Skip to content

Conversation

dependabot[bot]
Copy link

@dependabot dependabot bot commented on behalf of github Jul 31, 2025

Bumps com.fasterxml.jackson.core:jackson-core from 2.10.3 to 2.15.0.

Changelog

Sourced from com.fasterxml.jackson.core:jackson-core's changelog.

#release configuration #Sun Apr 23 14:19:10 PDT 2023 scm.commentPrefix=[maven-release-plugin] exec.pomFileName=pom.xml pushChanges=false releaseStrategyId=default project.dev.com.fasterxml.jackson.core:jackson-core=2.15.1-SNAPSHOT project.scm.com.fasterxml.jackson.core:jackson-core.connection=scm:git:git@github.com:FasterXML/jackson-core.git scm.tag=jackson-core-2.15.0 remoteTagging=true project.scm.com.fasterxml.jackson.core:jackson-core.developerConnection=scm:git:git@github.com:FasterXML/jackson-core.git exec.additionalArguments=-Prelease scm.branchCommitComment=@{prefix} prepare branch @{releaseLabel} projectVersionPolicyId=default scm.url=scm:git:git@github.com:FasterXML/jackson-core.git scm.tagNameFormat=@{project.artifactId}-@{project.version} project.scm.com.fasterxml.jackson.core:jackson-core.tag=HEAD pinExternals=false project.rel.com.fasterxml.jackson.core:jackson-core=2.15.0 preparationGoals=clean verify scm.releaseCommitComment=@{prefix} prepare release @{releaseLabel} exec.snapshotReleasePluginAllowed=false project.scm.com.fasterxml.jackson.core:jackson-core.url=https://github.com/FasterXML/jackson-core scm.developmentCommitComment=@{prefix} prepare for next development iteration scm.rollbackCommitComment=@{prefix} rollback the release of @{releaseLabel} completedPhase=end-release

Commits
  • a2c0bdc [maven-release-plugin] prepare release jackson-core-2.15.0
  • 180027a Prepare for 2.15.0 release
  • 2b41925 ...
  • 85340aa Merge branch '2.14' into 2.15
  • ed846d9 ...
  • 94ea208 Update release notes wrt #990
  • a4f2086 [2.14 only] backport removal of BigDecimal to BigInt conversion (#990)
  • 1976c0d Try to get Release workflow working wrt SLSA provenance (fix #844) (#989)
  • 0ee3ad8 ...
  • 163540e [maven-release-plugin] prepare for next development iteration
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [com.fasterxml.jackson.core:jackson-core](https://github.com/FasterXML/jackson-core) from 2.10.3 to 2.15.0.
- [Changelog](https://github.com/FasterXML/jackson-core/blob/jackson-core-2.15.0/release.properties)
- [Commits](FasterXML/jackson-core@jackson-core-2.10.3...jackson-core-2.15.0)

---
updated-dependencies:
- dependency-name: com.fasterxml.jackson.core:jackson-core
  dependency-version: 2.15.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file java Pull requests that update java code labels Jul 31, 2025
@jpeaks-eroad
Copy link

Logo
Checkmarx One – Scan Summary & Details134b8586-f47e-4bef-9c86-346972613e85

New Issues (4)

Checkmarx found the following issues in this Pull Request

Severity Issue Source File / Package Checkmarx Insight
HIGH CVE-2025-52999 Maven-com.fasterxml.jackson.core:jackson-core-2.10.3
detailsRecommended version: 2.15.0
Description: The jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. In versions pr...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: k4bSniNc9safJ7rSUy69gRxWuQAVQOgMC9AzW%2Bypvp0%3D
Vulnerable Package
MEDIUM CVE-2025-49128 Maven-com.fasterxml.jackson.core:jackson-core-2.10.3
detailsRecommended version: 2.15.0
Description: Jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. In com.fasterxml.j...
Attack Vector: LOCAL
Attack Complexity: LOW

ID: tGpYZbxzwp5E5AOHzd4i97nDjigrGrAv52yodQ7Yg8I%3D
Vulnerable Package
MEDIUM CVE-2025-53864 Maven-com.google.code.gson:gson-2.8.5
detailsRecommended version: 2.12.0
Description: Connect2id Nimbus JOSE + JWT allows a remote attacker to cause a Denial-of-Service (DoS) via a deeply nested JSON object supplied in a JWT claim se...
Attack Vector: NETWORK
Attack Complexity: LOW

ID: KtroJJnaPi1a5AcjHSpG6hmi72ZDWgDBGWoNNiBCzfk%3D
Vulnerable Package
LOW Unpinned Actions Full Length Commit SHA /stale_issue.yml: 13
detailsPinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA help...
ID: t7QLW7aAeEY99HHKqLRYUX2tA9o%3D
Fixed Issues (31)

Great job! The following issues were fixed in this Pull Request

Severity Issue Source File / Package
HIGH CVE-2018-1000180 Gradle-org.bouncycastle:bcprov-jdk15on-1.56
HIGH CVE-2018-1000613 Gradle-org.bouncycastle:bcprov-jdk15on-1.56
HIGH CVE-2019-17359 Gradle-org.bouncycastle:bcprov-jdk15on-1.56
HIGH CVE-2021-35515 Gradle-org.apache.commons:commons-compress-1.12
HIGH CVE-2021-35516 Gradle-org.apache.commons:commons-compress-1.12
HIGH CVE-2021-35517 Gradle-org.apache.commons:commons-compress-1.12
HIGH CVE-2021-36090 Gradle-org.apache.commons:commons-compress-1.12
HIGH CVE-2022-3171 Gradle-com.google.protobuf:protobuf-java-3.10.0
HIGH CVE-2022-3509 Gradle-com.google.protobuf:protobuf-java-3.10.0
HIGH Cxa9261daf-3755 Gradle-org.bouncycastle:bcprov-jdk15on-1.56
HIGH Cxdfe95b9f-ea87 Gradle-org.jetbrains.kotlin:kotlin-compiler-embeddable-1.3.72
MEDIUM Absolute_Path_Traversal /samples/Identity/src/main/java/identity/FleetProvisioningSample.java: 206
MEDIUM Absolute_Path_Traversal /samples/Greengrass/src/main/java/greengrass/BasicDiscovery.java: 138
MEDIUM Absolute_Path_Traversal /samples/Greengrass/src/main/java/greengrass/BasicDiscovery.java: 138
MEDIUM Absolute_Path_Traversal /samples/Greengrass/src/main/java/greengrass/BasicDiscovery.java: 138
MEDIUM CVE-2018-11771 Gradle-org.apache.commons:commons-compress-1.12
MEDIUM CVE-2018-1324 Gradle-org.apache.commons:commons-compress-1.12
MEDIUM CVE-2020-13956 Gradle-org.apache.httpcomponents:httpclient-4.5.6
MEDIUM CVE-2020-15522 Gradle-org.bouncycastle:bcprov-jdk15on-1.56
MEDIUM CVE-2020-17521 Gradle-org.codehaus.groovy:groovy-all-2.4.15
MEDIUM CVE-2020-26939 Gradle-org.bouncycastle:bcprov-jdk15on-1.56
MEDIUM CVE-2020-29582 Gradle-org.jetbrains.kotlin:kotlin-compiler-embeddable-1.3.72
MEDIUM CVE-2021-22569 Gradle-com.google.protobuf:protobuf-java-3.10.0
MEDIUM Unchecked_Input_for_Loop_Condition /samples/PubSubStress/src/main/java/pubsubstress/PubSubStress.java: 314
MEDIUM Unchecked_Input_for_Loop_Condition /samples/PubSubStress/src/main/java/pubsubstress/PubSubStress.java: 314
MEDIUM Unchecked_Input_for_Loop_Condition /samples/PubSubStress/src/main/java/pubsubstress/PubSubStress.java: 314
MEDIUM Unchecked_Input_for_Loop_Condition /samples/BasicPubSub/src/main/java/pubsub/PubSub.java: 201
MEDIUM Unchecked_Input_for_Loop_Condition /samples/RawPubSub/src/main/java/rawpubsub/RawPubSub.java: 144
LOW CVE-2020-8908 Gradle-com.google.guava:guava-28.1-jre
LOW Cxeb68d52e-5509 Gradle-commons-codec:commons-codec-1.10
LOW Heap_Inspection /samples/RawPubSub/src/main/java/rawpubsub/RawPubSub.java: 37

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file java Pull requests that update java code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant