From 7e4d26ad96e5d6aec4e6651d09638527d0f84432 Mon Sep 17 00:00:00 2001 From: Ash Godfrey Date: Fri, 23 Oct 2026 09:07:32 +0100 Subject: [PATCH 1/2] fix(java,python): bump jackson-databind to 2.22.4 and the httpx2 floor to 2.12.0 jackson-databind before 2.22.3 caches a deserializer for every distinct polymorphic type id with no bound. The generated SDK's custom type-id resolver returns the Unknown fallback for unrecognised discriminators, so a server returning many unique ids grows the static mapper's cache without limit. 2.22.4 bounds the cache; jsr310 and jdk8 move with it to match the BOM. httpx2 before 2.12.0 inflates each compressed read in a single allocation, so a compressed response bomb can exhaust client memory on any endpoint. The floor moves to 2.12.0, which bounds decompression output. Co-Authored-By: Claude --- .changesets/1792742734-f1c0ed3e.yaml | 11 +++++++++++ templates/templates/javav2/config.ts | 6 +++--- templates/templates/pythonv2/config.ts | 2 +- 3 files changed, 15 insertions(+), 4 deletions(-) create mode 100644 .changesets/1792742734-f1c0ed3e.yaml diff --git a/.changesets/1792742734-f1c0ed3e.yaml b/.changesets/1792742734-f1c0ed3e.yaml new file mode 100644 index 000000000..232012f86 --- /dev/null +++ b/.changesets/1792742734-f1c0ed3e.yaml @@ -0,0 +1,11 @@ +id: 1792742734-f1c0ed3e +features: + - core +targets: + - javav2 + - pythonv2 +type: fix +bump: patch +description: bump jackson-databind to 2.22.4 and the httpx2 floor to 2.12.0 to pick up upstream fixes for unbounded type-id caching and streaming decompression memory use +author: AshGodfrey +date: "2026-10-23" diff --git a/templates/templates/javav2/config.ts b/templates/templates/javav2/config.ts index e06fd5239..fb37a8766 100644 --- a/templates/templates/javav2/config.ts +++ b/templates/templates/javav2/config.ts @@ -14,21 +14,21 @@ function getTemplateDependencies() { }, "com.fasterxml.jackson.core:jackson-databind": { name: "com.fasterxml.jackson.core:jackson-databind", - version: "2.22.1", + version: "2.22.4", cpe: "cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:java:*:*", ecosystem: "Maven", category: "runtime", }, "com.fasterxml.jackson.datatype:jackson-datatype-jsr310": { name: "com.fasterxml.jackson.datatype:jackson-datatype-jsr310", - version: "2.22.0", + version: "2.22.4", cpe: "cpe:2.3:a:fasterxml:jackson-datatype-jsr310:*:*:*:*:*:java:*:*", ecosystem: "Maven", category: "runtime", }, "com.fasterxml.jackson.datatype:jackson-datatype-jdk8": { name: "com.fasterxml.jackson.datatype:jackson-datatype-jdk8", - version: "2.22.0", + version: "2.22.4", cpe: "cpe:2.3:a:fasterxml:jackson-datatype-jdk8:*:*:*:*:*:java:*:*", ecosystem: "Maven", category: "runtime", diff --git a/templates/templates/pythonv2/config.ts b/templates/templates/pythonv2/config.ts index e441cf95b..418cfa04a 100644 --- a/templates/templates/pythonv2/config.ts +++ b/templates/templates/pythonv2/config.ts @@ -22,7 +22,7 @@ function getTemplateDependencies() { }, httpx2: { name: "httpx2", - version: ">=2.10.0", + version: ">=2.12.0", cpe: "cpe:2.3:a:pydantic:httpx2:*:*:*:*:*:python:*:*", ecosystem: "PyPI", category: "runtime", From d15ca415b69ec104a450b04b62564fb9751bf934 Mon Sep 17 00:00:00 2001 From: Ash Godfrey Date: Fri, 23 Oct 2026 09:28:19 +0100 Subject: [PATCH 2/2] chore(java): regenerate the review SDK for the jackson datatype bump Co-Authored-By: Claude --- zSDKs/sdk-javav2/.speakeasy/gen.lock | 2 +- zSDKs/sdk-javav2/build.gradle | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/zSDKs/sdk-javav2/.speakeasy/gen.lock b/zSDKs/sdk-javav2/.speakeasy/gen.lock index 25c8b0ff3..9ffd38168 100644 --- a/zSDKs/sdk-javav2/.speakeasy/gen.lock +++ b/zSDKs/sdk-javav2/.speakeasy/gen.lock @@ -55,7 +55,7 @@ trackedFiles: USAGE.md: last_write_checksum: sha1:fbfd5c561abbbf7ddfaaf2c470f9405aea851c5c build.gradle: - last_write_checksum: sha1:b577e4b21e9facbdcb32a4e052f25060a5070561 + last_write_checksum: sha1:fd944f72958f72269dcbdecf2161f7558c35921a docs/models/bar/Bike.md: last_write_checksum: sha1:eb80c64e76fad367879aec3fbf8eb5cad9adedf0 docs/models/bar/Car.md: diff --git a/zSDKs/sdk-javav2/build.gradle b/zSDKs/sdk-javav2/build.gradle index 9d4607115..edfd5f0d1 100644 --- a/zSDKs/sdk-javav2/build.gradle +++ b/zSDKs/sdk-javav2/build.gradle @@ -116,8 +116,8 @@ dependencies { implementation 'com.fasterxml.jackson.core:jackson-databind:2.16.0' api 'org.apache.commons:commons-compress:1.26.1' api 'com.fasterxml.jackson.core:jackson-annotations:2.22' - implementation 'com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.22.0' - implementation 'com.fasterxml.jackson.datatype:jackson-datatype-jdk8:2.22.0' + implementation 'com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.22.4' + implementation 'com.fasterxml.jackson.datatype:jackson-datatype-jdk8:2.22.4' api('org.openapitools:jackson-databind-nullable:0.2.6') {exclude group: 'com.fasterxml.jackson.core', module: 'jackson-databind'} implementation 'commons-io:commons-io:2.18.0' implementation 'jakarta.annotation:jakarta.annotation-api:3.0.0'