Jackson version bump to 2.18.9 - #635
Conversation
Sorry, something went wrong.
There was a problem hiding this comment.
Pull request overview
Warning
Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.
This PR upgrades the Jackson dependency version used by aws-lambda-java-serialization to address reported CVEs, and bumps the tests module to consume the new serialization version.
Changes:
- Bump aws-lambda-java-serialization Jackson version from 2.18.6 to 2.18.9.
- Update aws-lambda-java-tests to depend on aws-lambda-java-serialization 1.4.2.
- Add a 1.4.2 entry to the serialization release changelog.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| aws-lambda-java-tests/pom.xml | Updates tests module to use serialization 1.4.2. |
| aws-lambda-java-serialization/pom.xml | Bumps Jackson version property to 2.18.9. |
| aws-lambda-java-serialization/RELEASE.CHANGELOG.md | Documents the 1.4.2 release and dependency bump. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Sorry, something went wrong.
Codecov Report✅ All modified and coverable lines are covered by tests. @@ Coverage Diff @@
## main #635 +/- ##
============================================
+ Coverage 65.38% 65.79% +0.40%
- Complexity 212 213 +1
============================================
Files 34 34
Lines 991 991
Branches 143 143
============================================
+ Hits 648 652 +4
+ Misses 290 287 -3
+ Partials 53 52 -1 ☔ View full report in Codecov by Harness.
|
Sorry, something went wrong.
| --> | ||
| <junit.version>5.9.2</junit.version> | ||
| <jacoco.maven.plugin.version>0.8.7</jacoco.maven.plugin.version> | ||
| <aws-lambda-java-serialization.version>1.4.1</aws-lambda-java-serialization.version> |
There was a problem hiding this comment.
It's fine but we need to remember of releasing also this package in the followup PR.
Sorry, something went wrong.
There was a problem hiding this comment.
actually I was wrong. The test are exercised locally but you need to have the same version, otherwise it will fail the test, because it is registered locally as 1.4.1.
Sorry, something went wrong.
There was a problem hiding this comment.
Cool, I'll revert this then
Sorry, something went wrong.
Issue #, if available:
Description of changes:
Upgrade jackson dependency version to 2.18.9 in the serialization package to address the following CVE reports CVE-2026-54512 and CVE-2026-54513
Will update tests package separately after maven workflow's auto version bump for serialization
Target (OCI, Managed Runtime, both):
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.