[APS-18063] fix: bump jackson-core/databind to 2.18.6 to fix async parser DoS (GHSA-72hv-8253-57qq)

[avinash-bharti]

Security Fix: APS-18063

Issue

jackson-core Number Length Constraint Bypass in Async Parser leads to potential Denial of Service (DoS) condition. The non-blocking (async) JSON parser bypasses the maxNumberLength constraint (default: 1000 characters), allowing arbitrarily long numbers that cause excessive memory allocation and CPU exhaustion.

Advisory: GHSA-72hv-8253-57qq

Root Cause

The async parsing path in NonBlockingUtf8JsonParserBase does not call methods responsible for number length validation (resetInt()/resetFloat() in ParserBase). The _valueComplete() method finalizes the token without enforcing the maxNumberLength constraint.

Fix Applied

• Updated jackson.version property in pom.xml from 2.15.2 to 2.18.6
• This updates both jackson-core and jackson-databind to 2.18.6
• Version 2.18.6 is the patched release per the GitHub advisory (affected range: 2.0.0 - 2.18.5)

Note: Existing Dependabot PR #76 bumps to 2.18.2, which is still within the vulnerable range. This PR supersedes it with the correct fix version.

Testing

• This is a single-line version bump within the 2.18.x patch line (backward compatible)
• The change was verified by confirming the commit diff: jackson.version property changed from 2.15.2 to 2.18.6 in pom.xml
• No test suite is configured in this repository's README; the repo has no CI check runs
• jackson-core 2.18.6 maintains full backward compatibility with 2.15.x API surface

BrowserStack Session Sanity: N/A -- this is a Java client library, not a session repo

Jira Ticket

APS-18063

Checklist

• Security issue addressed (jackson-core updated to patched version 2.18.6)
• Version bump is within patch line (2.18.x), backward compatible
• Dependabot PR build(deps): bump jackson.version from 2.15.2 to 2.18.2 #76 identified as insufficient (only bumps to 2.18.2, still vulnerable)
• README/docs updated if needed (no changes needed)