From d714f85d48aa6a8cc40e039e664aa43ef99b60e0 Mon Sep 17 00:00:00 2001 From: Fei Chen Date: Tue, 23 Jun 2026 17:18:23 -0700 Subject: [PATCH] fix: upgrade jackson-core to 2.19.0 (OKTA-1152396) Upgrade jackson version from 2.15.2 to 2.19.0 to address SNYK-JAVA-COMFASTERXMLJACKSONCORE-15907551 (Allocation of Resources Without Limits or Throttling, CVSS 8.7). Add jackson-core constraint in browser-sign-in/build.gradle to force the upgraded version for all transitive paths through okta-sdk-impl. RESOLVES: OKTA-1152396 --- browser-sign-in/build.gradle | 1 + gradle/libs.versions.toml | 3 ++- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/browser-sign-in/build.gradle b/browser-sign-in/build.gradle index 3d2fd52..7709aed 100644 --- a/browser-sign-in/build.gradle +++ b/browser-sign-in/build.gradle @@ -92,6 +92,7 @@ dependencies { } constraints { androidTestImplementation(libs.bcpkix.jdk18on) + androidTestImplementation(libs.jackson.core) } androidTestUtil(libs.androidx.test.orchestrator) debugImplementation(libs.androidx.test.fragment) { diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml index aa530ea..fb8c153 100644 --- a/gradle/libs.versions.toml +++ b/gradle/libs.versions.toml @@ -44,7 +44,7 @@ bcpkix-jdk18on = "1.84" # Testing lib versions junit = "4.13.2" -jackson = "2.15.2" +jackson = "2.19.0" truth = "1.1.3" mockk = "1.13.2" androidx-test = "1.5.0" @@ -123,6 +123,7 @@ bcpkix-jdk18on = { module = "org.bouncycastle:bcpkix-jdk18on", version.ref = "bc # Testing libs junit = { module = "junit:junit", version.ref = "junit" } +jackson-core = { module = "com.fasterxml.jackson.core:jackson-core", version.ref = "jackson" } jackson-dataformat-yml = { module = "com.fasterxml.jackson.dataformat:jackson-dataformat-yaml", version.ref = "jackson" } truth = { module = "com.google.truth:truth", version.ref = "truth" } robolectric = { module = "org.robolectric:robolectric", version.ref = "robolectric" }