From 6352c89d1e119173591d9a41bbefc23dfe9cc346 Mon Sep 17 00:00:00 2001 From: Aroh Maurya Date: Thu, 3 Sep 2026 18:30:01 +0530 Subject: [PATCH] fix: force jackson-core to a patched version in sensorhub-security-oauth com.auth0:jwks-rsa:0.22.1 pulls in jackson-databind 2.15.0, which resolves jackson-core at 2.15.0 too. That version is affected by GHSA-r7wm-3cxj-wff9 (async parser maxNumberLength bypass via chunked digit accumulation). Same fix pattern already used a few lines above for org.json: add a direct dependency at the patched version so Gradle picks it over the transitive one. Verified with gradlew :sensorhub-security-oauth:dependencies that jackson-core now resolves to 2.18.8, and the module still compiles and packages cleanly. --- security/sensorhub-security-oauth/build.gradle | 3 +++ 1 file changed, 3 insertions(+) diff --git a/security/sensorhub-security-oauth/build.gradle b/security/sensorhub-security-oauth/build.gradle index fbc295e25..8d549fb1c 100644 --- a/security/sensorhub-security-oauth/build.gradle +++ b/security/sensorhub-security-oauth/build.gradle @@ -10,6 +10,9 @@ dependencies { // Force upgrade on dependency to address secuirty vulnerabilities // This lib is required by org.apache.oltu.oauth2:org.apache.oltu.oauth2.client:1.0.2 embeddedImpl 'org.json:json:20240303' + // Force upgrade on dependency to address a security vulnerability (GHSA-r7wm-3cxj-wff9). + // Transitively pulled in at 2.15.0 by com.auth0:jwks-rsa:0.22.1's jackson-databind dependency. + embeddedImpl 'com.fasterxml.jackson.core:jackson-core:2.18.8' } // add info to OSGi manifest