[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
com.fasterxml.jackson.core:jackson-databind (source)	2.22.4 → 2.23.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[fossabot]

Needs Review

I recommend reviewing this upgrade before merging because several factors require human validation. A failing external CI check from Snyk (security/snyk) cannot be analyzed (logs are unavailable from this provider), and per policy this mandates a needs-review verdict. Additionally, this release introduces stricter UTF-8 validation that may reject previously accepted input, and changes null-handling behavior in readerForUpdating() with @​JsonSetter(nulls = Nulls.SKIP) on creator properties. While the codebase's actual jackson-databind usage in JsonLoader.java is limited to basic ObjectMapper deserialization (reading typed lists from JSON files), which is unlikely to be directly affected by the null-handling or UTF-8 behavioral changes, the Snyk failure warrants investigation to understand whether it relates to the typosquatting malware alert for a similarly-named package (org.fasterxml.jackson.core:jackson-databind) or to the upgraded version itself. That malicious package is distinct from this upgrade but its existence in the Maven ecosystem means verifying build caches and local resolvers are clean is prudent. No security vulnerabilities were identified for the specific version range in scope.

Tip: Comment @​fossabot fix to attempt automatic fixes.

Fix Suggestions

We identified 3 fixable issues in this upgrade.

• Verify the build.gradle dependency uses the legitimate com.fasterxml.jackson.core group ID and not the typosquatting org.fasterxml.jackson.core variant
  Run: grep -rn 'org.fasterxml.jackson' ./
  Files: algorithm-exercises-java/build.gradle
• Verify JSON test-data files contain valid UTF-8 (Jackson 2.23 now rejects overlong UTF-8 sequences that were previously silently accepted)
  Run: find ./ -name '*.json' -exec python3 -c "import sys; [open(f,'rb').read().decode('utf-8') for f in sys.argv[1:]]" {} +
  Files: algorithm-exercises-java/src/main/java/util/JsonLoader.java
• Investigate the failing Snyk CI check (security/snyk) to determine whether it flags the Jackson 2.23.0 upgrade or is unrelated
  Files: .github/workflows/build.yaml

What we checked

• Direct dependency declaration: implementation 'com.fasterxml.jackson.core:jackson-databind:2.23.0'. This is a first-party, explicit dependency in the build file, confirming the upgrade is intentional and the library is in active use. ^[1]
• Active import of com.fasterxml.jackson.databind.ObjectMapper. The class creates ObjectMapper instances and uses readerForListOf(type).readValue(objectMapper.readTree(file)) to load typed lists from JSON test-data files. This is straightforward usage unlikely to be impacted by the null-handling or view-filtering behavioral changes in the new version. ^[2]
• The new version introduces stricter UTF-8 validation: overlong sequences previously accepted silently are now rejected. If any JSON test-data files in this project contain non-standard byte sequences, deserialization in JsonLoader.loadJson() could begin throwing parse errors that did not occur before. ^[3]
• Null-handling behavioral change: readerForUpdating() combined with @​JsonSetter(nulls = Nulls.SKIP) on creator properties no longer overwrites non-null values with null. JsonLoader.java does not use readerForUpdating(), so this specific change is not expected to affect current usage. ^[4]
• A typosquatting malicious package org.fasterxml.jackson.core:jackson-databind (using org. prefix instead of the legitimate com.) was discovered on Maven Central. It downloads and executes a Cobalt Strike beacon on startup. This is NOT the package being upgraded, but its presence in the ecosystem warrants verifying that local caches and lock files do not accidentally reference the org. variant. The Snyk CI failure may be related to this advisory. ^[5]
• The project also upgrades jackson-core to 2.23.0 and jackson-annotations to 2.23 in the same build file, keeping the Jackson BOM trio in sync. No version mismatches exist between the core Jackson artifacts. ^[6]

Dependency Usage

No usage of the analyzed dependencies was found in this repository.

• Direct dependency declaration: implementation 'com.fasterxml.jackson.core:jackson-databind:2.23.0'. This is a first-party, explicit dependency in the build file, confirming the upgrade is intentional and the library is in active use.
  

  algorithm-exercises-java/algorithm-exercises-java/build.gradle

  Line 41 in 634e417

  implementation 'com.fasterxml.jackson.core:jackson-databind:2.23.0'

• Active import of com.fasterxml.jackson.databind.ObjectMapper. The class creates ObjectMapper instances and uses readerForListOf(type).readValue(objectMapper.readTree(file)) to load typed lists from JSON test-data files. This is straightforward usage unlikely to be impacted by the null-handling or view-filtering behavioral changes in the new version.
  

  algorithm-exercises-java/algorithm-exercises-java/src/main/java/util/JsonLoader.java

  Line 3 in 634e417

  import com.fasterxml.jackson.databind.ObjectMapper;

View 1 more usage

• The project also upgrades jackson-core to 2.23.0 and jackson-annotations to 2.23 in the same build file, keeping the Jackson BOM trio in sync. No version mismatches exist between the core Jackson artifacts.
  

  algorithm-exercises-java/algorithm-exercises-java/build.gradle

  Line 39 in 634e417

  implementation 'com.fasterxml.jackson.core:jackson-core:2.23.0'

Changes

jackson-databind has been updated with a targeted security fix that rejects deserialization of known gadget types as Map keys, blocking a polymorphic deserialization attack vector. The update also includes 14 bug fixes addressing @​JsonView filtering gaps across creator properties, builder-based deserializers, and EnumMap; null-handling correctness for primitive deserializers; @​JsonAlias support for enums; and a duplicate-key merging bug in UntypedObjectDeserializer.

• Key deserializers for known gadget types are now rejected. StdKeyDeserializers.findStringBasedKeyDeserializer() checks SubTypeValidator and throws InvalidDefinitionException for illegal Map key types (e.g. known polymorphic-deserialization gadget classes). (v2.23.0, package source)
• Creator properties (POJO, Map, EnumMap, Enum factory creators) now honor @​JsonView when the active view hides them. Previously they were not filtered in several code paths. Hidden creator properties are now skipped, or fail when FAIL_ON_UNEXPECTED_VIEW_PROPERTIES is enabled. This may change results for users who relied on the old behavior (databind#5971, #6261, #6077). (v2.23.0, package source)
• Properties hidden by the active view now go through the unified view handling. With FAIL_ON_UNEXPECTED_VIEW_PROPERTIES enabled, BeanAsArrayDeserializer and builder-based deserialization now report the mismatch instead of silently skipping it (databind#5969, #6077). (v2.23.0, package source)

View 16 more changes

• EnumMap, Map, and Enum factory-based creators now assign the views of creator parameters (_assignCreatorViews), so view-based filtering applies to them the same way it does for POJO creator properties (databind#6261). (v2.23.0, package source)
• CreatorProperty.set()/setAndReturn() now skip null values when the property uses a skip-nulls null provider (NullsConstantProvider.isSkipper). This fixes the fallback setter path ignoring Nulls.SKIP settings (databind#6338). (v2.23.0, package source)
• Enum aliases (@​JsonAlias) are now honored when building EnumResolver, so aliases are accepted during enum deserialization. Empty @​JsonAlias annotations are ignored, and aliases set by a secondary introspector in AnnotationIntrospectorPair are preserved (databind#6210, #6339). (v2.23.0, package source)
• A property annotated with both @​JsonKey and @​JsonValue (or with both in the same way fields are handled) is no longer treated as a regular property; both accessors are registered (databind#6240). (v2.23.0, package source)
• Bracketed IPv6 InetSocketAddress deserialization is more robust: it uses the first ']' rather than the last, and malformed trailing content is reported through the problem-handler path (handleWeirdStringValue) instead of throwing InvalidFormatException directly. (v2.23.0, package source)
• Primitive char/Character deserialization handles null more consistently. A null returned by a DeserializationProblemHandler for a primitive char now follows FAIL_ON_NULL_FOR_PRIMITIVES instead of being passed through. char[] deserialization also honors the content nuller, and CharDeser.withResolved() now preserves the nuller and unwrap-single settings instead of returning this. (v2.23.0, package source)
• Primitive boolean and numeric deserializers now handle a null returned by a DeserializationProblemHandler: it is verified against FAIL_ON_NULL_FOR_PRIMITIVES, and when allowed it becomes false or 0 rather than causing an NPE. Single-element unwrapped byte[] handling is also consolidated. (v2.23.0, package source)
• Custom KeyDeserializer results for untyped Maps (Map<Object,...>) are validated. A non-String key now produces a clear InvalidDefinitionException instead of a ClassCastException. (v2.23.0, package source)
• Fixed duplicate-key squashing in UntypedObjectDeserializer (_mapObjectWithDups). It used the first key for every squashed duplicate instead of the current key, which could merge values under the wrong property name. (v2.23.0, package source)
• WritableObjectId and BeanSerializerBase now write a JSON null when an object id is null (e.g. an id property not yet assigned) instead of failing when alwaysAsId is set. (v2.23.0, package source)
• ArrayBuilders array equality now correctly handles null elements (the previous logic ignored a null in the default array). (v2.23.0, package source)
• NullSerializer is no longer annotated with @​JacksonStdImpl. Optimization modules such as Afterburner and Blackbird no longer treat it as a replaceable default serializer. (v2.23.0, package source)
• Added protected helper BeanDeserializerBase.handleUnexpectedView(JsonParser, DeserializationContext, SettableBeanProperty, Class<?>) (@​since 2.23). It centralizes handling of properties hidden by the active view: it reports an error when FAIL_ON_UNEXPECTED_VIEW_PROPERTIES is enabled, otherwise it skips the value. Subclasses that override view handling can use it. (v2.23.0, package source)
• Added protected helpers to StdDeserializer for primitive handling of problem-handler results: _verifyNullForPrimitive(ctxt, JsonToken), _handleUnexpectedBooleanPrimitive(), _handleUnexpectedNumberPrimitive(), and _nonNullNumberFromHandler() (all @​since 2.23). Custom deserializers extending StdDeserializer can use them. (v2.23.0, package source)
• Documentation: AnnotationIntrospector.findEnumAliases() now states that implementations should assign only entries they have aliases for, since AnnotationIntrospectorPair passes the same array to the secondary and then the primary introspector. PolymorphicTypeValidator Javadoc now recommends BasicPolymorphicTypeValidator. (v2.23.0, package source)
• Build and metadata updates: version bumped from 2.22.4 to 2.23.0 in the POM, MANIFEST, PackageVersion, and SCM tag; reproducible build timestamp updated; test-profile comment updated. (v2.23.0, package source)

References (6)

[1]: Direct dependency declaration: implementation 'com.fasterxml.jackson.core:jackson-databind:2.23.0'. This is a first-party, explicit dependency in the build file, confirming the upgrade is intentional and the library is in active use.

algorithm-exercises-java/algorithm-exercises-java/build.gradle

Line 41 in 634e417

implementation 'com.fasterxml.jackson.core:jackson-databind:2.23.0'

[2]: Active import of com.fasterxml.jackson.databind.ObjectMapper. The class creates ObjectMapper instances and uses readerForListOf(type).readValue(objectMapper.readTree(file)) to load typed lists from JSON test-data files. This is straightforward usage unlikely to be impacted by the null-handling or view-filtering behavioral changes in the new version.

algorithm-exercises-java/algorithm-exercises-java/src/main/java/util/JsonLoader.java

Line 3 in 634e417

import com.fasterxml.jackson.databind.ObjectMapper;

[3]: The new version introduces stricter UTF-8 validation: overlong sequences previously accepted silently are now rejected. If any JSON test-data files in this project contain non-standard byte sequences, deserialization in JsonLoader.loadJson() could begin throwing parse errors that did not occur before. (source link)

[4]: Null-handling behavioral change: readerForUpdating() combined with @​JsonSetter(nulls = Nulls.SKIP) on creator properties no longer overwrites non-null values with null. JsonLoader.java does not use readerForUpdating(), so this specific change is not expected to affect current usage. (source link)

[5]: A typosquatting malicious package org.fasterxml.jackson.core:jackson-databind (using org. prefix instead of the legitimate com.) was discovered on Maven Central. It downloads and executes a Cobalt Strike beacon on startup. This is NOT the package being upgraded, but its presence in the ecosystem warrants verifying that local caches and lock files do not accidentally reference the org. variant. The Snyk CI failure may be related to this advisory. (source link)

[6]: The project also upgrades jackson-core to 2.23.0 and jackson-annotations to 2.23 in the same build file, keeping the Jackson BOM trio in sync. No version mismatches exist between the core Jackson artifacts.

algorithm-exercises-java/algorithm-exercises-java/build.gradle

Line 39 in 634e417

implementation 'com.fasterxml.jackson.core:jackson-core:2.23.0'

---

fossabot analyzed this PR using dependency research and AI. View this analysis on the web

[fossabot]

[fossabot]

[fossabot]

No Issues

No security issues were detected in the SAST scan. The code changes appear to follow secure coding practices.

---

fossabot analyzed this PR using SAST security analysis and AI (changed files only).

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (3f9be97) to head (634e417).

Additional details and impacted files

@@             Coverage Diff             @@
##                main      #627   +/-   ##
===========================================
  Coverage     100.00%   100.00%           
  Complexity       434       434           
===========================================
  Files             76        76           
  Lines           1383      1383           
  Branches         210       210           
===========================================
  Hits            1383      1383           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.