fix(security): move Jackson to fixed 2.21.5 baseline - #160
Conversation
📝 WalkthroughWalkthroughJackson 2.21.5 BOM을 Spring Boot BOM보다 먼저 import하도록 루트 Maven 설정을 변경했습니다. 보안 기준선 문서와 변경 기록을 추가했습니다. BOM 버전과 선언 순서를 검증하는 Maven 테스트를 추가했습니다. ChangesJackson 보안 기준선
Estimated code review effort: 3 (Moderate) | ~20 minutes Possibly related issues
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@coderabbitai review |
Rate Limit Exceeded
|
|
@coderabbitai review |
|
Fresh scanner-completeness evidence — #196 does not supersede this remediationRevalidated this PR before writing: source head remains A newer direct- and then emitted zero CRITICAL/HIGH/MEDIUM findings. Because the scanner explicitly reported incomplete Maven/BOM resolution, that zero-findings result is now classified as incomplete / non-passing security evidence even though its workflow aggregate was green. The same run was also synthetic-merge source, which is an independent identity limitation. This does not make #160 unnecessary and must not be used as rollback evidence. The protected base still has no Jackson BOM override; the accepted remediation decision remains to prove the resolved exact dependency graph and patched 2.21.5 baseline on accepted source identity, without CVE suppression, severity reduction, or scanner-warning suppression. Accordingly the merge boundary for this PR is stricter than the existing body currently states: in addition to literal-source execution, non-vacuous coverage and independent approval, accepted security evidence must prove dependency-resolution completeness or an independently complete same-revision resolved-dependency scanner path. A green Trivy aggregate containing the #196 warning does not qualify. No evidence from #192 or any other PR transfers to this head. |
|
@coderabbitai review |
|
|
@coderabbitai review |
✅ Action performedReview finished.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/doctoring/jackson-2.21.5-security-baseline.md`:
- Around line 97-99: Update the Spring Boot plugin documentation link in the
references to use the version-specific `/3.5/maven-plugin/using.html` path,
keeping the Jackson BOM link and citation details unchanged.
- Around line 91-93: 참고문헌 목록에 CVE-2026-59889를 FasterXML advisory 식별자
GHSA-5gvw-p9qm-jgwh와 함께 별도 항목으로 추가하고, GHSA-mhm7-754m-9p8w도 별도의 참고문헌 항목으로 추가하세요.
기존 Jackson 참고문헌 형식과 링크 스타일을 유지하세요.
In
`@etl-service/src/test/java/com/xtrmetl/etl/documentation/JacksonSecurityBaselineTest.java`:
- Around line 30-39: JacksonSecurityBaselineTest의 문자열 기반
jacksonBom/springBootBom 검사를 XML parser 또는 Maven model 검증으로 교체하세요. 루트
dependencyManagement에서 com.fasterxml.jackson:jackson-bom의 import type, import
scope, version 연결과 spring-boot-dependencies의 실제 구조 및 순서를 확인하고, 별도 effective POM
또는 dependency tree 검증으로 etl-service가 해결한 jackson-databind 버전까지 검사하도록 업데이트하세요.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 061f6857-563d-42ca-b3bc-ce945c0bc194
📒 Files selected for processing (4)
CHANGELOG.mddocs/doctoring/jackson-2.21.5-security-baseline.mdetl-service/src/test/java/com/xtrmetl/etl/documentation/JacksonSecurityBaselineTest.javapom.xml
| FasterXML. (2026, July 7). *Jackson release 2.21*. GitHub. https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.21 | ||
|
|
||
| FasterXML. (2026). *Case-insensitive deserialization bypasses per-property @JsonIgnoreProperties in jackson-databind* (GHSA-5jmj-h7xm-6q6v; CVE-2026-54515). GitHub Security Advisory. https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5jmj-h7xm-6q6v |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -u
printf '%s\n' '--- guidance files ---'
find .. -name AGENTS.md -print
printf '%s\n' '--- target document ---'
target='docs/doctoring/jackson-2.21.5-security-baseline.md'
if [ -f "$target" ]; then
cat -n "$target" | sed -n '1,120p'
else
printf 'Missing: %s\n' "$target"
fi
printf '%s\n' '--- advisory and version references ---'
rg -n -i 'GHSA-mhm7-754m-9p8w|GHSA-5jmj-h7xm-6q6v|CVE-2026-54515|CVE-2026-59889|2\.21\.5|Spring Boot' . --glob '!node_modules' --glob '!dist' --glob '!build'Repository: ContextualWisdomLab/mightyETL
Length of output: 15161
🏁 Script executed:
#!/bin/bash
set -u
printf '%s\n' '--- repository guidance ---'
cat -n ../git/AGENTS.md
printf '%s\n' '--- referenced URLs and status ---'
python3 - <<'PY'
from pathlib import Path
from urllib.request import Request, urlopen
import re
path = Path("docs/doctoring/jackson-2.21.5-security-baseline.md")
text = path.read_text()
urls = re.findall(r'https?://\S+', text)
for url in urls:
url = url.rstrip(').,;')
try:
request = Request(url, method="HEAD", headers={"User-Agent": "Mozilla/5.0"})
with urlopen(request, timeout=15) as response:
print(response.status, response.geturl(), url)
except Exception as exc:
print("ERROR", url, type(exc).__name__, str(exc))
PY
printf '%s\n' '--- advisory metadata ---'
for advisory in GHSA-mhm7-754m-9p8w GHSA-5jmj-h7xm-6q6v; do
url="https://api.github.com/repos/FasterXML/jackson-databind/security-advisories/$advisory"
printf '%s\n' "$advisory"
curl -L --fail --silent --show-error \
-H 'Accept: application/vnd.github+json' \
-H 'User-Agent: review-check' \
"$url" | jq '{ghsa_id, cve_id, summary, severity, vulnerable_versions, patched_versions, references}'
doneRepository: ContextualWisdomLab/mightyETL
Length of output: 4459
🌐 Web query:
"GHSA-mhm7-754m-9p8w" "CVE-2026-59889" Jackson
💡 Result:
GHSA-mhm7-754m-9p8w and CVE-2026-59889 are two distinct security vulnerabilities affecting the Jackson Databind library, both related to the bypass of @JsonView annotations [1][2][3]. CVE-2026-59889 CVE-2026-59889 is an authorization-bypass vulnerability where the @JsonView annotation is bypassed for @JsonUnwrapped properties [2][3][4]. Specifically, the UnwrappedPropertyHandler fails to enforce visibility checks when replaying buffered JSON, allowing an attacker to write to properties that should have been restricted by the active view [3][5][4]. This issue is fixed in Jackson Databind versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 [2][3][5]. GHSA-mhm7-754m-9p8w GHSA-mhm7-754m-9p8w describes a separate @JsonView bypass vulnerability involving creator properties (e.g., constructor parameters) combined with @JsonTypeInfo(include=As.EXTERNAL_PROPERTY) [1][6][7]. The deserializer failed to apply view-based filtering in the creator-property branch, which allowed unauthorized modification of restricted creator parameters [1][6]. This is categorized as a "patch gap" because while fixes were initially applied to the 3.x line, they were not correctly backported to earlier versions [1][6][7]. This was addressed in the same release cycle as CVE-2026-59889 (e.g., 2.18.9, 2.21.5, 2.22.1) [8][9]. In summary, both identifiers represent critical @JsonView bypass flaws that allow unauthorized mass-assignment of sensitive fields, and both were addressed in the July 2026 release of Jackson Databind versions [2][3]. Users are advised to upgrade to the latest versions (2.18.9, 2.21.5, 2.22.1, 3.1.5, 3.2.1 or newer) to mitigate these risks [2][3][5].
Citations:
- 1: GHSA-mhm7-754m-9p8w
- 2: https://suriq.io/blog/jackson-databind-jsonview-write-bypass-cve-2026-59889
- 3: https://www.cve.org/CVERecord?id=CVE-2026-59889
- 4: https://cvepremium.circl.lu/vuln/cve-2026-59889
- 5: https://guide.sonatype.com/vulnerability/CVE-2026-59889
- 6: https://cve.circl.lu/vuln/ghsa-mhm7-754m-9p8w
- 7: GHSA-mhm7-754m-9p8w
- 8: https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.18.9
- 9: https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.22.1
🏁 Script executed:
#!/bin/bash
set -u
printf '%s\n' '--- advisory API responses ---'
for advisory in GHSA-mhm7-754m-9p8w GHSA-5jmj-h7xm-6q6v; do
printf '\n%s\n' "$advisory"
curl -k -L --fail --silent --show-error \
-H 'Accept: application/vnd.github+json' \
-H 'User-Agent: review-check' \
"https://api.github.com/repos/FasterXML/jackson-databind/security-advisories/$advisory" |
jq '{ghsa_id, cve_id, summary, description, severity, published_at, updated_at, identifiers, references, vulnerabilities, cvss}'
done
printf '%s\n' '--- CVE record endpoints ---'
for url in \
'https://cveawg.mitre.org/api/cve/CVE-2026-59889' \
'https://cveawg.mitre.org/api/cve/CVE-2026-54515' \
'https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-59889' \
'https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-54515'
do
printf '\n%s\n' "$url"
curl -k -L --silent --show-error --max-time 20 "$url" |
jq 'if .containers then {cveMetadata,containers} elif .vulnerabilities then {totalResults, vulnerabilities} else . end' 2>/dev/null |
head -c 12000
printf '\n'
done
printf '%s\n' '--- link reachability without certificate validation ---'
python3 - <<'PY'
from pathlib import Path
from urllib.request import Request, urlopen
import re, ssl
text = Path("docs/doctoring/jackson-2.21.5-security-baseline.md").read_text()
urls = sorted(set(u.rstrip(").,;") for u in re.findall(r'https?://\S+', text)))
ctx = ssl._create_unverified_context()
for url in urls:
try:
request = Request(url, method="HEAD", headers={"User-Agent": "Mozilla/5.0"})
with urlopen(request, timeout=20, context=ctx) as response:
print(response.status, response.geturl(), url)
except Exception as exc:
print("ERROR", url, type(exc).__name__, str(exc))
PYRepository: ContextualWisdomLab/mightyETL
Length of output: 32751
참고문헌에 누락된 advisory 식별자를 추가하세요.
Trigger의 CVE-2026-59889와 GHSA-mhm7-754m-9p8w를 별도 참고문헌으로 추가하세요. CVE-2026-59889의 FasterXML advisory는 GHSA-5gvw-p9qm-jgwh이며, GHSA-mhm7-754m-9p8w와는 별도 취약점입니다.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/doctoring/jackson-2.21.5-security-baseline.md` around lines 91 - 93,
참고문헌 목록에 CVE-2026-59889를 FasterXML advisory 식별자 GHSA-5gvw-p9qm-jgwh와 함께 별도 항목으로
추가하고, GHSA-mhm7-754m-9p8w도 별도의 참고문헌 항목으로 추가하세요. 기존 Jackson 참고문헌 형식과 링크 스타일을
유지하세요.
Source: Coding guidelines
| Spring Boot. (2026). *Using the plugin: Using Spring Boot without the parent POM*. Spring Documentation. https://docs.spring.io/spring-boot/maven-plugin/using.html | ||
|
|
||
| Spring Boot. (2026). *Version properties: Jackson BOM*. Spring Documentation. https://docs.spring.io/spring-boot/3.5/appendix/dependency-versions/properties.html |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- AGENTS.md files ---'
find .. -name AGENTS.md -print
printf '%s\n' '--- target document ---'
target='docs/doctoring/jackson-2.21.5-security-baseline.md'
if [ -f "$target" ]; then
sed -n '1,120p' "$target"
else
printf 'Missing target: %s\n' "$target"
fi
printf '%s\n' '--- relevant repository references ---'
rg -n -i '3\.5(\.16)?|4\.1\.0|maven-plugin/using\.html|Jackson BOM|2\.21\.5|GHSA-mhm7-754m-9p8w' -- "$target" docs README.md 2>/dev/null || true
printf '%s\n' '--- link status and redirects ---'
for url in \
'https://docs.spring.io/spring-boot/maven-plugin/using.html' \
'https://docs.spring.io/spring-boot/3.5/maven-plugin/using.html' \
'https://docs.spring.io/spring-boot/3.5/appendix/dependency-versions/properties.html'
do
printf '\n%s\n' "$url"
curl -L -sS -o /dev/null -w 'status=%{http_code} final=%{url_effective}\n' "$url" || true
doneRepository: ContextualWisdomLab/mightyETL
Length of output: 14116
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- repository guidance ---'
cat ../git/AGENTS.md
printf '%s\n' '--- unversioned page metadata ---'
curl -L -sS 'https://docs.spring.io/spring-boot/maven-plugin/using.html' |
tr '\n' ' ' |
grep -oE '<title>[^<]*|Spring Boot [0-9]+\.[0-9]+(\.[0-9]+)?' |
head -20 || true
printf '%s\n' '--- versioned page metadata ---'
curl -L -sS 'https://docs.spring.io/spring-boot/3.5/maven-plugin/using.html' |
tr '\n' ' ' |
grep -oE '<title>[^<]*|Spring Boot [0-9]+\.[0-9]+(\.[0-9]+)?' |
head -20 || true
printf '%s\n' '--- relevant page wording ---'
for url in \
'https://docs.spring.io/spring-boot/maven-plugin/using.html' \
'https://docs.spring.io/spring-boot/3.5/maven-plugin/using.html'
do
printf '\nURL: %s\n' "$url"
curl -L -sS "$url" |
sed 's/<[^>]*>/ /g' |
tr -s '[:space:]' ' ' |
grep -oE '.{0,120}(without the parent POM|dependency management|version).{0,240}' |
head -8 || true
doneRepository: ContextualWisdomLab/mightyETL
Length of output: 8498
Spring Boot 문서 링크를 3.5 버전으로 고정하세요.
기준선이 Spring Boot 3.5.16이므로, 최신 4.1.0 문서를 가리키는 비버전 경로 대신 /3.5/maven-plugin/using.html을 사용하세요.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/doctoring/jackson-2.21.5-security-baseline.md` around lines 97 - 99,
Update the Spring Boot plugin documentation link in the references to use the
version-specific `/3.5/maven-plugin/using.html` path, keeping the Jackson BOM
link and citation details unchanged.
Source: Coding guidelines
| String jacksonBom = "<artifactId>jackson-bom</artifactId>"; | ||
| String springBootBom = "<artifactId>spring-boot-dependencies</artifactId>"; | ||
| int jacksonIndex = pom.indexOf(jacksonBom); | ||
| int springBootIndex = pom.indexOf(springBootBom); | ||
|
|
||
| assertTrue(jacksonIndex >= 0, "Root dependencyManagement must import the Jackson BOM explicitly"); | ||
| assertTrue(springBootIndex >= 0, "Root dependencyManagement must continue importing Spring Boot dependencies"); | ||
| assertTrue( | ||
| jacksonIndex < springBootIndex, | ||
| "Without the Spring Boot parent POM, the explicit Jackson override BOM must precede spring-boot-dependencies" |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- AGENTS.md files ---'
find .. -name AGENTS.md -print
printf '%s\n' '--- target and nearby Maven files ---'
git ls-files | grep -E '(^|/)(pom\.xml|JacksonSecurityBaselineTest\.java|AGENTS\.md)$' | sed -n '1,120p'
printf '%s\n' '--- test outline ---'
ast-grep outline etl-service/src/test/java/com/xtrmetl/etl/documentation/JacksonSecurityBaselineTest.java || true
printf '%s\n' '--- test source ---'
cat -n etl-service/src/test/java/com/xtrmetl/etl/documentation/JacksonSecurityBaselineTest.java
printf '%s\n' '--- Maven POM locations/content around Jackson ---'
for f in $(git ls-files '*pom.xml'); do
if grep -q -E 'jackson|spring-boot-dependencies|jackson-bom' "$f"; then
echo "### $f"
grep -n -C 6 -E 'jackson|spring-boot-dependencies|dependencyManagement|jackson-databind' "$f" | sed -n '1,240p'
fi
doneRepository: ContextualWisdomLab/mightyETL
Length of output: 6518
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- repository guidance ---'
cat -n AGENTS.md
printf '%s\n' '--- focused verifier ---'
python3 - <<'PY'
from pathlib import Path
import xml.etree.ElementTree as ET
test = Path("etl-service/src/test/java/com/xtrmetl/etl/documentation/JacksonSecurityBaselineTest.java").read_text()
pom_text = Path("pom.xml").read_text(encoding="utf-8")
root = ET.fromstring(pom_text)
ns = {"m": "http://maven.apache.org/POM/4.0.0"}
management = root.find("m:dependencyManagement/m:dependencies", ns)
imports = []
for dep in management.findall("m:dependency", ns):
imports.append({
"groupId": dep.findtext("m:groupId", namespaces=ns),
"artifactId": dep.findtext("m:artifactId", namespaces=ns),
"version": dep.findtext("m:version", namespaces=ns),
"type": dep.findtext("m:type", namespaces=ns),
"scope": dep.findtext("m:scope", namespaces=ns),
})
print("current raw checks:", {
"version_contains": "<jackson-bom.version>2.21.5</jackson-bom.version>" in pom_text,
"jackson_index": pom_text.find("<artifactId>jackson-bom</artifactId>"),
"spring_boot_index": pom_text.find("<artifactId>spring-boot-dependencies</artifactId>"),
})
print("parsed jackson import:", next((d for d in imports if d["artifactId"] == "jackson-bom"), None))
print("parsed spring boot import:", next((d for d in imports if d["artifactId"] == "spring-boot-dependencies"), None))
print("test uses XML parser:", "XML" in test or "DocumentBuilder" in test or "MavenXpp3Reader" in test)
print("test resolves dependency graph:", any(x in test for x in ("dependency:tree", "effective-pom", "jackson-databind")))
counterexample = """<project>
<properties>
<!-- <jackson-bom.version>2.21.5</jackson-bom.version> -->
</properties>
<dependencyManagement>
<dependencies>
<dependency>
<artifactId>unrelated-jackson-bom</artifactId>
</dependency>
<dependency>
<artifactId>spring-boot-dependencies</artifactId>
</dependency>
</dependencies>
</dependencyManagement>
</project>"""
print("counterexample raw checks:", {
"version_contains": "<jackson-bom.version>2.21.5</jackson-bom.version>" in counterexample,
"jackson_index": counterexample.find("<artifactId>jackson-bom</artifactId>"),
"spring_boot_index": counterexample.find("<artifactId>spring-boot-dependencies</artifactId>"),
})
PYRepository: ContextualWisdomLab/mightyETL
Length of output: 3322
🏁 Script executed:
#!/bin/bash
set -eu
python3 - <<'PY'
from pathlib import Path
source = Path("etl-service/src/test/java/com/xtrmetl/etl/documentation/JacksonSecurityBaselineTest.java").read_text()
fake_pom = """<project>
<!--
<jackson-bom.version>2.21.5</jackson-bom.version>
<artifactId>jackson-bom</artifactId>
-->
<dependencyManagement>
<dependencies>
<!-- The marker below is not a dependency-management entry. -->
<dependency>
<artifactId>spring-boot-dependencies</artifactId>
</dependency>
</dependencies>
</dependencyManagement>
</project>"""
predicates = [
"<jackson-bom.version>2.21.5</jackson-bom.version>" in fake_pom,
fake_pom.find("<artifactId>jackson-bom</artifactId>") >= 0,
fake_pom.find("<artifactId>spring-boot-dependencies</artifactId>") >= 0,
fake_pom.find("<artifactId>jackson-bom</artifactId>") < fake_pom.find("<artifactId>spring-boot-dependencies</artifactId>"),
]
print("all raw test predicates pass:", all(predicates))
print("fake POM has parsed Jackson dependency-management import:", False)
print("test source contains XML parser/model:", any(x in source for x in ("DocumentBuilder", "MavenXpp3Reader", "XmlPullParser")))
print("test source checks resolved jackson-databind version:", "jackson-databind" in source)
PYRepository: ContextualWisdomLab/mightyETL
Length of output: 371
XML 구조와 해석된 의존성으로 Jackson 보안 계약을 검사하세요.
JacksonSecurityBaselineTest는 contains와 indexOf만 사용합니다. 주석이나 무관한 XML 노드의 문자열만으로 모든 검사가 통과할 수 있습니다. 테스트는 com.fasterxml.jackson:jackson-bom의 type, scope, version 연결 또는 etl-service의 실제 jackson-databind 버전을 검사하지 않습니다. XML parser 또는 Maven model로 dependencyManagement 구조를 검사하고, effective POM 또는 dependency tree로 resolved version을 별도로 검사하세요.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@etl-service/src/test/java/com/xtrmetl/etl/documentation/JacksonSecurityBaselineTest.java`
around lines 30 - 39, JacksonSecurityBaselineTest의 문자열 기반
jacksonBom/springBootBom 검사를 XML parser 또는 Maven model 검증으로 교체하세요. 루트
dependencyManagement에서 com.fasterxml.jackson:jackson-bom의 import type, import
scope, version 연결과 spring-boot-dependencies의 실제 구조 및 순서를 확인하고, 별도 effective POM
또는 dependency tree 검증으로 etl-service가 해결한 jackson-databind 버전까지 검사하도록 업데이트하세요.
Source: Coding guidelines
opencode-agent
Bot
added
area: security
1 participant
Purpose
Repair the shared protected dependency baseline that caused open mightyETL Security Scan failures through inherited
jackson-databindadvisories. This is a direct-develop, repository-wide security slice rather than a PR-local suppression.Exact current identity
develop@622e5e6c3d534f230c390f10e3832efadfc01825;security/jackson-databind-2.21.5;2905c416679dfccf6ad48e7a7f056b22d476a553;develop;Every check/review from an older head is stale and does not transfer.
Trigger / RCA
PR #158 Security Scan run
31312834418, Trivy filesystem job93243221587, failed after Trivy itself completed successfully. The hard findings gate reported three MEDIUM findings against inheritedcom.fasterxml.jackson.core:jackson-databind:CVE-2026-54515;CVE-2026-59889;GHSA-mhm7-754m-9p8w.The scanner checked out synthetic merge
6f0669cc1c3b36f14296ab839154991c298a7eec(#158 head 3b501f8...merged into protecteddevelop@622e5e6...). #158 itself changes MySQL source discovery and does not alter Jackson. Re-running #158 against the unchanged base cannot change this inherited failure.Protected root
pom.xmlimports Spring Boot 3.5.16 dependency management and had no explicit Jackson override. Spring Boot 3.5.16 manages Jackson 2.21.4; FasterXML's 2.21 LTS line released 2.21.5 on 2026-07-06, and upstream advisory/release material identifies 2.21.5 as the patched 2.21.x line for the current Databind findings.Real-world Maven feasibility
mightyETL imports
spring-boot-dependenciesrather than inheritingspring-boot-starter-parent. Spring Boot's Maven documentation explicitly states that property-only overrides do not work in that topology; the project must declare an overriding dependency/BOM before the Spring Boot BOM. Therefore this PR importscom.fasterxml.jackson:jackson-bom:2.21.5immediately beforespring-boot-dependencies, keeping Jackson modules aligned on one upstream LTS patch line instead of pinning Databind alone.No CVE suppression, Trivy severity reduction, invented repository secret, cross-repository mutation, or feature-branch-only patch is used.
TDD
RED
Commit
b60d7a6ef6b8a7fd8faa4cf3598bc25768a1847badds onlyJacksonSecurityBaselineTest. It requires:jackson-bom.version2.21.5;The exact starting POM has none of these, so the test is source-proven fail-first at the dependency-management production boundary.
GREEN candidate
c6ddc23c5a3ab7e71be5795164f42b16e076b3fcadds only the supported Jackson BOM override before Spring Boot dependency management;c31256350f125728d86b5c8b48007d7b52433c11records root cause, alternatives, compatibility/rollback and acceptance evidence indocs/doctoring/jackson-2.21.5-security-baseline.md;2905c416679dfccf6ad48e7a7f056b22d476a553records the LTS patch override inCHANGELOG.md.Fresh hosted proof on the current head
All exposed workflow aggregates for
2905c416679dfccf6ad48e7a7f056b22d476a553have now completed successfully:31315057362: success;31315057369: success;31315057355: success;31315057350: success;31315057367: success.Security Scan Trivy job
93248855990checked out synthetic merge1e5b77c98b4c5870a5633dea05c84287074ded27(Merge 2905c416... into 622e5e6...) and reported0 CRITICAL/HIGH/MEDIUM findings in trivy-results.sarif. That is strong merged-tree evidence that the Jackson remediation removes the inherited hard findings, but it is not literal-source scanner evidence.CI macOS job
93248864251likewise checked out synthetic merge1e5b77c..., ran the full Maven reactor successfully, and reported 276 ETL tests, 106 CDC tests and 3 gateway tests with zero test failures/skips in those result sets. However, the same log proves the existing durable-job JaCoCo gate is vacuous on this tree:Analyzed bundle 'etl-service' with 0 classesfollowed byAll coverage checks have been met.That independent quality-gate defect is tracked by #162 and repaired by active PR #164; this CI result must not be represented as valid 100% owned-production coverage evidence.Compatibility / rollback
This remains inside Jackson 2.21 LTS and changes only the patch baseline. Spring Boot cautions that dependency overrides may cause compatibility issues, so complete reactor/build/security evidence remains mandatory. Removing the override is mechanically simple but would knowingly restore the vulnerable 2.21.4 inherited baseline while Boot 3.5.16 remains unchanged; a compatibility failure therefore requires another supported security path rather than silent rollback to the advisories.
Remaining gates
Keep Draft. The current source implementation has materially strong merged-tree deterministic/security evidence, but protected merge acceptance is still blocked by independent controls rather than by the Jackson fix itself:
APPROVEDreview exists;After this PR integrates, unchanged feature PRs such as #158 must be rerun against the new protected base rather than reusing their old synthetic failure or any #160 evidence.
Summary by CodeRabbit
보안 개선
문서화
검증