Description of the patch:
This update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformats-binary, jackson-modules-base, jackson-parent fixes the following issues
- CVE-2026-54512: jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows
arbitrary class instantiation (bsc#1268897).
- CVE-2026-54513: jackson-databind: array subtype allowlist bypass in BasicPolymorphicTypeValidator (bsc#1268898).
- CVE-2026-54514: jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (bsc#1268899).
- CVE-2026-54515: jackson-databindi: case-insensitive deserialization bypasses per-property @JsonIgnoreProperties
(bsc#1268902).
- jackson-core: document length constraint bypass in blocking, async, and DataInput parsers (bsc#1268603).
Changes for jackson-annotations:
Changes for jackson-bom:
- #68: Remove 'junit' 4.x dependency from 'jackson-base' 2.18.x
to help junit5 migration
- 'base/pom.xml' now creates '${project.version.underscore}' for
'cleansed' version of '${project.version}'
Changes for jackson-core:
- #1611: Apply number-length validator on streaming integer path
of async parser
- #1570: Fail parsing from 'DataInput' if 'StreamReadConstraints
.getMaxDocumentLength()' set
(bsc#1268603, GHSA-2m67-wjpj-xhg9)
- #1600: Rework 3rd party licenses in jar
- #1602: 'UTF8DataInputJsonParser' needs to enforce
'StreamReadConstraints.maxNameLength' limit
- #1512: Number-parsing fix for 'UTF8DataInputJsonParser'
- #1548: 'StreamReadConstraints.maxDocumentLength' not checked
when creating parser with fixed buffer
- #1555: Enforce 'StreamReadConstraints.maxNumberLength' for
non-blocking (async) parser
- #1433: 'JsonParser#getNumberType()' throws
'JsonParseException' when the current...