fix(deps): update all non-major dependencies - #271
Merged
Conversation
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
July 11, 2026 23:41
5f7062a to
0ce3ada
Compare
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
July 18, 2026 11:50
0ce3ada to
b437020
Compare
|
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
3 times, most recently
from
July 28, 2026 09:30
76b9fe9 to
90c762e
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
July 28, 2026 09:35
90c762e to
c4c212c
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v7.0.0→v7.0.1v5.3.0→v5.6.0v6.4.0→v6.5.024.17.0→24.18.06.1.0→6.1.26.1.0→6.1.21.24.0→1.25.03.5.0→3.5.12.22.0→2.22.1Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnoreProperties
CVE-2026-54515 / GHSA-5jmj-h7xm-6q6v
More information
Details
Summary
In
BeanDeserializerBase.createContextual(), per-property@JsonIgnorePropertiesexclusions are applied by_handleByNameInclusion(), producing acontextualdeserializer whoseBeanPropertyMaphas the ignored properties removed. The subsequent per-property case-insensitivity block (triggered by@JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES)) rebuilds fromthis._beanProperties(the original, unfiltered map) instead ofcontextual._beanProperties, then overwrites the filtered map — restoring every property_handleByNameInclusionhad just removed. The ignored property becomes writable again.Impact
An application that both enables case-insensitive matching and relies on per-property
@JsonIgnorePropertiesto keep a field unwritable can have that field set from untrusted JSON (mass-assignment-style write).Affected / Patched
Will be fixed in 2.18.9, 2.21.5, 2.22.1 and 3.1.4.
Severity / CWE
Maintainer: minor. Reporter: Moderate. CWE-915.
Upstream fix
FasterXML/jackson-databind#5962 (PR #5964,
0e1b0b2), milestone 3.1.4. Released 2026-06-04.Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
jackson-databind: @JsonView ypassed for @JsonUnwrapped container properties on deserialization
CVE-2026-59889 / GHSA-5gvw-p9qm-jgwh
More information
Details
Summary
UnwrappedPropertyHandler.processUnwrapped()replays the buffered JSON for a@JsonUnwrappedproperty by iterating its properties and callingprop.deserializeAndSet()with noprop.visibleInView(ctxt.getActiveView())guard — the exact guardprocessUnwrappedCreatorProperties()received in the #5971 / GHSA-rcqc-6cw3-h962 fix, and the guardBeanDeserializer.deserializeWithUnwrappedapplies to directly-matched properties. As a result, a property annotated with both@JsonView(PrivilegedView.class)and@JsonUnwrappedis written from attacker JSON even when deserializing under a more-restrictive active view.Correction to the original framing (runtime-verified): the gap is NOT a per-field inner
@JsonView(the unwrapped sub-object's ownBeanDeserializergates inner fields correctly). The unchecked gate is the view of the unwrapped CONTAINER property.Intent proof (runtime, 2.x HEAD 21dd70dd and 3.x HEAD 7a5939d6)
An
@JsonView(AdminView)property that is NOT@JsonUnwrapped→nullunderPublicView(correctly gated). The identical property WITH@JsonUnwrapped→ fully populated (bypass). The fix the creator path already received, not applied to the regular-property method.Impact — write-side mass-assignment / privilege escalation
@JsonViewis commonly used as a write-side authorization guard: a public endpoint binds the body underreaderWithView(PublicView.class)and groups privileged state in a nested object whose container property is@JsonView(AdminView). When that property is@JsonUnwrapped, an untrusted caller mass-assigns it. PoC: a self-service registration whereAccountFlags{role,approved,creditBalance}is@JsonView(AdminView) @​JsonUnwrapped; attacker JSON{role:ADMIN,approved:true,creditBalance:1000000}underPublicViewbinds all three → approved admin with arbitrary balance. The failing gate is a WRITE gate, hence integrity-high (C:N/I:H/A:N); no worse than the C:L/I:L parent and arguably higher as@JsonView-as-write-guard is the exact use case #5971/#5969 defended.Affected
com.fasterxml.jackson.core:jackson-databind2.x: confirmed bypass at 21dd70dd (== released 2.21.4 / 2.22.0 line; includes the #5973 backport).DEFAULT_VIEW_INCLUSIONdefault=true.tools.jackson.core:jackson-databind3.x: confirmed bypass at HEAD 7a5939d6 (latest 3.x).DEFAULT_VIEW_INCLUSIONdefault=false → the stock-config repro is the common shape where privileged inner fields are individually@JsonView(PublicView)and the developer relies on the container@JsonView(AdminView); the 3.x PoC mass-assigns role/approved/creditBalance under PublicView. (The other simultaneous report's PoC was reportedly fixed on 3.x; this distinct container-property path is not.)Additive variants (runtime-confirmed both branches; all closed by the same one-line guard)
@JsonUnwrapped(unwrapped-in-unwrapped) — recursive bypass.readerWithView(...).withValueToUpdate(...)(PATCH/partial-update) — bypass; non-unwrapped merge control gates correctly.@JsonDeserialize(builder=...)) —BuilderBasedDeserializerroutes through the sameprocessUnwrapped.@JsonAnySetter+view and@JsonTypeInfo+@JsonUnwrappedare separate/unsupported behaviors, not this bug.Fix
Add
prop.visibleInView(ctxt.getActiveView())(whenMapperFeature.DEFAULT_VIEW_INCLUSION/active-view applies) to theprocessUnwrapped()property loop, mirroringprocessUnwrappedCreatorProperties(). One change closes the impact PoC + all three variants acrossBeanDeserializerandBuilderBasedDeserializer. Full runnable PoCs (2.x + 3.x) + variant harnesses available on request.Severity
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
actions/checkout (actions/checkout)
v7.0.1Compare Source
actions/setup-java (actions/setup-java)
v5.6.0Compare Source
What's Changed
Full Changelog: actions/setup-java@v5...v5.6.0
v5.5.0Compare Source
v5.4.0Compare Source
What's Changed
New Contributors
Full Changelog: actions/setup-java@v5...v5.4.0
actions/setup-node (actions/setup-node)
v6.5.0Compare Source
What's Changed
Full Changelog: actions/setup-node@v6.4.0...v6.5.0
actions/node-versions (node)
v24.18.0: 24.18.0Compare Source
Node.js 24.18.0
junit-team/junit-framework (org.junit.jupiter:junit-jupiter-engine)
v6.1.1jreleaser/jreleaser (org.jreleaser:jreleaser-maven-plugin)
v1.25.0Compare Source
Binaries
https://github.com/jreleaser/jreleaser/wiki/Release-v1.25.0
Changelog
🚀 Features
assemble
1404462Resolve native-image distribution artifacts with multiple archive formats, closes #2106e0c5956Update gradle DSL, closes #210603ece6eResolve jlink distribution artifacts with multiple archive formats, closes #210627d5a50Support multiple archive formats in jlink assembler, closes #2106core
36e4e99Provide secret hints, closes #2141release
d2c2784Expose snapshot enabled status🐛 Fixes
deploy
dc7c2e4Clarify Maven Central polling log wording, closes #2125jdks
2dac6f3Drop unsupported connectTimeOut from download-maven-plugin call, closes #2126packager
69d6677Update Chcolatey GH workflows, closes #2117release
7d4d23aEnsure JRELEASER_PREVIOUS_TAG_NAME is used with snapshot releases, closes #2136signing
65e3fb7PGP no longer requires a publicKey to be set, closes #2143b5b088bskip signing validation errors when --yolo is set, closes #2128validation
c47df63Correct project identifier log message for GitLab deployer🛠 Build
e6c5adcUpdate release announcementsddd5b2cBump flatpack runtime to 25.08📝 Documentation
347c635Add mvanhorn as a contributor for codecb8ab48Add seonwooj0810 as a contributor for code⚙️ Dependencies
951142cUpdate zstd-jni to 1.5.7-116457cb6Update woodstox to 7.2.16d729a0Update syft to 1.46.08ae6a3eUpdate slf4j to 2.0.18390afffUpdate tika to 2.9.47744f7bUpdate jacoco to 0.8.1506cb7ebUpdate jackson to 2.22.0d5b4c90Update cyclonedx to 0.32.05febc13Update cosign to 3.1.12ba4c3eUpdate commons-jexl to 3.6.3eaad81aUpdate classworlds to 2.12.0f34068bUpdate classmate to 1.7.35850a5eUpdate byte-buddy to 1.18.10650fa89Update aws-java-sdk to 2.46.177fd8875Update asm to 9.10.1817d8b4Update jdks-gradle-plugin to 1.24.076e2accReleasing version 1.25.05e48b86Bump for next development cycleContributors
We'd like to thank the following people for their contributions:
apache/maven-jar-plugin (org.apache.maven.plugins:maven-jar-plugin)
v3.5.1Configuration
📅 Schedule: (in timezone Europe/Oslo)
* 0-3 * * 1)🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.