From c2c8269fc83b5f1b09ed26d04408bfe980f45b4f Mon Sep 17 00:00:00 2001
From: Will Jones <willjones127@gmail.com>
Date: Fri, 9 Oct 2026 19:55:19 -0700
Subject: [PATCH] fix(java): upgrade Jackson to 2.18.11 to address CVEs (#4500)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## Summary

The Java SDK pinned `jackson-databind` 2.17.1, and `jackson-core` and
the other Jackson modules came in transitively via `arrow-vector` and
`lance-namespace-apache-client` at 2.16.x–2.17.x, all affected by known
CVEs.

This imports `jackson-bom` 2.18.11 in the parent POM, and declares
`jackson-core`, `jackson-annotations`, `jackson-datatype-jsr310`, and
`jackson-jaxrs-json-provider` as direct (BOM-managed) dependencies of
`lancedb-core`. The direct declarations are needed because the parent's
dependency management doesn't apply to a consumer's transitive
resolution; without them, Maven's nearest-wins mediation still hands
downstream apps the older versions from `arrow-vector`.

## Evidence

`mvn dependency:list` in a separate consumer project depending only on
`lancedb-core`:

| Artifact | Before | After |
|---|---|---|
| jackson-core | 2.16.0 | 2.18.11 |
| jackson-annotations | 2.16.0 | 2.18.11 |
| jackson-databind | 2.17.1 | 2.18.11 |
| jackson-datatype-jsr310 | 2.16.0 | 2.18.11 |
| jackson-jaxrs-base / json-provider | 2.17.1 | 2.18.11 |
| jackson-module-jaxb-annotations | 2.17.1 | 2.18.11 |

## Merge Risk

**Door:** Two-way. Dependency versions only, and they stay within
Jackson 2.x.
**Blast Radius:** `java` dependencies. Downstream users of
`lancedb-core` now get Jackson 2.18.11 transitively.

Fixes OSS-2360, OSS-2337

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 java/lancedb-core/pom.xml | 25 ++++++++++++++++++++++++-
 java/pom.xml              | 10 ++++++++++
 2 files changed, 34 insertions(+), 1 deletion(-)

diff --git a/java/lancedb-core/pom.xml b/java/lancedb-core/pom.xml
index df20bc7f0..9affef0ef 100644
--- a/java/lancedb-core/pom.xml
+++ b/java/lancedb-core/pom.xml
@@ -44,7 +44,30 @@
         <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
             <artifactId>jackson-databind</artifactId>
-            <version>2.17.1</version>
+        </dependency>
+
+        <!-- Declared directly so downstream consumers resolve the patched versions:
+             the parent's jackson-bom only manages our own build, and otherwise Maven's
+             nearest-wins mediation picks older versions via arrow-vector and
+             lance-namespace-apache-client. -->
+        <dependency>
+            <groupId>com.fasterxml.jackson.core</groupId>
+            <artifactId>jackson-core</artifactId>
+        </dependency>
+
+        <dependency>
+            <groupId>com.fasterxml.jackson.core</groupId>
+            <artifactId>jackson-annotations</artifactId>
+        </dependency>
+
+        <dependency>
+            <groupId>com.fasterxml.jackson.datatype</groupId>
+            <artifactId>jackson-datatype-jsr310</artifactId>
+        </dependency>
+
+        <dependency>
+            <groupId>com.fasterxml.jackson.jaxrs</groupId>
+            <artifactId>jackson-jaxrs-json-provider</artifactId>
         </dependency>
 
         <dependency>
diff --git a/java/pom.xml b/java/pom.xml
index e6308140d..be828e21a 100644
--- a/java/pom.xml
+++ b/java/pom.xml
@@ -29,6 +29,7 @@
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <arrow.version>15.0.0</arrow.version>
         <lance-core.version>14.0.0-beta.10</lance-core.version>
+        <jackson.version>2.18.11</jackson.version>
         <spotless.skip>false</spotless.skip>
         <spotless.version>2.30.0</spotless.version>
         <spotless.java.googlejavaformat.version>1.7</spotless.java.googlejavaformat.version>
@@ -62,6 +63,15 @@
 
     <dependencyManagement>
         <dependencies>
+            <!-- Pin every Jackson artifact, including ones pulled in transitively
+                 (e.g. jackson-core), to a single patched version. -->
+            <dependency>
+                <groupId>com.fasterxml.jackson</groupId>
+                <artifactId>jackson-bom</artifactId>
+                <version>${jackson.version}</version>
+                <type>pom</type>
+                <scope>import</scope>
+            </dependency>
             <dependency>
                 <groupId>org.lance</groupId>
                 <artifactId>lance-core</artifactId>