FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

fix(deps): security update — 1 package(s) [risk: LOW] by aniket-shikhare-cstk · Pull Request #290 · contentstack/contentstack-java · GitHub

/ contentstack-java Public

fix(deps): security update — 1 package(s) [risk: LOW] - #290

Merged
aniket-shikhare-cstk merged 1 commit into
developmentfrom
snykr-fix/2026-04-21
Apr 21, 2026
ConversationCommits (1)ChecksFiles changed
Merged

fix(deps): security update — 1 package(s) [risk: LOW]#290
aniket-shikhare-cstk merged 1 commit into
developmentfrom
snykr-fix/2026-04-21

Conversation

aniket-shikhare-cstk commented Apr 21, 2026

Copy link
Copy Markdown
Contributor

Security Fix — SnykrAI

Verification

  • Dependencies resolve
  • Build passes (mvn compile -q)
  • Tests pass (mvn test -q)

Risk: LOW

Patch-level upgrade. Bug/security fixes only, safe to merge.

Vulnerabilities Addressed

HIGH: Allocation of Resources Without Limits or Throttling

Detail Value
Package com.fasterxml.jackson.core:jackson-core@2.21.1
Dependency type Transitive
CWE CWE-770
CVSS 8.7
Vulnerable range [2.8.0,2.21.2)
Fixed in 2.21.2
Snyk ID SNYK-JAVA-COMFASTERXMLJACKSONCORE-15907551
Published 2026-04-05

Dependency Upgrades

Package From To Risk Reasoning
com.fasterxml.jackson.core:jackson-databind 2.21.1 2.21.2 patch Upgrading jackson-databind to 2.21.2 as specified in Snyk's fixed_in field; jackson-core is part of the same Jackson ...

Changelog & Impact Analysis

com.fasterxml.jackson.core:jackson-databind (2.21.1 → 2.21.2)

Registry: https://central.sonatype.com/artifact/com.fasterxml.jackson.core/jackson-databind/2.21.2

No changelog available from registry. Manual review recommended.

Not Fixed — Remediation Guidance

• com.fasterxml.jackson.core:jackson-core@2.21.1 — Wait for upstream fix: Since jackson-core is a transitive dependency of jackson-databind, the practical path is to upgrade jackson-databind to 2.21.2, which will pull in the corrected jackson-core version transitively. Monitor the jackson-databind 2.21.2 release to confirm the aligned jackson-core dependency, then update your pom.xml accordingly.

Metadata
LLM Provider anthropic
Strategy conservative
Total issues 2
Fixable 1
Ecosystem maven
Generated 2026-04-21 05:34 UTC

Automated by SnykrAI — draft PR, needs human review before merging.

github-actions Bot commented Apr 21, 2026

Copy link
Copy Markdown

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type Count (with fixes) Without fixes Threshold Result
🔴 Critical Severity 0 0 10 ✅ Passed
🟠 High Severity 0 0 25 ✅ Passed
🟡 Medium Severity 0 0 500 ✅ Passed
🔵 Low Severity 1 0 1000 ✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity Breaches (with fixes) Breaches (no fixes) SLA Threshold (with/no fixes) Status
🔴 Critical 0 0 15 / 30 days ✅ Passed
🟠 High 0 0 30 / 120 days ✅ Passed
🟡 Medium 0 0 90 / 365 days ✅ Passed
🔵 Low 0 0 180 / 365 days ✅ Passed

✅ BUILD PASSED - All security checks passed

github-actions Bot commented Apr 21, 2026 •
edited
Loading

Copy link
Copy Markdown

Coverage Summary

  • 📘 Instruction Coverage: 93%
  • 🌿 Branch Coverage: 80%

aniket-shikhare-cstk marked this pull request as ready for review April 21, 2026 00:06
aniket-shikhare-cstk requested a review from a team as a code owner April 21, 2026 00:06
sunil-lakshman approved these changes Apr 21, 2026
View reviewed changes

sunil-lakshman left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

LGTM

netrajpatel approved these changes Apr 21, 2026
View reviewed changes

netrajpatel left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

LGTM // approved in Slack with WorkerB

github-actions Bot commented Apr 21, 2026

Copy link
Copy Markdown

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type Count (with fixes) Without fixes Threshold Result
🔴 Critical Severity 0 0 10 ✅ Passed
🟠 High Severity 0 0 25 ✅ Passed
🟡 Medium Severity 0 0 500 ✅ Passed
🔵 Low Severity 1 0 1000 ✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity Breaches (with fixes) Breaches (no fixes) SLA Threshold (with/no fixes) Status
🔴 Critical 0 0 15 / 30 days ✅ Passed
🟠 High 0 0 30 / 120 days ✅ Passed
🟡 Medium 0 0 90 / 365 days ✅ Passed
🔵 Low 0 0 180 / 365 days ✅ Passed

✅ BUILD PASSED - All security checks passed

fix(deps): update 2 dependencies
390ca5f 
Updated packages: com.fasterxml.jackson.core:jackson-core, com.fasterxml.jackson.core:jackson-databind.

Security maintenance update.

github-actions Bot commented Apr 21, 2026

Copy link
Copy Markdown

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type Count (with fixes) Without fixes Threshold Result
🔴 Critical Severity 0 0 10 ✅ Passed
🟠 High Severity 0 0 25 ✅ Passed
🟡 Medium Severity 0 0 500 ✅ Passed
🔵 Low Severity 1 0 1000 ✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity Breaches (with fixes) Breaches (no fixes) SLA Threshold (with/no fixes) Status
🔴 Critical 0 0 15 / 30 days ✅ Passed
🟠 High 0 0 30 / 120 days ✅ Passed
🟡 Medium 0 0 90 / 365 days ✅ Passed
🔵 Low 0 0 180 / 365 days ✅ Passed

✅ BUILD PASSED - All security checks passed

aniket-shikhare-cstk merged commit c013c64 into development Apr 21, 2026
10 checks passed
reeshika-h deleted the snykr-fix/2026-04-21 branch June 16, 2026 12:06
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

netrajpatel netrajpatel approved these changes
cs-raj Awaiting requested review from cs-raj
+1 more reviewer
sunil-lakshman sunil-lakshman approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

Back | FazBrowse Home | New Git URL