mirror of
https://github.com/lancedb/lancedb.git
synced 2026-10-13 07:12:27 +00:00
Will JonesandClaude Opus 5.5
c2c8269fc8
## Summary The Java SDK pinned `jackson-databind` 2.17.1, and `jackson-core` and the other Jackson modules came in transitively via `arrow-vector` and `lance-namespace-apache-client` at 2.16.x–2.17.x, all affected by known CVEs. This imports `jackson-bom` 2.18.11 in the parent POM, and declares `jackson-core`, `jackson-annotations`, `jackson-datatype-jsr310`, and `jackson-jaxrs-json-provider` as direct (BOM-managed) dependencies of `lancedb-core`. The direct declarations are needed because the parent's dependency management doesn't apply to a consumer's transitive resolution; without them, Maven's nearest-wins mediation still hands downstream apps the older versions from `arrow-vector`. ## Evidence `mvn dependency:list` in a separate consumer project depending only on `lancedb-core`: | Artifact | Before | After | |---|---|---| | jackson-core | 2.16.0 | 2.18.11 | | jackson-annotations | 2.16.0 | 2.18.11 | | jackson-databind | 2.17.1 | 2.18.11 | | jackson-datatype-jsr310 | 2.16.0 | 2.18.11 | | jackson-jaxrs-base / json-provider | 2.17.1 | 2.18.11 | | jackson-module-jaxb-annotations | 2.17.1 | 2.18.11 | ## Merge Risk **Door:** Two-way. Dependency versions only, and they stay within Jackson 2.x. **Blast Radius:** `java` dependencies. Downstream users of `lancedb-core` now get Jackson 2.18.11 transitively. Fixes OSS-2360, OSS-2337 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>