From 64f8145b8de88a0e852b8c21fefdac6a7a073c4a Mon Sep 17 00:00:00 2001 From: Prashant Srivastava Date: Tue, 7 Jul 2026 14:17:55 -0700 Subject: [PATCH 1/2] bump jackson to 2.18.8 to address CVE-2026-54512 and CVE-2026-54513 Bumps jackson-bom and jackson-datatype from 2.18.6 to 2.18.8 to remediate two HIGH severity jackson-databind CVEs flagged by the daily dependency scan: - CVE-2026-54512: arbitrary code execution via PolymorphicTypeValidator bypass - CVE-2026-54513: security bypass allowing arbitrary code execution Both are fixed in jackson-databind 2.18.8. Verified the dependency tree resolves jackson-databind to 2.18.8. Co-Authored-By: Claude Opus 4.7 --- dependencyManagement/build.gradle.kts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/dependencyManagement/build.gradle.kts b/dependencyManagement/build.gradle.kts index ac32fc23..07d597e4 100644 --- a/dependencyManagement/build.gradle.kts +++ b/dependencyManagement/build.gradle.kts @@ -5,14 +5,14 @@ plugins { data class DependencySet(val group: String, val version: String, val modules: List) val DEPENDENCY_BOMS = listOf( - "com.fasterxml.jackson:jackson-bom:2.18.6", + "com.fasterxml.jackson:jackson-bom:2.18.8", "org.junit:junit-bom:5.8.2" ) val DEPENDENCY_SETS = listOf( DependencySet( "com.fasterxml.jackson.datatype", - "2.18.6", + "2.18.8", listOf("jackson-datatype-jsr310") ), DependencySet( From 92e8f8cf2c76e522f3850275d4999fc485888e48 Mon Sep 17 00:00:00 2001 From: Prashant Srivastava Date: Wed, 8 Jul 2026 10:39:44 -0700 Subject: [PATCH 2/2] fix macOS CI: upgrade setup-java to v5 with zulu distribution The pinned setup-java v1.4.4 defaulted to architecture x64, which fails on the now-ARM64 macos-latest runners (JAVA_HOME points to a nonexistent x64 JDK path). Upgrades to setup-java v5.0.0 with the zulu distribution, which publishes JDK 8 and 11 for macOS aarch64, so all matrix cells provision a native JDK. Matches the SHA already used in daily-scan.yml. Co-Authored-By: Claude Opus 4.7 --- .github/workflows/pr-build.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/pr-build.yml b/.github/workflows/pr-build.yml index 4a81f31d..ca525e85 100644 --- a/.github/workflows/pr-build.yml +++ b/.github/workflows/pr-build.yml @@ -29,9 +29,10 @@ jobs: uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 #v2.7.0 - name: Setup java - uses: actions/setup-java@b6e674f4b717d7b0ae3baee0fbe79f498905dfde #v1.4.4 + uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 #v5.0.0 with: java-version: ${{ matrix.java }} + distribution: 'zulu' - name: Cache Gradle Modules uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 #v4.3.0