From 7dd490299d758e9f0fb34a7c38b7512184952c6d Mon Sep 17 00:00:00 2001
From: Vivek Kumar <40461643+Vivekkr0311@users.noreply.github.com>
Date: Fri, 10 Jul 2026 12:38:06 +0530
Subject: [PATCH] [PRODSEC-13135][PRODSEC-13134][PRODSEC-13037]: Bump jackson
 databind 2.22.1 and jackson annotations 2.22 (#2266)

---
 pom.xml                                                  | 9 +++++----
 .../packaging/src/main/resources/licenses/notice.txt     | 6 +++---
 2 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/pom.xml b/pom.xml
index f2647729b..589fe9af7 100644
--- a/pom.xml
+++ b/pom.xml
@@ -57,14 +57,15 @@
       <dependency.alfresco.xml-factory.version>1.3</dependency.alfresco.xml-factory.version>
       <dependency.alfresco-data-model.version>18.20</dependency.alfresco-data-model.version>
 
-      <!-- 2.18.6 fixes GHSA-72hv-8253-57qq (jackson-core async parser maxNumberLength bypass, MEDIUM).
+      <!-- 2.22.1 supersedes 2.18.6, which was the first release to fix GHSA-72hv-8253-57qq
+           (jackson-core async parser maxNumberLength bypass, MEDIUM); do not downgrade below 2.18.6.
            NOTE: htrace-core 3.2.0-incubating shades Jackson 2.4.0 internally; this property cannot
            override the shaded copy. The shaded JAR is physically removed in:
              - search-services/packaging/pom.xml (unpack exclude + antrun delete)
              - insight-engine/alfresco-insight-zeppelin/pom.xml (unpack exclude)
            The alfresco-insight-jdbc shaded jar uses an explicit <includes> list so htrace is not shaded in. -->
-      <dependency.jackson.version>2.18.6</dependency.jackson.version>
-
+      <dependency.jackson.version>2.22.1</dependency.jackson.version>
+      <dependency.jackson-annotations.version>2.22</dependency.jackson-annotations.version>
       <dependency.google.guava.version>33.1.0-jre</dependency.google.guava.version>
       <dependency.apache-commons-compress.version>1.26.1</dependency.apache-commons-compress.version>
       <dependency.apache-commons-lang3.version>3.18.0</dependency.apache-commons-lang3.version>
@@ -164,7 +165,7 @@
          <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
             <artifactId>jackson-annotations</artifactId>
-            <version>${dependency.jackson.version}</version>
+            <version>${dependency.jackson-annotations.version}</version>
          </dependency>
 
          <dependency>
diff --git a/search-services/packaging/src/main/resources/licenses/notice.txt b/search-services/packaging/src/main/resources/licenses/notice.txt
index 41e06e6ef..3d88858cb 100644
--- a/search-services/packaging/src/main/resources/licenses/notice.txt
+++ b/search-services/packaging/src/main/resources/licenses/notice.txt
@@ -60,9 +60,9 @@ chemistry-opencmis-server-bindings-1.0.0.jar    http://chemistry.apache.org/
 failureaccess-1.0.2.jar https://mvnrepository.com/artifact/com.google.guava/failureaccess/1.0.2
 listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar https://mvnrepository.com/artifact/com.google.guava/listenablefuture
 quartz-2.3.2.jar http://quartz-scheduler.org/
-jackson-core-2.18.6.jar https://github.com/FasterXML/jackson
-jackson-annotations-2.18.6.jar https://github.com/FasterXML/jackson
-jackson-databind-2.18.6.jar https://github.com/FasterXML/jackson
+jackson-core-2.22.1.jar https://github.com/FasterXML/jackson
+jackson-annotations-2.22.jar https://github.com/FasterXML/jackson
+jackson-databind-2.22.1.jar https://github.com/FasterXML/jackson
 commons-httpclient-3.1-HTTPCLIENT-1265.jar http://jakarta.apache.org/commons/
 spring-beans-7.0.7.jar http://projects.spring.io/spring-framework/
 spring-context-7.0.7.jar http://projects.spring.io/spring-framework/