Skip to content

Add Jackson and PostgreSQL version mappings to build configuration#3996

Merged
strehle merged 1 commit into
developfrom
pin_fixed_in_versions
Jul 23, 2026
Merged

Add Jackson and PostgreSQL version mappings to build configuration#3996
strehle merged 1 commit into
developfrom
pin_fixed_in_versions

Conversation

@duanemay

Copy link
Copy Markdown
Member
NAME              INSTALLED  FIXED IN  TYPE          VULNERABILITY        SEVERITY  EPSS         RISK  
jackson-databind  2.21.4     2.21.5    java-archive  CVE-2026-59889       Medium    0.4% (34th)  0.2   
jackson-databind  3.1.4      3.1.5     java-archive  CVE-2026-59889       Medium    0.4% (34th)  0.2   
postgresql        42.7.11    42.7.12   java-archive  CVE-2026-54291       High      0.2% (14th)  0.2   
jackson-databind  2.21.4     2.21.5    java-archive  CVE-2026-54515       Medium    0.3% (26th)  0.2   
jackson-databind  2.21.4     2.21.5    java-archive  GHSA-mhm7-754m-9p8w  Medium    N/A          N/A

Copilot AI review requested due to automatic review settings July 23, 2026 17:08

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates the Gradle build’s Spring Boot dependency-version override properties to pin patched Jackson and PostgreSQL versions, addressing reported CVEs by ensuring the imported Spring Boot BOM resolves to the fixed artifacts.

Changes:

  • Add version-catalog entries for Jackson 3.x, Jackson 2.x, and PostgreSQL JDBC driver.
  • Wire those catalog versions into Spring Boot BOM override properties via extra[...] in the root build.gradle.kts.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

File Description
gradle/libs.versions.toml Adds jackson, jackson2, and postgresql version entries for centralized version pinning.
build.gradle.kts Sets Spring Boot dependency property overrides (jackson*-bom.version, postgresql.version) from the version catalog so BOM-managed versions are patched.

Comment thread gradle/libs.versions.toml
Comment on lines 16 to 19
jacoco = "4.0.2"
jackson = "3.1.5"
jackson2 = "2.21.5"
jacocoAgent = "0.8.15"
@github-project-automation github-project-automation Bot moved this from Inbox to Pending Merge | Prioritized in Foundational Infrastructure Working Group Jul 23, 2026
@strehle
strehle merged commit 08ddd15 into develop Jul 23, 2026
27 checks passed
@github-project-automation github-project-automation Bot moved this from Pending Merge | Prioritized to Done in Foundational Infrastructure Working Group Jul 23, 2026
@strehle
strehle deleted the pin_fixed_in_versions branch July 23, 2026 20:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Development

Successfully merging this pull request may close these issues.

3 participants