Skip to content

GH-3693: Bump Jackson to 2.21.8 - #3940

Open
adoroszlai wants to merge 2 commits into
apache:parquet-1.17.xfrom
adoroszlai:jackson-2.21.8
Open

adoroszlai wants to merge 2 commits into
apache:parquet-1.17.xfrom
adoroszlai:jackson-2.21.8

Conversation

@adoroszlai

@adoroszlai adoroszlai commented Nov 10, 2026 •

Copy link
Copy Markdown

Rationale for this change

Parquet 1.17.1 includes Jackson 2.21.3, which has several CVEs.

What changes are included in this PR?

Bump Jackson to 2.21.8, the latest in 2.21 release line.

https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.21.8

Are these changes tested?

Dependency tree:

[INFO] --- dependency:3.7.1:tree (default-cli) @ parquet-jackson ---
[INFO] org.apache.parquet:parquet-jackson:jar:1.17.2-SNAPSHOT
[INFO] +- com.fasterxml.jackson.core:jackson-core:jar:2.21.8:compile
[INFO] +- com.fasterxml.jackson.core:jackson-annotations:jar:2.21:compile
[INFO] +- com.fasterxml.jackson.core:jackson-databind:jar:2.21.8:compile
...

CI build/test:
https://github.com/adoroszlai/parquet-java/actions/runs/42890817488

Build failure in Vector-plugins workflow is being fixed in #3942.

Are there any user-facing changes?

No user-facing changes.

Closes #3693.

@Fokko Fokko left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @adoroszlai

@adoroszlai

adoroszlai commented Nov 11, 2026 •

Copy link
Copy Markdown
Author

Thanks for the review. Can you please re-run failed checks? Seem to be transient network issue in dev/ci-before_install.sh:

W: Failed to fetch mirror+file:/etc/apt/apt-mirrors.txt/dists/resolute/InRelease  Temporary failure resolving 'security.ubuntu.com'

https://github.com/apache/parquet-java/actions/runs/43045953700/job/130609808700?pr=3940#step:4:11

https://github.com/apache/parquet-java/actions/runs/43045953643/job/130609808506?pr=3940#step:4:11

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants