From f4c746f4406bc59ff44c5513f3f48fbf0af8d178 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 17 Jul 2026 08:41:13 +0000 Subject: [PATCH] Bump jackson.version 2.22.0 -> 2.22.1 to fix GHSA-5jmj-h7xm-6q6v OSV-Scanner flagged jackson-databind 2.22.0 (CVSS 5.3, Medium) in srcmorph/pom.xml and srcmorph-cli/pom.xml after the main branch merge of the relocation-stub removal. jackson.version is pinned once in the parent's dependencyManagement (both jackson-databind and jackson-dataformat-yaml derive from it), so bumping it there closes the finding for both modules in one place. --- CHANGELOG.md | 7 +++++++ pom.xml | 2 +- 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 50b779a..224b6c1 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -11,6 +11,13 @@ The release procedure (prompt template and step-by-step instructions) lives in [ ## [Unreleased] +### Fixed +- Bumped `jackson.version` 2.22.0 → 2.22.1 (`jackson-databind` / `jackson-dataformat-yaml`, + pinned in the parent `pom.xml`) to close + [GHSA-5jmj-h7xm-6q6v](https://github.com/advisories/GHSA-5jmj-h7xm-6q6v) (CVSS 5.3, Medium), + flagged by OSV-Scanner against `srcmorph/pom.xml` and `srcmorph-cli/pom.xml` after the `main` + merge of the relocation-stub removal. + ### Removed - **Relocation-stub module** (`llamacpp-ai-index-maven-plugin/`, `net.ladenthin:llamacpp-ai-index-maven-plugin`) removed from the active reactor. It was published once at `1.0.4` as part of the `1.1.1` release diff --git a/pom.xml b/pom.xml index 4db37f4..5cc4716 100644 --- a/pom.xml +++ b/pom.xml @@ -59,7 +59,7 @@ SPDX-License-Identifier: Apache-2.0 parent POM, so the version used by both jackson dependencyManagement entries must live at this level. srcmorph-cli/pom.xml does not redeclare it. --> - 2.22.0 + 2.22.1