From 6b2670d78bfd5db28b09e3b67959c0b144ff242b Mon Sep 17 00:00:00 2001 From: Automatic Dependency Updater Date: Sun, 20 Sep 2026 22:44:03 +0000 Subject: [PATCH] =?UTF-8?q?=F0=9F=94=90=20Update=20dependencies=20to=20fix?= =?UTF-8?q?=20vulnerabilities?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- dependencies.md | 4 ++-- doc/changes/changelog.md | 1 + doc/changes/changes_2.1.3.md | 33 +++++++++++++++++++++++++++++++++ pk_generated_parent.pom | 2 +- pom.xml | 8 ++++---- 5 files changed, 41 insertions(+), 7 deletions(-) create mode 100644 doc/changes/changes_2.1.3.md diff --git a/dependencies.md b/dependencies.md index 42c6d74..cee8b42 100644 --- a/dependencies.md +++ b/dependencies.md @@ -11,7 +11,7 @@ | [Maven Core][4] | [Apache-2.0][1] | | [Spoon Core][5] | [CeCILL-C][6]; [MIT][7] | | [error-reporting-java][8] | [MIT License][9] | -| [SLF4J JDK14 Binding][10] | [MIT License][11] | +| [SLF4J JDK14 Provider][10] | [MIT][11] | | [Jackson-dataformat-YAML][12] | [The Apache Software License, Version 2.0][1] | | [Jackson datatype: JSR310][13] | [The Apache Software License, Version 2.0][14] | | [Error Code Model Java][15] | [MIT License][16] | @@ -74,7 +74,7 @@ [8]: https://github.com/exasol/error-reporting-java/ [9]: https://github.com/exasol/error-reporting-java/blob/main/LICENSE [10]: http://www.slf4j.org -[11]: http://www.opensource.org/licenses/mit-license.php +[11]: https://opensource.org/license/mit [12]: https://github.com/FasterXML/jackson-dataformats-text [13]: https://github.com/FasterXML/jackson-modules-java8/ [14]: http://www.apache.org/licenses/LICENSE-2.0.txt diff --git a/doc/changes/changelog.md b/doc/changes/changelog.md index 5571494..b6da9b3 100644 --- a/doc/changes/changelog.md +++ b/doc/changes/changelog.md @@ -1,5 +1,6 @@ # Changes +* [2.1.3](changes_2.1.3.md) * [2.1.2](changes_2.1.2.md) * [2.1.1](changes_2.1.1.md) * [2.1.0](changes_2.1.0.md) diff --git a/doc/changes/changes_2.1.3.md b/doc/changes/changes_2.1.3.md new file mode 100644 index 0000000..82eb280 --- /dev/null +++ b/doc/changes/changes_2.1.3.md @@ -0,0 +1,33 @@ +# Error Code Crawler Maven Plugin 2.1.3, released 2026-??-?? + +Code name: Fixed vulnerabilities CVE-2026-91776, CVE-2026-91777 + +## Summary + +This release fixes the following 2 vulnerabilities: + +### CVE-2026-91776 (CWE-770) in dependency `com.fasterxml.jackson.core:jackson-databind:jar:2.22.2:compile` +Jackson-databind - Unbounded growth of type id cache in TypeDeserializer +#### References +* https://guide.sonatype.com/vulnerability/CVE-2026-91776?component-type=maven&component-name=com.fasterxml.jackson.core%2Fjackson-databind&utm_source=ossindex-client&utm_medium=integration&utm_content=1.8.1 +* http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2026-91776 +* https://github.com/FasterXML/jackson-databind/pull/6203 + +### CVE-2026-91777 (CWE-407) in dependency `com.fasterxml.jackson.core:jackson-databind:jar:2.22.2:compile` +Jackson-databind - Denial of Service (DoS) +#### References +* https://guide.sonatype.com/vulnerability/CVE-2026-91777?component-type=maven&component-name=com.fasterxml.jackson.core%2Fjackson-databind&utm_source=ossindex-client&utm_medium=integration&utm_content=1.8.1 +* http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2026-91777 +* https://github.com/FasterXML/jackson-databind/pull/6204 + +## Security + +* #131: Fixed vulnerability CVE-2026-91776 in dependency `com.fasterxml.jackson.core:jackson-databind:jar:2.22.2:compile` +* #132: Fixed vulnerability CVE-2026-91777 in dependency `com.fasterxml.jackson.core:jackson-databind:jar:2.22.2:compile` + +## Dependency Updates + +### Plugin Dependency Updates + +* Updated `com.exasol:error-code-crawler-maven-plugin:2.1.2` to `2.1.3` +* Updated `com.exasol:project-keeper-maven-plugin:5.7.5` to `5.7.6` diff --git a/pk_generated_parent.pom b/pk_generated_parent.pom index 843136b..67c41b4 100644 --- a/pk_generated_parent.pom +++ b/pk_generated_parent.pom @@ -3,7 +3,7 @@ 4.0.0 com.exasol error-code-crawler-maven-plugin-generated-parent - 2.1.2 + 2.1.3 pom UTF-8 diff --git a/pom.xml b/pom.xml index 83f8ed3..3333269 100644 --- a/pom.xml +++ b/pom.xml @@ -3,7 +3,7 @@ 4.0.0 error-code-crawler-maven-plugin error-code-crawler-maven-plugin - 2.1.2 + 2.1.3 Crawler for Exasol error codes. https://github.com/exasol/error-code-crawler-maven-plugin/ maven-plugin @@ -70,7 +70,7 @@ org.slf4j slf4j-jdk14 - 1.7.36 + 2.0.19 provided @@ -140,7 +140,7 @@ com.exasol project-keeper-maven-plugin - 5.7.5 + 5.7.6 @@ -199,7 +199,7 @@ error-code-crawler-maven-plugin-generated-parent com.exasol - 2.1.2 + 2.1.3 pk_generated_parent.pom