[AshGodfrey]

Summary

• javav2: jackson-databind 2.22.1 → 2.22.4 (jsr310 and jdk8 to 2.22.4 to match the BOM; annotations stays at 2.22). Versions before 2.22.3 cache a deserializer per distinct polymorphic type id with no bound. The generated SDK's custom type-id resolver returns the Unknown* fallback for unrecognised discriminators, so a server returning many unique ids grows the static mapper's cache without limit (GHSA-wv8q-qhhj-9h54). 2.22.4 also clears the other open jackson-databind advisories, none of which are reachable from generated code.
• pythonv2: httpx2 floor >=2.10.0 → >=2.12.0 (opt-in client via httpClientLibrary: httpx2). Versions before 2.12.0 inflate each compressed read in a single allocation, so a compressed response bomb can exhaust client memory on any endpoint (GHSA-8xx6-hgc6-gc2m). The 2.12.0 floor also covers the two moderate httpx2 advisories. Python 3.10 users still resolve 2.14.x.

Patch releases within 2.22.x are drop-in; no behaviour changes. The review javav2 SDK pins jackson 2.16.0 through additionalDependencies to exercise that override, so no checked-in SDK output changes.

Test plan

• tsgo --project templates/templates/javav2 and pythonv2 pass
• prettier check on both config files
• CI javav2 and pythonv2 suites

---

Summary by cubic

Bumps jackson-databind to 2.22.4 and raises the httpx2 floor to 2.12.0 to close two memory-exhaustion advisories.

• jackson-databind before 2.22.3 caches a deserializer per distinct polymorphic type id with no bound; the generated client's Unknown* fallback lets a server with many unique discriminators grow the static mapper's cache without limit (GHSA-wv8q-qhhj-9h54). 2.22.4 bounds the cache and also covers the other open jackson-databind advisories. jackson-datatype-jsr310 and jackson-datatype-jdk8 move to 2.22.4 to match the BOM; annotations stays at 2.22.
• httpx2 before 2.12.0 inflates each compressed read in a single allocation, so a compressed response bomb can exhaust memory on any endpoint (GHSA-8xx6-hgc6-gc2m). The 2.12.0 floor also covers the two moderate httpx2 advisories; Python 3.10 users still resolve 2.14.x.

Both are patch-level, drop-in version bumps. The review javav2 SDK stays on jackson-databind 2.16.0 via additionalDependencies; its regenerated build.gradle picks up the datatype bumps but keeps databind pinned.

^{Written for commit d15ca41. Summary will update on new commits.}

[cubic-dev-ai]

No issues found across 3 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

<sub>Shadow auto-approve: would auto-approve. Patch-level dependency bumps in javav2 and pythonv2 templates (jackson modules to 2.22.4, httpx2 floor to 2.12.0) to close upstream memory-exhaustion CVEs; bounded version updates with no generated output changes.

View guided diff | Turn on auto-fix | Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 2 files (changes from recent commits).

<sub>Shadow auto-approve: would not auto-approve because issues were found.

View guided diff | Turn on auto-fix | Re-trigger cubic</sub>

[speakeasy-generator-bot]

Generator Snapshot Testing

Selector(s)	Result	Summary
snapshot-java, snapshot-python	✅	Snapshot run completed

Snapshot results: https://github.com/speakeasy-api/openapi-generation-snapshots/issues/130#issuecomment-6362579139

Snapshot results are summarized above. Additional run context is linked for maintainers with access.