Upgrade Jackson dependencies to 2.22.0 to address known security vulnerabilities #768

Activity

1. souravpattnaik431 commented on Jul 1, 2026

   

   souravpattnaik431

   on Jul 1, 2026

   Author

   More actions

   Also is there any roadmap to move to Jackson 3 (from tools.jackson)?
2. jbeckwith-oai commented on Jul 14, 2026

   

   jbeckwith-oai

   on Jul 14, 2026 – with ChatGPT Codex Connector

   Contributor

   More actions

   Thanks for flagging this. We've opened #777, which updates the SDK's published Jackson dependencies from 2.18.2 to 2.18.9.

   A couple of clarifications about the reported vulnerabilities:

   • The SDK's published default is Jackson 2.18.2, not 2.21.x. Jackson 2.21.x versions can appear in build-tool or resolved dependency graphs, but they are not the SDK's published default.
   • CVE-2026-54515 is fixed in Jackson 2.18.9. NVD currently lists 2.22.0 specifically as affected, so upgrading to exactly 2.22.0 would not address that advisory. Staying on the patched 2.18 line also minimizes compatibility risk for SDK consumers.
   • CVE-2026-24400 affects AssertJ rather than Jackson. The repository already uses the fixed AssertJ 3.27.7 release.

   #777 preserves the existing Jackson compatibility floor and adds test coverage against both the compatibility version and the published 2.18.9 version. It therefore addresses the security concern here without introducing a Jackson minor-line upgrade. A future Jackson 3 migration would be separate work.
3. jbeckwith-oai

   closed this as completedon Jul 15, 2026