[seonghobae]

Retirement by verified complete carryover

This PR is retired as a duplicate predecessor only after every valid delta was verified in canonical successor clearfolio #503. It is not being closed because the base moved, because Checks were slow, or because the repair was deferred.

Exact predecessor

• head: b3279eb75637ba5a1fb9cddf69aec9b87d830ba2;
• base: main@06633a25109c62e24a7015ae04fb9f6e0a246f7e;
• changed paths: pom.xml, CHANGELOG.md;
• intended delta: Jackson BOM 2.22.1 → 2.22.3 plus evidence for CVE-2026-68497, CVE-2026-91776, CVE-2026-91777, CVE-2026-19032, and CVE-2026-83557;
• exact-head CI 36933216516, Security 36933216623, SAST 36933216582, and fuzz 36933216552: GREEN;
• CodeQL 36933216537: queued at the final re-fetch and not used as merge evidence.

Complete successor proof

Canonical #503 exact head bf121dffff24e771739f50b9e2cc7961459670a2 completely carries this PR's valid delta:

#667 delta	#503 carryover
jackson-bom.version=2.22.3	same protected-base dependency repair
five-CVE RED evidence from #323/#454	recorded in #503 body and exact-head authority comment
CHANGELOG security rationale	preserved and expanded
dependency verification	stronger dependency-policy regression
release evidence	refreshed five-component CycloneDX hashes, purls, bom-refs, dependency edges, and third-party attribution
governance	expired OSV exception removed and docs/product-technical-gap-baseline.md updated

#503 changed paths strictly subsume the two #667 paths and add the canonical evidence/test bundle. Its exact-head Security 36824408486, CI 36824408492, SAST 36824408540, and fuzz 36824408531 are GREEN. CodeQL 36824408424 remains fail-closed pending terminal publication and independent approval is absent, so #503 remains Ready for admission but HOLD merge.

No unique functional, test, fixture, contract, documentation, or evidence delta remains only on #667.

Closure rationale

Close #667 only under the verified-complete-successor exception. Keep the branch and commits available for audit; do not delete or Force Push them. Downstream #323 and #454 now point to #503. No Checks were rerun, no synthetic event was created, and no bypass or merge was attempted.

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 42 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 38134e9b-2a15-430f-825f-8bc01378642e

📥 Commits

Reviewing files that changed from the base of the PR and between 06633a2 and b3279eb.

📒 Files selected for processing (2)

• CHANGELOG.md
• pom.xml

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Current authority — exact head b3279eb75637ba5a1fb9cddf69aec9b87d830ba2

The PR is open, Ready, and mechanically mergeable. Its two-file diff is limited to the Jackson 2.22.3 pin and CHANGELOG evidence. Fresh exact-head runs are admitted and currently queued: CI 36933216516, Security 36933216623, SAST 36933216582, fuzz 36933216552, CodeQL 36933216537.

Ready is review admission only. All nonterminal Checks and missing independent approval HOLD merge. The CodeRabbit capacity warning is not approval and is not bypass authority. No rerun, no-op commit, state toggle, Force Push, or predecessor evidence transfer is authorized.

[seonghobae]

Current authority — verified successor carryover

Re-fetch confirms exact head b3279eb75637ba5a1fb9cddf69aec9b87d830ba2 remains mechanically mergeable and its only changed paths are pom.xml and CHANGELOG.md. Canonical #503 exact head bf121dffff24e771739f50b9e2cc7961459670a2 contains both valid changes and the stronger regression/SBOM/attribution/OSV/Gap-baseline evidence bundle. #503 has absorbed the fresh #323/#454 five-CVE canaries and has exact-head Security 36824408486, CI 36824408492, SAST 36824408540, and fuzz 36824408531 GREEN. No unique valid delta remains on #667. This comment records the rationale before closure; the branch is preserved and #503 remains merge-blocked on CodeQL terminal publication and independent approval.