From 760f0d49a80e6981b19dfe47dd9fba71aa5e7e78 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 12 Oct 2026 11:48:39 +0000 Subject: [PATCH] fix(security): raise Jackson floor to 2.22.3 on Dokka's classpath Clears four high-severity Dependabot alerts on the build toolchain's Jackson (pulled in by Dokka's engine, not by the published SDK): - GHSA-7hhh-6rmp-j9qf jackson-core: unbounded StringBuilder growth (DoS) - GHSA-p6pp-m3f8-5c89 jackson-core: ReDoS in NumberInput.PATTERN_FLOAT - GHSA-cxp5-3px4-pw24 jackson-databind: quadratic forward-reference completion - GHSA-wv8q-qhhj-9h54 jackson-databind: retains every unknown raw type ID All four are fixed in 2.22.3. Co-Authored-By: Claude Sonnet 5.5 Claude-Session: https://claude.ai/code/session_017wK7KCUHKqHQEhVmoSeX1B --- gradle/libs.versions.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml index 4004439..f802a13 100644 --- a/gradle/libs.versions.toml +++ b/gradle/libs.versions.toml @@ -47,7 +47,7 @@ dokka = "2.2.0" # tool already ships is a no-op, so a stale entry is inert rather than harmful. netty = "4.1.138.Final" protobuf = "3.25.9" -jackson = "2.22.2" +jackson = "2.22.3" jsoup = "1.23.2" bouncycastle = "1.85" jose4j = "0.9.6"