From b6f57da1a1dda5547abe5d2a46f459e1262d39bd Mon Sep 17 00:00:00 2001
From: Rudraroop Ray <rudraroo@amazon.com>
Date: Wed, 19 Aug 2026 16:42:02 +0000
Subject: [PATCH 1/3] Jackson version bump to 2.18.9 for CVE

---
 aws-lambda-java-serialization/RELEASE.CHANGELOG.md | 4 ++++
 aws-lambda-java-serialization/pom.xml              | 2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/aws-lambda-java-serialization/RELEASE.CHANGELOG.md b/aws-lambda-java-serialization/RELEASE.CHANGELOG.md
index 3bb97793..2aaa8732 100644
--- a/aws-lambda-java-serialization/RELEASE.CHANGELOG.md
+++ b/aws-lambda-java-serialization/RELEASE.CHANGELOG.md
@@ -1,3 +1,7 @@
+### Aug 20, 2026
+`1.4.2`:
+- Update `jackson-databind` dependency from 2.18.6 to 2.18.9
+
 ### May 20, 2026
 `1.4.1`:
 - Fix build issue
diff --git a/aws-lambda-java-serialization/pom.xml b/aws-lambda-java-serialization/pom.xml
index 8b2b754a..fbdb93d9 100644
--- a/aws-lambda-java-serialization/pom.xml
+++ b/aws-lambda-java-serialization/pom.xml
@@ -35,7 +35,7 @@
         <maven.compiler.source>1.8</maven.compiler.source>
         <maven.compiler.target>1.8</maven.compiler.target>
         <relocation.prefix>com.amazonaws.lambda.thirdparty</relocation.prefix>
-        <jackson.version>2.18.6</jackson.version>
+        <jackson.version>2.18.9</jackson.version>
         <gson.version>2.10.1</gson.version>
         <json.version>20231013</json.version>
         <owasp.version>7.3.2</owasp.version>

From c38b1b13e347ad2558c48912edf816f95c221aa2 Mon Sep 17 00:00:00 2001
From: Rudraroop Ray <rudraroo@amazon.com>
Date: Wed, 19 Aug 2026 17:02:14 +0000
Subject: [PATCH 2/3] Adding next version of serialization post auto-bump to
 the test package

---
 aws-lambda-java-tests/pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/aws-lambda-java-tests/pom.xml b/aws-lambda-java-tests/pom.xml
index bb0c7ab7..40d4d0c3 100644
--- a/aws-lambda-java-tests/pom.xml
+++ b/aws-lambda-java-tests/pom.xml
@@ -43,7 +43,7 @@
         -->
         <junit.version>5.9.2</junit.version>
         <jacoco.maven.plugin.version>0.8.7</jacoco.maven.plugin.version>
-        <aws-lambda-java-serialization.version>1.4.1</aws-lambda-java-serialization.version>
+        <aws-lambda-java-serialization.version>1.4.2</aws-lambda-java-serialization.version>
         <aws-lambda-java-events.version>3.16.1</aws-lambda-java-events.version>
         <commons-lang3.version>3.18.0</commons-lang3.version>
         <assertj-core.version>3.27.7</assertj-core.version>

From 9bd304e308b2ed54899fde771730def99d022d30 Mon Sep 17 00:00:00 2001
From: Rudraroop Ray <rudraroo@amazon.com>
Date: Thu, 20 Aug 2026 10:08:00 +0000
Subject: [PATCH 3/3] Revert "Adding next version of serialization post
 auto-bump to the test package"

This reverts commit c38b1b13e347ad2558c48912edf816f95c221aa2.
---
 aws-lambda-java-tests/pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/aws-lambda-java-tests/pom.xml b/aws-lambda-java-tests/pom.xml
index 40d4d0c3..bb0c7ab7 100644
--- a/aws-lambda-java-tests/pom.xml
+++ b/aws-lambda-java-tests/pom.xml
@@ -43,7 +43,7 @@
         -->
         <junit.version>5.9.2</junit.version>
         <jacoco.maven.plugin.version>0.8.7</jacoco.maven.plugin.version>
-        <aws-lambda-java-serialization.version>1.4.2</aws-lambda-java-serialization.version>
+        <aws-lambda-java-serialization.version>1.4.1</aws-lambda-java-serialization.version>
         <aws-lambda-java-events.version>3.16.1</aws-lambda-java-events.version>
         <commons-lang3.version>3.18.0</commons-lang3.version>
         <assertj-core.version>3.27.7</assertj-core.version>