Update jackson monorepo to v2.22.4 by renovate[bot] · Pull Request #613 · sir-gon/algorithm-exercises-java

renovate · 2026-10-18T01:13:05Z

This PR contains the following updates:

Package	Change	Age	Confidence
com.fasterxml.jackson.core:jackson-databind (source)	`2.22.3` → `2.22.4`
com.fasterxml.jackson.core:jackson-core	`2.22.3` → `2.22.4`

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

fossabot · 2026-10-18T01:13:09Z

Needs Review

I recommend reviewing this upgrade before merging because an external CI check from Snyk is failing, and its logs cannot be analyzed — per policy, this alone requires human review. The upgrade itself is a patch release of com.fasterxml.jackson.core:jackson-databind and com.fasterxml.jackson.core:jackson-core (the legitimate packages) and does not involve the malicious typosquatted package (org.fasterxml.*), which is a separate threat entirely and does not affect this PR. The codebase actively uses these libraries — ObjectMapper is imported and instantiated in JsonLoader.java — and the upgrade ships genuine security hardening around polymorphic type validation, along with parser robustness fixes in jackson-core. A notable behavior change accompanies the security hardening: arrays of abstract or interface element types are no longer accepted without an explicit allow-list entry when using BasicPolymorphicTypeValidator or enableDefaultTyping-style validation. The current usage in JsonLoader.java appears limited to basic readerForListOf deserialization and is unlikely to be affected, but the Snyk failure and the polymorphic-type behavior change together warrant a quick human confirmation before merging.

Tip: Comment @fossabot fix to attempt automatic fixes.

Fix Suggestions

We identified 1 fixable issue in this upgrade.

Review the failing Snyk CI check to confirm it is unrelated to the jackson-core/jackson-databind 2.22.4 upgrade
Files: algorithm-exercises-java/build.gradle

AI Assistant Prompt

Copy prompt for AI assistant

# Dependency Upgrade Review: jackson-databind & jackson-core → 2.22.4

## Context
PR #613 in `algorithm-exercises-java` upgrades `com.fasterxml.jackson.core:jackson-databind` and `com.fasterxml.jackson.core:jackson-core` to version 2.22.4. This is a patch release with security hardening and bug fixes.

## What Changed in 2.22.4
- **Security**: Three fixes close polymorphic type validation bypasses. If using `BasicPolymorphicTypeValidator` or `enableDefaultTyping` with abstract/interface array element types, those element types must now be explicitly allow-listed (e.g., `allowIfSubType(Bar.class)`).
- **Bug fixes**: 25 fixes across both libraries addressing thread-safety in bean introspection, `@JsonIgnore` bypass, multiple NPE paths, and non-blocking parser correctness issues.

## Action Required

### 1. Review `build.gradle` for correct dependency versions
Open `build.gradle` and confirm that `jackson-databind` and `jackson-core` are both set to `2.22.4` and use the correct group ID `com.fasterxml.jackson.core` (NOT `org.fasterxml.*`, which is a known malicious typosquat).

### 2. Check `JsonLoader.java` for compatibility
This file imports and uses `ObjectMapper` with `readerForListOf` deserialization. Review it to confirm:
- No usage of `BasicPolymorphicTypeValidator` or `enableDefaultTyping` that would be affected by the new array element type restriction.
- No deserialization of abstract/interface array types without explicit allow-listing.
- The current basic usage pattern should be unaffected, but please verify.

### 3. Investigate failing Snyk CI check (MANUAL — cannot be automated)
The Snyk security check (`security/snyk`) is failing. Its logs are not available programmatically. Please:
1. Visit: https://app.snyk.io/org/sir-gon/pr-checks/c4fa3853-37e5-4d24-8578-451806c2355f
2. Determine if the failure is related to this jackson upgrade or is a pre-existing/unrelated issue.
3. If related to the upgrade, report what Snyk flagged so we can address it.
4. If unrelated, confirm it's safe to merge.

## Summary
The upgrade itself is low-risk for this codebase since `JsonLoader.java` uses basic deserialization only. The main blocker is the unexplained Snyk CI failure, which requires manual investigation.

What we checked

com.fasterxml.jackson.core:jackson-core:2.22.4 declared as a direct implementation dependency — confirms this is an actively declared, upgraded package. ^[1]
com.fasterxml.jackson.core:jackson-databind:2.22.4 declared as a direct implementation dependency — confirms active use of the upgraded package. ^[2]
import com.fasterxml.jackson.databind.ObjectMapper — the project directly imports ObjectMapper from jackson-databind, confirming runtime dependency on the upgraded library. ^[3]
ObjectMapper is instantiated and readerForListOf(type).readValue(...) is called. This is standard deserialization without custom polymorphic type handling, so the behavior changes in BasicPolymorphicTypeValidator are unlikely to affect this usage path. ^[4]
A malicious typosquatted package using the org.fasterxml.jackson.core prefix (instead of the legitimate com.fasterxml.jackson.core) was published to Maven Central. This PR upgrades the legitimate com.fasterxml.* packages, so it is not affected by this threat. Developers should remain alert to any accidental introduction of org.fasterxml.* coordinates in future dependency changes. ^[5]
The security/snyk (sir-gon) CI check is failing. Snyk is an unsupported CI provider — its logs cannot be inspected to determine whether the failure is related to this upgrade. Per policy, an unanalyzable CI failure from an external security tool requires human review before merging. ^[6]

Dependency Usage

No usage of the analyzed dependencies was found in this repository.

com.fasterxml.jackson.core:jackson-core:2.22.4 declared as a direct implementation dependency — confirms this is an actively declared, upgraded package.

algorithm-exercises-java/algorithm-exercises-java/build.gradle

Line 39 in fd0f3bb

implementation 'com.fasterxml.jackson.core:jackson-core:2.22.4'
com.fasterxml.jackson.core:jackson-databind:2.22.4 declared as a direct implementation dependency — confirms active use of the upgraded package.

algorithm-exercises-java/algorithm-exercises-java/build.gradle

Line 41 in fd0f3bb

implementation 'com.fasterxml.jackson.core:jackson-databind:2.22.4'

View 2 more usages

import com.fasterxml.jackson.databind.ObjectMapper — the project directly imports ObjectMapper from jackson-databind, confirming runtime dependency on the upgraded library.

algorithm-exercises-java/algorithm-exercises-java/src/main/java/util/JsonLoader.java

Line 3 in fd0f3bb

import com.fasterxml.jackson.databind.ObjectMapper;
ObjectMapper is instantiated and readerForListOf(type).readValue(...) is called. This is standard deserialization without custom polymorphic type handling, so the behavior changes in BasicPolymorphicTypeValidator are unlikely to affect this usage path.

algorithm-exercises-java/algorithm-exercises-java/src/main/java/util/JsonLoader.java

Line 15 in fd0f3bb

ObjectMapper objectMapper = new ObjectMapper();

Changes

Three security fixes in jackson-databind close a polymorphic type validation bypass where gadget classes could be smuggled through generic type parameters or array element types — consumers using BasicPolymorphicTypeValidator or enableDefaultTyping with abstract/interface array types must explicitly allow-list those element types (e.g., allowIfSubType(Bar.class)), as arrays of such types are no longer implicitly accepted. Additionally, 25 bug fixes across jackson-databind and jackson-core address thread-safety races in bean introspection, @JsonIgnore bypass via renamed properties, multiple NullPointerException paths in deserializers, and widespread non-blocking parser correctness issues including surrogate pair handling and end-of-input detection.

Fixed [REDACTED-CVE] in polymorphic type handling: element types of array type ids and classes named as generic type parameters (e.g. java.util.ArrayList<EvilGadget>) are now validated as if they were named directly as type ids, so a name-based allow-list for a container can no longer be bypassed by smuggling a gadget class in as a type argument or array element (v2.22.4, package source)
Behavior change from the [REDACTED-CVE] fix: with BasicPolymorphicTypeValidator and enableDefaultTyping-style validation, arrays of abstract or interface element types are no longer accepted without an explicit allow-list entry. Consumers relying on this must add the element types to the allow-list (e.g. allowIfSubType(Bar.class), or allowIfSubType(Bar[].class) to cover the array and its element type). Arrays of primitives and Number[] remain accepted implicitly. (v2.22.4, package source)
Behavior change: when a configured validator approves a polymorphic base type, Jackson now uses the new ApprovedBaseTypeValidator (instead of LaissezFaireSubTypeValidator), so classes used as type parameters of a generic type id are still validated. Generic type ids that previously worked without allow-listing their type parameters may now fail with InvalidTypeIdException (v2.22.4, package source)

View 36 more changes

Fixed @JsonValue self-reference: when the @JsonValue accessor returns the POJO itself, Jackson now detects the direct cycle and throws a clear error (Direct self-reference leading to cycle) under FAIL_ON_SELF_REFERENCES, or writes null under WRITE_SELF_REFERENCES_AS_NULL (databind#6206) (v2.22.4, package source)
Deeper @JsonValue cycles that overflow the stack are now reported as JsonMappingException ("Infinite recursion (StackOverflowError)") with the property path, instead of a raw StackOverflowError (databind#6206) (v2.22.4, package source)
Improved thread-safety of bean introspection for shared BeanDescription / POJOPropertiesCollector instances: lazy initialization of properties, default views, and property collection is now synchronized, and the _collected flag is volatile (databind#6227) (v2.22.4, package source)
Fixed race condition in BasicBeanDescription.findDefaultViews() where another thread could observe the 'resolved' flag before the default views were assigned and receive null; the value is now assigned before the flag (databind#6227) (v2.22.4, package source)
Fixed @JsonIgnore semantics for renamed properties: inferred non-visible field mutators are now stripped during deserialization so they cannot bypass an ignored setter. Serialization still keeps fields for annotation merging (databind#5967) (v2.22.4, package source)
Handled parsers that report a VALUE_STRING token without text (e.g. Ion parser with corrupt content) across many standard deserializers (primitives, wrappers, numbers, BigInteger/BigDecimal, Date, Enum, Collection, arrays, Path, Boolean, String collections, and type-id resolution). These now fail through the normal handleUnexpectedToken path instead of throwing a NullPointerException (v2.22.4, package source)
Fixed NullPointerException when deserializing String values with an empty-string check via ObjectArrayDeserializer, StringArrayDeserializer, StringCollectionDeserializer, and PrimitiveArrayDeserializers when the parser returns null text (v2.22.4, package source)
Fixed AsPropertyTypeDeserializer with ACCEPT_EMPTY_STRING_AS_NULL_OBJECT and AsArrayTypeDeserializer to avoid null text dereference (v2.22.4, package source)
Added PolymorphicTypeValidator.isArrayTypeAllowedExplicitly(MapperConfig, JavaType, JavaType) (default returns false). BasicPolymorphicTypeValidator overrides it so that an array type passed to Builder.allowIfSubType(Class) (e.g. Bar[].class) also covers its element type (v2.22.4, package source)
Added public SubTypeValidator.isIllegalType(Class<?>) method that reports whether a class is on the deny list of known gadget types, for use by custom code (v2.22.4, package source)
Added ClassUtil.isArraySuperType(Class<?>) utility, and a new BasicPolymorphicTypeValidator.Builder option that records explicitly allowed array types (protected constructor overload with an extra Set<Class<?>> parameter added) (v2.22.4, package source)
Upgraded test dependency ByteBuddy from 1.15.10 to 1.18.15, and load the ByteBuddy agent via -javaagent for JDK 21+ test runs instead of dynamic self-attach (v2.22.4, package source)
Updated version metadata (PackageVersion, MANIFEST, pom.xml, parent jackson-base) to 2.22.4 and refreshed the reproducible-build timestamp (v2.22.4, package source)
FilteringGeneratorDelegate: writeRawValue(...), writeRawUTF8String(...) and writeUTF8String(...) now treat raw writes as full values via the new _checkRawValueWriteAsValue(), so array element indexes advance correctly and filtering is applied to raw values. (v2.22.4, package source)
FilteringGeneratorDelegate: binary value writes now call TokenFilterContext.checkValue() so array element index tracking stays correct, and use includeBinary() on the resulting state. (v2.22.4, package source)
Decimal point handling for numbers: a number with a decimal point and no following digit (e.g. "1.") is rejected unless ALLOW_TRAILING_DECIMAL_POINT_FOR_NUMBERS is enabled. The check is now shared across the blocking and non-blocking parsers (core#1746). (v2.22.4, package source)
Non-blocking (async) parser: a leading '.' is now handled consistently. It is accepted only when ALLOW_LEADING_DECIMAL_POINT_FOR_NUMBERS is enabled, and otherwise reported as an unexpected character (core#611, core#1746). (v2.22.4, package source)
Leading-zero and negative-zero numbers are parsed more consistently across parsers. Anything other than a digit, decimal point or exponent after '0' now ends the number, and the error is reported as a missing separator (root level) or missing comma (inside containers). '+' is no longer included in number text, and a leading '-' is kept only for '-0' and negative values. (v2.22.4, package source)
Numbers at root level must now be followed by whitespace (or end of input) in the blocking and non-blocking parsers, matching each other. (v2.22.4, package source)
Field names containing JSON-escaped surrogate pairs (\uD83D\uDE00 style) are decoded correctly in the UTF-8 and char-based parsers, including the non-blocking parser. Supplementary characters are encoded as 4-byte UTF-8 when split across chunks (core#1744, core#1742, core#1683). (v2.22.4, package source)
Parsers now reject backslash-escaped raw surrogates and supplementary characters (for example \ followed by a non-BMP character or a raw surrogate) with 'Unrecognized character escape' instead of silently truncating them (core#1744). (v2.22.4, package source)
Escaped surrogates in field names are validated: a lone low surrogate or a high surrogate not followed by a valid low surrogate is reported as an error (core#1683, core#1541 mirror). (v2.22.4, package source)
Non-blocking parser: unescaped control characters inside String values are handled correctly when ALLOW_UNESCAPED_CONTROL_CHARS is enabled, and line/row tracking is updated for unescaped CR/LF in strings (core#1750). (v2.22.4, package source)
Non-blocking parser: a backslash-escaped multi-byte UTF-8 character split across input chunks is decoded correctly, instead of being dropped or misreported (core#1756). (v2.22.4, package source)
Non-blocking parser: end-of-input is now reported with a specific error when it occurs inside a field name, a string escape, a comment, a number (after a decimal point or exponent marker, or after a sign), or inside a UTF-8 BOM. Previously these cases returned NOT_AVAILABLE or silently ended the input. (v2.22.4, package source)
Non-blocking parser: a BOM followed by whitespace, comments or a number at document start is handled correctly, and a second BOM is rejected. Whitespace and comments at document start no longer cause excessive recursion, since they are now skipped iteratively. (v2.22.4, package source)
Non-blocking parser: a '.' starting a value, and a '-.' or '+.' prefix, are now parsed as floats only when ALLOW_LEADING_DECIMAL_POINT_FOR_NUMBERS is enabled. Otherwise they produce a clear error. (v2.22.4, package source)
Parsers now report the 'Decimal point not followed by a digit' and '+' sign errors with consistent messages across blocking and non-blocking implementations, using shared helper methods. (v2.22.4, package source)
Error location and row tracking are improved for invalid characters and unquoted linefeeds in String values, including the '\r\n' case. (v2.22.4, package source)
ReaderBasedJsonParser and the blocking UTF-8 parsers no longer produce a misleading error when a multi-byte UTF-8 character follows a backslash. The error now names the character, and end-of-input inside an escape sequence gives the standard invalid-EOF error. (v2.22.4, package source)
Deprecated protected constants MINOR_ROOT_NEED_SEPARATOR and MINOR_ROOT_GOT_SEPARATOR in NonBlockingJsonParserBase (since 2.21.8, no longer used). Consumers subclassing the non-blocking parser should stop referencing them. (v2.22.4, package source)
Deprecated protected methods _finishNumberLeadingPosZeroes() and _finishNumberLeadingPosNegZeroes(boolean) in the non-blocking parser base (since 2.21.8). Use _finishNumberLeadingZeroes() or _finishNumberLeadingNegZeroes() instead, since '+' is no longer part of number text. (v2.22.4, package source)
FilteringGeneratorDelegate now overrides writeArray(int[]/long[]/double[]/String[], offset, length) so typed array elements are filtered by the TokenFilter instead of being passed straight through to the delegate. Filtered-out elements are skipped. Fully included arrays still use the delegate's implementation. (v2.22.4, package source)
FilteringGeneratorDelegate now overrides writeEmbeddedObject(Object), applying the filter (including TokenFilter.includeEmbeddedValue) before delegating. (v2.22.4, package source)
Internal refactoring of parser error reporting: _reportInvalidChar(), _reportInvalidInitial() and the string-character handling were moved from the subclasses into JsonParserBase (protected). New protected helpers were added there, including _handleInvalidStringChar(), _handleLinefeedInString(), _verifyFractionDigits(), _missingFractionDigits(), _reportLeadingPlusSignNotAllowed() and _reportInvalidChar().... (v2.22.4, package source)
Version bump to 2.22.4 across MANIFEST.MF, pom.xml, pom.properties and PackageVersion.VERSION. (v2.22.4, package source)

References (6)

[1]: com.fasterxml.jackson.core:jackson-core:2.22.4 declared as a direct implementation dependency — confirms this is an actively declared, upgraded package.

algorithm-exercises-java/algorithm-exercises-java/build.gradle

Line 39 in fd0f3bb

implementation 'com.fasterxml.jackson.core:jackson-core:2.22.4'

[2]: com.fasterxml.jackson.core:jackson-databind:2.22.4 declared as a direct implementation dependency — confirms active use of the upgraded package.

algorithm-exercises-java/algorithm-exercises-java/build.gradle

Line 41 in fd0f3bb

implementation 'com.fasterxml.jackson.core:jackson-databind:2.22.4'

[3]: import com.fasterxml.jackson.databind.ObjectMapper — the project directly imports ObjectMapper from jackson-databind, confirming runtime dependency on the upgraded library.

algorithm-exercises-java/algorithm-exercises-java/src/main/java/util/JsonLoader.java

Line 3 in fd0f3bb

import com.fasterxml.jackson.databind.ObjectMapper;

[4]: ObjectMapper is instantiated and readerForListOf(type).readValue(...) is called. This is standard deserialization without custom polymorphic type handling, so the behavior changes in BasicPolymorphicTypeValidator are unlikely to affect this usage path.

algorithm-exercises-java/algorithm-exercises-java/src/main/java/util/JsonLoader.java

Line 15 in fd0f3bb

ObjectMapper objectMapper = new ObjectMapper();

[5]: A malicious typosquatted package using the org.fasterxml.jackson.core prefix (instead of the legitimate com.fasterxml.jackson.core) was published to Maven Central. This PR upgrades the legitimate com.fasterxml.* packages, so it is not affected by this threat. Developers should remain alert to any accidental introduction of org.fasterxml.* coordinates in future dependency changes. (source link)

[6]: The security/snyk (sir-gon) CI check is failing. Snyk is an unsupported CI provider — its logs cannot be inspected to determine whether the failure is related to this upgrade. Per policy, an unanalyzable CI failure from an external security tool requires human review before merging. (source link)

fossabot analyzed this PR using dependency research and AI. View this analysis on the web

fossabot · 2026-10-18T01:13:10Z

fossabot · 2026-10-18T01:13:11Z

fossabot · 2026-10-18T01:14:01Z

No Issues

No security issues were detected in the SAST scan. The code changes appear to follow secure coding practices.

fossabot analyzed this PR using SAST security analysis and AI (changed files only).

codecov · 2026-10-18T01:14:07Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (3e250f3) to head (fd0f3bb).

Additional details and impacted files

@@             Coverage Diff             @@
##                main      #613   +/-   ##
===========================================
  Coverage     100.00%   100.00%           
  Complexity       434       434           
===========================================
  Files             76        76           
  Lines           1383      1383           
  Branches         210       210           
===========================================
  Hits            1383      1383

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

sonarqubecloud · 2026-10-18T01:14:51Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Update jackson monorepo to v2.22.4

fd0f3bb

sir-gon merged commit 82026b7 into main Oct 18, 2026
49 of 50 checks passed

renovate Bot deleted the renovate/jackson-monorepo branch October 18, 2026 01:38

Navigation Menu

Repository navigation

Update jackson monorepo to v2.22.4 - #613

Update jackson monorepo to v2.22.4#613
sir-gon merged 1 commit into
mainfrom
renovate/jackson-monorepo

renovate Bot commented Oct 18, 2026

Uh oh!

fossabot Bot commented Oct 18, 2026 •

edited

Loading

Uh oh!

fossabot Bot commented Oct 18, 2026 •

edited

Loading

Uh oh!

fossabot Bot commented Oct 18, 2026 •

edited

Loading

Uh oh!

fossabot Bot commented Oct 18, 2026 •

edited

Loading

Uh oh!

codecov Bot commented Oct 18, 2026

Uh oh!

sonarqubecloud Bot commented Oct 18, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

renovate Bot commented Oct 18, 2026

Configuration

Uh oh!

fossabot Bot commented Oct 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Needs Review

Fix Suggestions

AI Assistant Prompt

What we checked

Dependency Usage

Changes

Uh oh!

fossabot Bot commented Oct 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

fossabot Bot commented Oct 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

fossabot Bot commented Oct 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

No Issues

Uh oh!

codecov Bot commented Oct 18, 2026

Codecov Report

Uh oh!

sonarqubecloud Bot commented Oct 18, 2026

Quality Gate passed

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

fossabot Bot commented Oct 18, 2026 •

edited

Loading

fossabot Bot commented Oct 18, 2026 •

edited

Loading

fossabot Bot commented Oct 18, 2026 •

edited

Loading

fossabot Bot commented Oct 18, 2026 •

edited

Loading