Jackson version bump to 2.18.9 - #635
Conversation
There was a problem hiding this comment.
Pull request overview
Warning
Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.
This PR upgrades the Jackson dependency version used by aws-lambda-java-serialization to address reported CVEs, and bumps the tests module to consume the new serialization version.
Changes:
- Bump
aws-lambda-java-serializationJackson version from2.18.6to2.18.9. - Update
aws-lambda-java-teststo depend onaws-lambda-java-serialization1.4.2. - Add a
1.4.2entry to the serialization release changelog.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| aws-lambda-java-tests/pom.xml | Updates tests module to use serialization 1.4.2. |
| aws-lambda-java-serialization/pom.xml | Bumps Jackson version property to 2.18.9. |
| aws-lambda-java-serialization/RELEASE.CHANGELOG.md | Documents the 1.4.2 release and dependency bump. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #635 +/- ##
=========================================
Coverage 65.38% 65.38%
Complexity 212 212
=========================================
Files 34 34
Lines 991 991
Branches 143 143
=========================================
Hits 648 648
Misses 290 290
Partials 53 53 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
| --> | ||
| <junit.version>5.9.2</junit.version> | ||
| <jacoco.maven.plugin.version>0.8.7</jacoco.maven.plugin.version> | ||
| <aws-lambda-java-serialization.version>1.4.1</aws-lambda-java-serialization.version> |
There was a problem hiding this comment.
It's fine but we need to remember of releasing also this package in the followup PR.
There was a problem hiding this comment.
actually I was wrong. The test are exercised locally but you need to have the same version, otherwise it will fail the test, because it is registered locally as 1.4.1.
…st package" This reverts commit c38b1b1.
Issue #, if available:
Description of changes:
Upgrade
jacksondependency version to2.18.9in the serialization package to address the following CVE reports CVE-2026-54512 and CVE-2026-54513Will update tests package separately after maven workflow's auto version bump for serialization
Target (OCI, Managed Runtime, both):
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.