From 7dfdea8986423c9a46d0e632ddd2332fe34ed0a6 Mon Sep 17 00:00:00 2001
From: Jasbir Singh <jasbir@browserstack.com>
Date: Wed, 7 Oct 2026 09:50:18 +0530
Subject: [PATCH] [APS-21171][APS-20636] bump jackson-core/databind to 2.18.9
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Single property bump closes both CVEs in one change:

* APS-21171 — jackson-core async parser maxNumberLength bypass
  (GHSA-r7wm-3cxj-wff9, incomplete fix for GHSA-72hv-8253-57qq).
  Fixed in jackson-core 2.18.8; 2.18.9 inherits the fix.

* APS-20636 — jackson-databind BasicPolymorphicTypeValidator
  allowIfSubTypeIsArray allowlist bypass (GHSA-rmj7-2vxq-3g9f,
  CVSS 8.1). Fixed in jackson-databind 2.18.8; 2.18.9 inherits.

jackson-core and jackson-databind share one <jackson.version> property
in pom.xml, so one line bump covers both. Supersedes Dependabot PRs
#85 and #86 (which each only bumped one of the two).
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index f80323c..b76fcf9 100644
--- a/pom.xml
+++ b/pom.xml
@@ -34,7 +34,7 @@
 	</distributionManagement>
 
 	<properties>
-		<jackson.version>2.18.6</jackson.version>
+		<jackson.version>2.18.9</jackson.version>
 		<junit.version>4.13.2</junit.version>
 		<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
 		<maven.compiler.source>1.8</maven.compiler.source>