From 2ef728656802eb63d8f32fa601eee10df1480495 Mon Sep 17 00:00:00 2001 From: Arunav Gandhi Date: Tue, 10 Nov 2026 14:06:34 +0530 Subject: [PATCH] [NAPP-244] Fix jackson and java-jwt CVEs (ESD-71218) Bump com.auth0:java-jwt 4.6.1 -> 4.6.2 and the jackson-bom pin 2.22.2 -> 2.22.4, and declare jackson-core / jackson-databind directly (explicit 2.22.4) so Maven consumers and POM-only scanners also resolve the patched version. java-jwt 4.6.2 still pulls Jackson 2.22.3, which is affected by CVE-2026-110879. Addresses CVE-2026-85473 (java-jwt), CVE-2026-89425 and CVE-2026-89407 (jackson-core), CVE-2026-91776, CVE-2026-91777 and CVE-2026-110879 (jackson-databind). Co-Authored-By: Claude --- guardian/build.gradle | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/guardian/build.gradle b/guardian/build.gradle index 733f105..c8d3df4 100644 --- a/guardian/build.gradle +++ b/guardian/build.gradle @@ -167,9 +167,13 @@ dependencies { implementation 'com.squareup.okhttp3:okhttp' implementation 'com.squareup.okhttp3:logging-interceptor' // JWT signing/verification - implementation 'com.auth0:java-jwt:4.6.1' - // Pin patched Jackson (fixes CVEs in the version pulled transitively by java-jwt) - implementation platform('com.fasterxml.jackson:jackson-bom:2.22.2') + implementation 'com.auth0:java-jwt:4.6.2' + // Pin patched Jackson (fixes CVEs in the version pulled transitively by java-jwt). + // Declared directly, with an explicit version, so Maven consumers (nearest-wins) and POM-only + // scanners also resolve the patched version. Keep these in sync with the BOM above. + implementation platform('com.fasterxml.jackson:jackson-bom:2.22.4') + implementation 'com.fasterxml.jackson.core:jackson-core:2.22.4' + implementation 'com.fasterxml.jackson.core:jackson-databind:2.22.4' testImplementation 'com.squareup.okhttp3:mockwebserver' // Mockito