Update jackson monorepo by renovate[bot] · Pull Request #626 · sir-gon/algorithm-exercises-java

renovate · 2026-11-08T00:39:41Z

This PR contains the following updates:

Package	Change	Age	Confidence
com.fasterxml.jackson.core:jackson-annotations (source)	`2.22` → `2.23`
com.fasterxml.jackson.core:jackson-core	`2.22.4` → `2.23.0`

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

fossabot · 2026-11-08T00:39:45Z

Needs Review

Review before merging: the upgrade creates a version skew between the three core Jackson artifacts. jackson-core and jackson-annotations are upgraded while jackson-databind remains at 2.22.4, and jackson-databind relies on jackson-core for all low-level JSON parsing. The Jackson project expects all three to be aligned, and mismatches can cause subtle runtime failures. jackson-core 2.23.0 also introduces stricter parsing behavior (hardened UTF-8 validation and StreamReadConstraints-based limits on Base64 decoding) that can propagate through jackson-databind into JsonLoader. A failing external Snyk check (security/snyk) could not be analyzed because its logs are unavailable and may indicate a dependency vulnerability. Separately, a Maven Central typosquatting attack used the swapped group ID org.fasterxml.jackson.core; the project uses the legitimate com.fasterxml prefix, but reviewers should confirm no entry or transitive resolution references org.fasterxml. Aligning all three Jackson core artifacts to the same version is strongly recommended before merging.

Tip: Comment @fossabot fix to attempt automatic fixes.

Fix Suggestions

We identified 3 fixable issues in this upgrade.

Upgrade jackson-databind to 2.23.0 in build.gradle to align all three core Jackson artifacts and eliminate version skew
Files: algorithm-exercises-java/build.gradle
Normalize jackson-annotations version from '2.23' to '2.23.0' in build.gradle for consistency with the other Jackson artifacts
Files: algorithm-exercises-java/build.gradle
Verify no reference to the typosquatting group ID 'org.fasterxml.jackson.core' exists in the project
Run: grep -rn 'org\.fasterxml\.jackson' ./
Files: algorithm-exercises-java/build.gradle

AI Assistant Prompt

Copy prompt for AI assistant

## Fix Jackson Dependency Version Skew in build.gradle

This PR upgraded `jackson-core` to 2.23.0 and `jackson-annotations` to 2.23, but left `jackson-databind` at 2.22.4. The Jackson project requires all three core artifacts to be version-aligned. Mismatched versions can cause runtime failures because `jackson-databind` depends on `jackson-core` for low-level JSON parsing.

### File to edit: `algorithm-exercises-java/build.gradle`

Lines 38-41 currently read:
```gradle
    implementation 'com.fasterxml.jackson.core:jackson-core:2.23.0'
    implementation 'com.fasterxml.jackson.core:jackson-annotations:2.23'
    implementation 'com.fasterxml.jackson.core:jackson-databind:2.22.4'
```

### Changes needed (2 fixes):

1. **Upgrade jackson-databind from 2.22.4 to 2.23.0** to align with jackson-core 2.23.0.
2. **Normalize jackson-annotations version from '2.23' to '2.23.0'** for consistency with the other two artifacts.

The corrected lines should be:
```gradle
    implementation 'com.fasterxml.jackson.core:jackson-core:2.23.0'
    implementation 'com.fasterxml.jackson.core:jackson-annotations:2.23.0'
    implementation 'com.fasterxml.jackson.core:jackson-databind:2.23.0'
```

### Verification:
After making changes, confirm that no reference to the typosquatting group ID `org.fasterxml.jackson.core` exists anywhere in the project (the legitimate prefix is `com.fasterxml.jackson.core`). You can verify with:
```bash
grep -r 'org.fasterxml.jackson' .
```
This should return zero results.

What we checked

jackson-core upgraded to 2.23.0 while jackson-databind remains at 2.22.4, creating a version skew among the core Jackson artifacts. ^[1]
jackson-databind:2.22.4 is not upgraded; Gradle conflict resolution will select the higher jackson-core at runtime, so databind runs against a jackson-core it was not tested with. ^[2]
The only Jackson usage is com.fasterxml.jackson.databind.ObjectMapper, so upgrade behavior changes affect the project indirectly through jackson-databind. ^[3]
jackson-core ships as a Multi-Release JAR from 2.14; build tooling that shades or merges JARs without MR support may produce broken artifacts. ^[4]
A typosquatting attack used the swapped group ID org.fasterxml.jackson.core to deliver a malicious payload; the project uses the correct com.fasterxml prefix, but this should be verified. ^[5]
jackson-annotations is listed as 2.23 while jackson-core is 2.23.0; confirm Gradle resolves both to the same artifact version. ^[6]

Dependency Usage

No usage of the analyzed dependencies was found in this repository.

jackson-core upgraded to 2.23.0 while jackson-databind remains at 2.22.4, creating a version skew among the core Jackson artifacts.

algorithm-exercises-java/algorithm-exercises-java/build.gradle

Line 39 in 58cb5de

implementation 'com.fasterxml.jackson.core:jackson-core:2.23.0'
jackson-databind:2.22.4 is not upgraded; Gradle conflict resolution will select the higher jackson-core at runtime, so databind runs against a jackson-core it was not tested with.

algorithm-exercises-java/algorithm-exercises-java/build.gradle

Line 41 in 58cb5de

implementation 'com.fasterxml.jackson.core:jackson-databind:2.22.4'

View 2 more usages

The only Jackson usage is com.fasterxml.jackson.databind.ObjectMapper, so upgrade behavior changes affect the project indirectly through jackson-databind.

algorithm-exercises-java/algorithm-exercises-java/src/main/java/util/JsonLoader.java

Line 3 in 58cb5de

import com.fasterxml.jackson.databind.ObjectMapper;
jackson-annotations is listed as 2.23 while jackson-core is 2.23.0; confirm Gradle resolves both to the same artifact version.

algorithm-exercises-java/algorithm-exercises-java/build.gradle

Line 40 in 58cb5de

implementation 'com.fasterxml.jackson.core:jackson-annotations:2.23'

Changes

jackson-core was updated with 2 security fixes and 1 breaking change: UTF-8 parsers now reject previously-accepted invalid encodings (overlong sequences, surrogates, out-of-range code points) with JsonParseException, Base64 decoding enforces StreamReadConstraints.getMaxStringLength() to prevent oversized payloads, and field names are validated before symbol table caching to prevent malformed name injection. Additionally, 20 bug fixes address numeric conversion accuracy, escape sequence handling, and async parser correctness across jackson-core.

UTF-8 validation hardened in byte-based parsers: overlong encodings (0xC0/0xC1 leads, overlong 3- and 4-byte forms), UTF-8 surrogates, and code points beyond U+10FFFF are now rejected in string values, escape sequences, comments, and field names (core#1782, core#1748). Inputs previously accepted may now fail with JsonParseException. (v2.23.0, package source)
Base64 decoding of binary JSON string values now enforces StreamReadConstraints.getMaxStringLength() during decoding (checked periodically and at end of value). Oversized values are rejected with StreamConstraintsException instead of being fully decoded first. The diff does not cite a CVE ID. (v2.23.0, package source)
Field names decoded from UTF-8 bytes are now validated before being added to the symbol table. Unquoted names with non-ASCII bytes are checked, and the last-quad padding (0xFF) is validated, so invalid names cannot be cached and matched later without validation (core#1748, core#1784). (v2.23.0, package source)

View 32 more changes

Documentation: corrected the word 'deference' to 'dereference' in the JsonInclude Javadoc for the referential-type 'absent' value option (two occurrences) (v2.23, package source)
Documentation: fixed Javadoc examples in JsonProperty (code-block formatting for the multi-field declaration and enum examples) and changed 'a exclusion marker' to 'an exclusion marker' (v2.23, package source)
Build metadata: bumped version from 2.22 to 2.23 in the Maven POM, parent reference, SCM tag, MANIFEST.MF, and pom.properties; reproducible-build timestamp updated (v2.23, package source)
Floating-point number values converted to int/long/BigInteger now use the exact original text (or exact double) rather than a lossy intermediate, so conversion results no longer depend on access order and are not rounded or truncated incorrectly (core#1814). Overflow checks now use the exact value. (v2.23.0, package source)
Numbers with floating-point requested as float/double/BigInteger are now retained as exact BigInteger/text rather than being lossy-parsed to double/float first; deferred double decoding happens once and no longer nulls the retained text (core#1815). (v2.23.0, package source)
Fixed CharTypes UTF-8 input code table so that 0xC0/0xC1 and 0xF5-0xFF lead bytes are treated as invalid per RFC 3629 (core#1782). (v2.23.0, package source)
Fixed CharTypes.charToHex() which masked input with 0xFF, so non-Latin-1 characters (e.g. U+2042) aliased onto ASCII hex digits; now range-checked and returns -1 (core#1787). (v2.23.0, package source)
Fixed CharTypes.initUtf8Names/JS-name table initialization: Arrays.fill used an empty range (128, 128) and now correctly fills 128-256 (core#1748). (v2.23.0, package source)
Fixed ByteSourceJsonBootstrapper creating a ByteArrayInputStream with an incorrect length (_inputEnd instead of the computed length) when constructing a reader for small inputs. (v2.23.0, package source)
When CHARSET_DETECTION is disabled, ByteSourceJsonBootstrapper now sets the encoding in the parsing context (UTF-8) so constructReader() picks up the correct encoding. (v2.23.0, package source)
UTF8DataInputJsonParser root-level handling: root values followed by any valid whitespace (space, tab, CR, LF) are accepted and line counting is correct; nextValue() now returns null at end-of-input between root values instead of failing (core#1795). (v2.23.0, package source)
Corrected JsonLocation row reported for FIELD_NAME tokens in UTF8DataInputJsonParser: the location now refers to the field name rather than the following value (core#1795). (v2.23.0, package source)
Unicode escape and character escape handling: multi-byte UTF-8 characters after a backslash are decoded correctly; supplementary characters and surrogates after backslash now raise a clear 'Unrecognized character escape' error instead of being silently truncated (core#1744, core#1756). Parsers that accepted these previously may now reject them. (v2.23.0, package source)
Error messages for code points beyond the BMP now show the full character and code point (e.g. "'X' (code 128512 / 0x1f600)") instead of a truncated char (core#1756). (v2.23.0, package source)
Control characters in string values are handled consistently with ALLOW_UNESCAPED_CONTROL_CHARS; invalid chars are no longer reduced to plain characters (core#1750). (v2.23.0, package source)
Non-blocking (async) parser: a number ending right after a decimal point at end of input now reports an error correctly (core#1746), and unquoted-name and invalid-value error messages decode multi-byte UTF-8 characters instead of showing raw lead bytes (core#1748). (v2.23.0, package source)
Non-blocking parser: escape sequences split across input buffers (including multi-byte UTF-8 after a backslash and surrogate escapes in names) are now resumed correctly, and invalid second bytes in split sequences are reported properly. (v2.23.0, package source)
Unquoted field names are now padded before symbol table lookup, avoiding [core#148]-style collisions between names that differ only by trailing 0x00 bytes (core#1748). (v2.23.0, package source)
Whitespace validation in UTF8DataInputJsonParser: invalid (non-whitespace) control characters between tokens now raise an error instead of being silently accepted; CR-LF counts as a single line break. (v2.23.0, package source)
Reader-based and generic base64 decoding: the input-consumption flag _tokenIncomplete is now cleared only when the closing quote is reached, so other textual content remains accessible in error cases. finishToken() skips incomplete-token handling when no current token exists after a base64 constraint failure. (v2.23.0, package source)
FilteringParserDelegate.getBinaryValue() now clears the cached current token when the delegate fails with StreamConstraintsException, so the failed value is not visible to the caller. (v2.23.0, package source)
TextBuffer: writeTo(Writer) now performs the same size and string-length validation as contentsAsString() before writing; setCurrentAndReturn() no longer sets an inconsistent segment size. (v2.23.0, package source)
Number conversion: convertNumberToInt()/convertNumberToLong() and related paths handle float-typed values without falling through to an internal error when the NR_FLOAT representation is the only valid one. (v2.23.0, package source)
Deprecated protected NonBlockingJsonParserBase._addName(int[], int, int) (since 2.23); use _decodeAndAddUTF8Name(ByteQuadsCanonicalizer, int[], int, int) instead. Affects only subclasses of the async parser base. (v2.23.0, package source)
Added protected _floatNumberText() hook in ParserBase (default returns retained number text, overridden in JsonParserBase), so subclasses can access the exact original text of floating-point tokens for conversions. (v2.23.0, package source)
Added protected helpers to ParserBase for subclasses: _decodeAndAddUTF8Name(), _findOrAddUnquotedUTF8Name(), _padLastQuad(), _verifyUTF8CodePoint3/4(), _verifyUTF8SecondByte(), _utf8ContinuationCount(), _decodeUTF8ForError(), _handleEscapedUTF8Char(), and _reportInvalidOther() overloads moved from individual parser classes. (v2.23.0, package source)
Added ParserBase.BASE64_CHECK_INTERVAL (8000), _base64MaxDecodedLength(), and _reportBase64LengthExceeded() as protected members for Base64 max-string-length enforcement (@since 2.18.13 backport). (v2.23.0, package source)
Added JsonGeneratorImpl.MAX_BASE64_ENCODE_BUFFER_LENGTH (64 KiB). writeBinary(Base64Variant, InputStream, int) with a known length now allocates a sized encoding buffer (capped) for fewer InputStream reads (core#1622). Applies to both UTF8JsonGenerator and WriterBasedJsonGenerator. (v2.23.0, package source)
Protected helper ParserBase/_padLastQuad changed: NonBlockingUtf8JsonParserBase._padLastQuad(int,int) was a protected static method without checked exceptions and is now an instance method in ParserBase that declares JsonParseException. Only subclasses calling or overriding this protected helper are affected; public API is unchanged. (v2.23.0, package source)
BufferRecycler: default base64 codec byte buffer (index BYTE_BASE64_CODEC_BUFFER) increased from 2000 to 4000 bytes to reduce InputStream reads during binary encoding (core#1622). Memory use per recycled buffer increases slightly. (v2.23.0, package source)
Parser location: currentTokenLocation() for UTF8DataInputJsonParser now reports the field-name start row while a FIELD_NAME is current. (v2.23.0, package source)
Version bump to 2.23.0 across PackageVersion, pom.xml, MANIFEST.MF (Implementation-Version/Specification-Version 2.23), and SCM tag jackson-core-2.23.0. (v2.23.0, package source)

References (6)

[1]: jackson-core upgraded to 2.23.0 while jackson-databind remains at 2.22.4, creating a version skew among the core Jackson artifacts.

algorithm-exercises-java/algorithm-exercises-java/build.gradle

Line 39 in 58cb5de

implementation 'com.fasterxml.jackson.core:jackson-core:2.23.0'

[2]: jackson-databind:2.22.4 is not upgraded; Gradle conflict resolution will select the higher jackson-core at runtime, so databind runs against a jackson-core it was not tested with.

algorithm-exercises-java/algorithm-exercises-java/build.gradle

Line 41 in 58cb5de

implementation 'com.fasterxml.jackson.core:jackson-databind:2.22.4'

[3]: The only Jackson usage is com.fasterxml.jackson.databind.ObjectMapper, so upgrade behavior changes affect the project indirectly through jackson-databind.

algorithm-exercises-java/algorithm-exercises-java/src/main/java/util/JsonLoader.java

Line 3 in 58cb5de

import com.fasterxml.jackson.databind.ObjectMapper;

[4]: jackson-core ships as a Multi-Release JAR from 2.14; build tooling that shades or merges JARs without MR support may produce broken artifacts. (source link)

[5]: A typosquatting attack used the swapped group ID org.fasterxml.jackson.core to deliver a malicious payload; the project uses the correct com.fasterxml prefix, but this should be verified. (source link)

[6]: jackson-annotations is listed as 2.23 while jackson-core is 2.23.0; confirm Gradle resolves both to the same artifact version.

algorithm-exercises-java/algorithm-exercises-java/build.gradle

Line 40 in 58cb5de

implementation 'com.fasterxml.jackson.core:jackson-annotations:2.23'

fossabot analyzed this PR using dependency research and AI. View this analysis on the web

fossabot · 2026-11-08T00:39:46Z

fossabot · 2026-11-08T00:40:38Z

fossabot · 2026-11-08T00:40:39Z

No Issues

No security issues were detected in the SAST scan. The code changes appear to follow secure coding practices.

fossabot analyzed this PR using SAST security analysis and AI (changed files only).

sonarqubecloud · 2026-11-08T00:40:51Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

codecov · 2026-11-08T00:41:12Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (12deb02) to head (58cb5de).

Additional details and impacted files

@@             Coverage Diff             @@
##                main      #626   +/-   ##
===========================================
  Coverage     100.00%   100.00%           
  Complexity       434       434           
===========================================
  Files             76        76           
  Lines           1383      1383           
  Branches         210       210           
===========================================
  Hits            1383      1383

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Update jackson monorepo

58cb5de

sir-gon merged commit 3f9be97 into main Nov 8, 2026
49 of 50 checks passed

renovate Bot deleted the renovate/jackson-monorepo branch November 8, 2026 00:49

Navigation Menu

Repository navigation

Update jackson monorepo - #626

Update jackson monorepo#626
sir-gon merged 1 commit into
mainfrom
renovate/jackson-monorepo

renovate Bot commented Nov 8, 2026

Uh oh!

fossabot Bot commented Nov 8, 2026 •

edited

Loading

Uh oh!

fossabot Bot commented Nov 8, 2026 •

edited

Loading

Uh oh!

fossabot Bot commented Nov 8, 2026 •

edited

Loading

Uh oh!

fossabot Bot commented Nov 8, 2026 •

edited

Loading

Uh oh!

sonarqubecloud Bot commented Nov 8, 2026

Uh oh!

codecov Bot commented Nov 8, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

renovate Bot commented Nov 8, 2026

Configuration

Uh oh!

fossabot Bot commented Nov 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Needs Review

Fix Suggestions

AI Assistant Prompt

What we checked

Dependency Usage

Changes

Uh oh!

fossabot Bot commented Nov 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

fossabot Bot commented Nov 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

fossabot Bot commented Nov 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

No Issues

Uh oh!

sonarqubecloud Bot commented Nov 8, 2026

Quality Gate passed

Uh oh!

codecov Bot commented Nov 8, 2026

Codecov Report

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

fossabot Bot commented Nov 8, 2026 •

edited

Loading

fossabot Bot commented Nov 8, 2026 •

edited

Loading

fossabot Bot commented Nov 8, 2026 •

edited

Loading

fossabot Bot commented Nov 8, 2026 •

edited

Loading