Repository navigation
fix(security): bound Jackson fallback cache for TFS bug 712021 - #162
Merged
alexgomezlf merged 6 commits intoOct 15, 2026
Merged
alexgomezlf merged 6 commits into
alexgomezlf merged 6 commits into
Conversation
Upgrade Jackson databind/core to 2.21.7 within the existing LTS line to bound the polymorphic fallback type-ID cache (CVE-2026-91776). Add regression coverage with the actual client mapper and Entry model. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Contributor
Contributor
Update the publishing workflow and changelog as requested by Alexandria Gomez. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
quinn-mchale-lf
approved these changes
Oct 15, 2026
alexgomezlf
deleted the
devbot/veracode/sca-app-1791266-comp-5bc97c69-5880-48b2-aead-85df2b6ee5dd
branch
October 15, 2026 16:58
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description of changes: Fix the Jackson dependency findings tracked by TFS bugs 712021 (CVE-2026-91776) and 712022 (CVE-2026-91777), and update the publishing version requested by Alexandria Gomez on bug 712022.
The v2 client uses Jackson at runtime through TokenClientObjectMapper, so removing the dependency is not appropriate. The existing remediation raises the shared jackson-version property in pom.xml from 2.21.6 to 2.21.7, upgrading jackson-databind and jackson-core together within the repository's 2.21 LTS policy. jackson-annotations remains at its separately versioned 2.21. The bug identifies 2.21.7 as a fixed version for CVE-2026-91777; Maven Central confirms this artifact exists.
Four existing unit regressions exercise the actual mapper/model for bounded unknown-type caching, repeated IDs, overlong IDs, and preservation of known subtypes. These address the sibling finding CVE-2026-91776; they are not a reproduction of CVE-2026-91777's identity-enabled collection/map path.
Follow-up: update .github/workflows/main.yml VERSION_PREFIX from 1.0.4 to 1.0.5. Maven Central already lists client 1.0.4 as released. The publish-production-package job copies VERSION_PREFIX to PACKAGE_VERSION, applies it with mvn versions:set, and tags the release as v2-${PACKAGE_VERSION}. The POM's existing 1.0.0 development version is deliberately unchanged because the publishing workflow sets the release version. Move the Jackson fix into a new 1.0.5 changelog section while retaining the published 1.0.4 history. No publishing conditions, permissions, credentials, or integration tests were changed.
Verification: the follow-up YAML parses successfully and differs structurally from the previous workflow only in VERSION_PREFIX; checks confirm the publication-version flow and matching changelog section. git diff --check passes. The rendered PR contains exactly the intended four files, with no unexpected additions or deletions.
Hosted CI on follow-up commit 198b89c: the build, all 29 unit tests, and both CodeQL analyses pass. build-n-test and integration-test-results-cloud remain red in https://github.com/Laserfiche/lf-repository-api-client-java/actions/runs/37624975249: three search assertions fail and six entry-fixture tests return missing-entry errors (9001). These same nine failures occur on unchanged v2 baseline commit 8218848 in https://github.com/Laserfiche/lf-repository-api-client-java/actions/runs/36905581252, before this change. No unrelated integration-test or environment fixes are included. Documentation and publishing jobs are skipped; publishing was not invoked.
Work item links