openSUSE-SU-2026:21375-1

Description of the patch:

This update for jackson-annotations, jackson-core, jackson-databind fixes the following issues:

• CVE-2026-54515: rebuilding the property map from unfiltered bean properties could permit a bypass of @JsonIgnoreProperties exclusions (bsc#1268902).
• CVE-2026-59889: missing view guard when deserializing @JsonUnwrapped properties could allow unauthorized writes to @JsonView restricted fields (bsc#1271440).
• CVE-2026-59888: mismatch between property renaming and ignore-filtering on Java Records could allow a bypass of @JsonIgnore restrictions (bsc#1271442).

Changes for jackson-annotations:

• Update to 2.18.9.

Changes for jackson-core:

• Update to 2.18.9.

Changes for jackson-databind:

• Update to 2.18.9:

• honor @JsonView for external-type-id (EXTERNAL_PROPERTY) properties (GHSA-mhm7-754m-9p8w).