Repository navigation
Bump com.fasterxml.jackson:jackson-bom from 2.22.2 to 2.22.4 - #381
Conversation
Bumps [com.fasterxml.jackson:jackson-bom](https://github.com/FasterXML/jackson-bom) from 2.22.2 to 2.22.4. - [Commits](FasterXML/jackson-bom@jackson-bom-2.22.2...jackson-bom-2.22.4) --- updated-dependencies: - dependency-name: com.fasterxml.jackson:jackson-bom dependency-version: 2.22.4 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Code Coverage Report
|
deweyjose
left a comment
deweyjose
left a comment
There was a problem hiding this comment.
Review: Bump jackson-bom 2.22.2 → 2.22.4
Summary
Dependabot patch bump of the jackson-bom.version property (graphqlcodegen-maven-plugin/pom.xml:59), 2.22.2 → 2.22.4. Single-line change, limited to pom.xml dependency metadata; no source/test changes. The BOM governs jackson-databind/jackson-core (compile) and jackson-annotations (runtime), which the plugin uses only in RemoteSchemaService to parse introspection JSON into SDL at build time.
Build result
Ran locally: ./mvnw -B -ntp verify -pl graphqlcodegen-maven-plugin → BUILD SUCCESS (68 tests, 0 failures, 0 errors, 2 skipped; spotless:check clean, 29 files). All PR checks green as well: build, build (test), build (spotless), e2e all succeeded.
Wiring completeness
N/A — no new/changed @Parameter or builder/constructor changes; no option wiring involved.
Backwards compatibility: NOT breaking.
- Not a generation-path dependency — the gate lists only
graphql-dgs-codegen-core,kotlinpoet, andgraphql-java. Jackson is not among them. - Does not change generated output: Jackson only deserializes introspection responses into SDL; the generated code is produced by DGS codegen core + kotlinpoet, unaffected by a Jackson patch.
- Plugin dependencies load in the build-time plugin classloader and are not transitive to a consumer's compile/runtime classpath, so gate item (f) does not apply.
- Patch-level bump within the 2.22.x line; no
@Parameter, default, Java/Maven floor, goal, phase, or packaging change.
Risks
Low. Patch release within the same minor; the direct jackson-databind/jackson-core/jackson-annotations pins (kept direct per #353 so they survive POM flattening and win mediation over DGS's older Jackson) remain intact and continue to resolve from the bumped BOM.
Verdict: APPROVE — meets all Dependabot auto-merge criteria (dependabot[bot] author, patch bump, non-generation-path, pom-metadata-only, CI + local verify green, no breaking-change label). Merging.
Generated by Claude Code
Bumps com.fasterxml.jackson:jackson-bom from 2.22.2 to 2.22.4.
Commits
267bf9a[maven-release-plugin] prepare release jackson-bom-2.22.4d41cad1Prep for 2.22.4 release8fd9aceMerge branch '2.21' into 2.22e1b27edPost-release dep version bump5dfe489[maven-release-plugin] prepare for next development iterationb23db92[maven-release-plugin] prepare release jackson-bom-2.21.88937d04Prep for 2.21.8 releasec44e739Merge branch '2.20' into 2.21b86d50eMerge branch '2.19' into 2.207756e79Merge branch '2.18' into 2.19Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)