Jackson version bump to 2.18.9 - #635
Conversation
There was a problem hiding this comment.
Pull request overview
Warning
Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.
This PR upgrades the Jackson dependency version used by aws-lambda-java-serialization to address reported CVEs, and bumps the tests module to consume the new serialization version.
Changes:
- Bump
aws-lambda-java-serializationJackson version from2.18.6to2.18.9. - Update
aws-lambda-java-teststo depend onaws-lambda-java-serialization1.4.2. - Add a
1.4.2entry to the serialization release changelog.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| aws-lambda-java-tests/pom.xml | Updates tests module to use serialization 1.4.2. |
| aws-lambda-java-serialization/pom.xml | Bumps Jackson version property to 2.18.9. |
| aws-lambda-java-serialization/RELEASE.CHANGELOG.md | Documents the 1.4.2 release and dependency bump. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #635 +/- ##
============================================
+ Coverage 65.38% 65.79% +0.40%
- Complexity 212 213 +1
============================================
Files 34 34
Lines 991 991
Branches 143 143
============================================
+ Hits 648 652 +4
+ Misses 290 287 -3
+ Partials 53 52 -1 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
| --> | ||
| <junit.version>5.9.2</junit.version> | ||
| <jacoco.maven.plugin.version>0.8.7</jacoco.maven.plugin.version> | ||
| <aws-lambda-java-serialization.version>1.4.1</aws-lambda-java-serialization.version> |
There was a problem hiding this comment.
It's fine but we need to remember of releasing also this package in the followup PR.
There was a problem hiding this comment.
actually I was wrong. The test are exercised locally but you need to have the same version, otherwise it will fail the test, because it is registered locally as 1.4.1.
There was a problem hiding this comment.
Cool, I'll revert this then
Issue #, if available:
Description of changes:
Upgrade
jacksondependency version to2.18.9in the serialization package to address the following CVE reports CVE-2026-54512 and CVE-2026-54513Will update tests package separately after maven workflow's auto version bump for serialization
Target (OCI, Managed Runtime, both):
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.