fix(deps): jackson-databind 2.21.3 -> 2.21.5 (7 advisories) [0.8.3]

CHANGELOG.md

@@ -4,6 +4,29 @@ All notable changes to Agents.KT are documented here. The format follows [Keep a
 
 ## [Unreleased]
 
+### Security — jackson-databind bumped 2.21.3 → 2.21.5 (7 advisories)
+
+`jackson-databind` arrives transitively via `langchain4j-core` in `agents-kt-rag-langchain4j` (it is not a
+direct dependency of any module). Dependabot flagged **7 open advisories** against the 2.21.x line it pulled;
+all are cleared by forcing the artifact — and the tightly-coupled `jackson-core` — to **2.21.5** in that
+module's existing `resolutionStrategy.force(...)` block:
+
+- **High** — array-subtype allowlist bypass in `BasicPolymorphicTypeValidator` (`allowIfSubTypeIsArray`),
+  GHSA-rmj7-2vxq-3g9f.
+- **High** — PolymorphicTypeValidator bypass via generic type parameters (arbitrary class instantiation),
+  GHSA-j3rv-43j4-c7qm.
+- **Moderate** — `@JsonView` bypass for unwrapped creator parameters (GHSA-rcqc-6cw3-h962) and for setterless
+  creator properties (GHSA-5hh8-q8hv-fr38).
+- **Moderate** — case-insensitive deserialization bypasses per-property `@JsonIgnoreProperties`
+  (GHSA-9fxm-vc8v-hj55).
+- **Moderate** — renamed `@JsonIgnore`'d setters can still deserialize via private fields (GHSA-hgj6-7826-r7m5).
+- **Moderate** — `InetSocketAddress` deserialization triggers eager DNS resolution (SSRF), GHSA-5jmj-h7xm-6q6v.
+  This one is fixed **only in 2.21.5** (2.21.4 leaves it open), which is why the bump targets 2.21.5 rather than
+  2.21.4.
+
+No source or API change; a patch bump within the same minor line. Lockfile + `verification-metadata.xml`
+regenerated for `jackson-core`/`jackson-databind`/`jackson-bom` 2.21.5.
+
 ## [0.8.2] - 2026-07-01
 
 _Standards & trust hardening._ Hardens the experimental x402 buyer (mandatory guardrails, cross-payment

agents-kt-rag-langchain4j/build.gradle.kts

@@ -20,6 +20,15 @@ configurations.all {
             "org.bouncycastle:bcpg-jdk18on:1.84",
             "org.bouncycastle:bcpkix-jdk18on:1.84",
             "org.bouncycastle:bcutil-jdk18on:1.84",
+            // Security bump — jackson-databind arrives transitively via langchain4j-core at
+            // 2.21.3; force it (and the tightly-coupled jackson-core) to 2.21.5, which clears
+            // the 7 open advisories on the 2.21.x line: array-subtype allowlist bypass
+            // (GHSA-rmj7-2vxq-3g9f), generic-parameter PTV bypass (GHSA-j3rv-43j4-c7qm),
+            // the @JsonView / @JsonIgnoreProperties / renamed-@JsonIgnore-setter cases
+            // (GHSA-rcqc-6cw3-h962, -9fxm-vc8v-hj55, -5hh8-q8hv-fr38, -hgj6-7826-r7m5), and
+            // InetSocketAddress eager-DNS SSRF (GHSA-5jmj-h7xm-6q6v, fixed only in 2.21.5).
+            "com.fasterxml.jackson.core:jackson-databind:2.21.5",
+            "com.fasterxml.jackson.core:jackson-core:2.21.5",
         )
     }
 }

agents-kt-rag-langchain4j/gradle.lockfile

@@ -2,9 +2,9 @@
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
 com.fasterxml.jackson.core:jackson-annotations:2.21=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.core:jackson-core:2.21.3=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.core:jackson-databind:2.21.3=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson:jackson-bom:2.21.3=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.core:jackson-core:2.21.5=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.core:jackson-databind:2.21.5=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson:jackson-bom:2.21.5=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 dev.langchain4j:langchain4j-core:1.16.3=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
 dev.langchain4j:langchain4j:1.16.3=testCompileClasspath,testRuntimeClasspath
 org.apache.opennlp:opennlp-tools:2.5.9=testCompileClasspath,testRuntimeClasspath

gradle/verification-metadata.xml

@@ -76,6 +76,11 @@
             <sha256 value="c442e80c313b5532db2ea7dcd20e0a030fa876f24008346a4b8e10a1fd2e3ff8" origin="Generated by Gradle"/>
          </artifact>
       </component>
+      <component group="com.fasterxml.jackson" name="jackson-base" version="2.21.5">
+         <artifact name="jackson-base-2.21.5.pom">
+            <sha256 value="4f4e2bea00ffe575f5ec054c07a4fbc34c1955d8635c01a3e88013bf2c71deff" origin="Generated by Gradle"/>
+         </artifact>
+      </component>
       <component group="com.fasterxml.jackson" name="jackson-bom" version="2.17.2">
          <artifact name="jackson-bom-2.17.2.pom">
             <sha256 value="1f472b0bc2004d5cf421ac48871417f84189e78f35c049718387fd8b44fb9f32" origin="Generated by Gradle"/>
@@ -91,6 +96,11 @@
             <sha256 value="05c72a0f20ae1fd79ced7ed29cff72db2842d160970a7ea0334e9b5fd047d597" origin="Generated by Gradle"/>
          </artifact>
       </component>
+      <component group="com.fasterxml.jackson" name="jackson-bom" version="2.21.5">
+         <artifact name="jackson-bom-2.21.5.pom">
+            <sha256 value="57fe22dec659de0655357fad0582ef7c8b2fe5a8906a6f1ff1bcbbd1e4554846" origin="Generated by Gradle"/>
+         </artifact>
+      </component>
       <component group="com.fasterxml.jackson" name="jackson-parent" version="2.17">
          <artifact name="jackson-parent-2.17.pom">
             <sha256 value="aee6de4a97283b040e43f4dad575e7b74796cd984d89276f7ec7567380c8a29d" origin="Generated by Gradle"/>
@@ -130,6 +140,14 @@
             <sha256 value="3a8d7aaa7d85908bf191a1f6b2a9e00e0efb562a24d894a1cab8e7a45cdfc6cf" origin="Generated by Gradle"/>
          </artifact>
       </component>
+      <component group="com.fasterxml.jackson.core" name="jackson-core" version="2.21.5">
+         <artifact name="jackson-core-2.21.5.jar">
+            <sha256 value="b64b5874162b503a0e58a8f7758266e8dd9f91bf49e3a59ae0b5f47589a231b7" origin="Generated by Gradle"/>
+         </artifact>
+         <artifact name="jackson-core-2.21.5.module">
+            <sha256 value="de113f4531def50feb12be04e7074a8f76f5f3ef290cf886b90086a4e274530f" origin="Generated by Gradle"/>
+         </artifact>
+      </component>
       <component group="com.fasterxml.jackson.core" name="jackson-databind" version="2.21.2">
          <artifact name="jackson-databind-2.21.2.jar">
             <sha256 value="8c982f01f148d805f0aaac2339011244757e0df7c6ff8951f2fa3f433b8ed849" origin="Generated by Gradle"/>
@@ -146,6 +164,14 @@
             <sha256 value="69eca3b6fa7e140d82c4ab32d4361b4c73ddab278de2ee11d4d38efdf59dac7d" origin="Generated by Gradle"/>
          </artifact>
       </component>
+      <component group="com.fasterxml.jackson.core" name="jackson-databind" version="2.21.5">
+         <artifact name="jackson-databind-2.21.5.jar">
+            <sha256 value="507418c0fafd38b2b2cfb704521630da613a8e4cc8381195a6f418017883e2c0" origin="Generated by Gradle"/>
+         </artifact>
+         <artifact name="jackson-databind-2.21.5.module">
+            <sha256 value="920e2a0211a31f54d2e7e4effdc580d02c3412a6fefdb632a8054e60c4758381" origin="Generated by Gradle"/>
+         </artifact>
+      </component>
       <component group="com.fasterxml.jackson.datatype" name="jackson-datatype-jsr310" version="2.21.2">
          <artifact name="jackson-datatype-jsr310-2.21.2.jar">
             <sha256 value="a083d57cd1c4a28fefcc6bd071740779eb7fc1c22a3c1b40451b5477c443f02f" origin="Generated by Gradle"/>