Upgrade to Jackson 3.x#2427
Merged
Merged
Conversation
- Migrate group id com.fasterxml.jackson → tools.jackson (BOM 3.1.2); annotations stay on com.fasterxml.jackson - Rebuild JsonUtil mappers via the immutable builder API; drop JavaTimeModule (java.time is built into databind) - Adapt custom (de)serializers, unchecked exceptions (JacksonException), JsonNode.properties(), XmlMapper builder - Replace Jersey JacksonFeature with the Jackson 3 JAX-RS provider (tools.jackson.jakarta.rs); drop unused jersey-media-json-jackson from the FSCrawler modules - Serialized JSON/YAML now orders fields alphabetically (Jackson 3 default); update unit tests and documentation examples accordingly - Keep Spotless pinned to Jackson 2.x Closes #2419 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
Contributor
|
Tick the box to add this pull request to the merge queue (same as
|
- Bump Jackson to 3.1.4: 3.1.2/3.1.3 are vulnerable to CVE-2026-54512 / CVE-2026-54513 (PolymorphicTypeValidator bypass, fixed in 3.1.4), which the OSS Index audit flags - Re-import the Jackson 2.x BOM (2.22.0) to pin the Jackson 2 jackson-databind still pulled transitively (Gestalt) to a patched release; consolidated with the Spotless Jackson version - Restore the Jackson 2 semantics of setDefaultPropertyInclusion(NON_EMPTY): also apply NON_EMPTY to content inclusion so empty map/collection values are omitted. Without it, the re-serialized Elasticsearch _source kept empty objects (e.g. "meta":{}), breaking FsCrawlerRestIT#documentWithExternalTags Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
- Switch gestalt-yaml / gestalt-json to gestalt-yaml-jackson3 / gestalt-json-jackson3 so Gestalt uses the same Jackson 3 (tools.jackson) as FSCrawler instead of pulling its own Jackson 2 line - Keep the com.fasterxml.jackson:jackson-bom (2.22.0) import: Jackson 2 is still pulled transitively by Tika (jackson-databind), so it must be pinned to a patched release for the OSS Index audit Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
The Jackson 3 Jakarta-RS provider resolves its mapper via ContextResolver<JsonMapper> (not ObjectMapper), so the ObjectMapper-typed RestJsonProvider was never picked up: the provider fell back to a default mapper and dropped the fscrawler module's custom (de)serializers. This made GET / serialize ByteSizeValue / TimeValue as objects instead of strings, breaking client-side deserialization (FsCrawlerRestIT#callRoot). - RestJsonProvider now implements ContextResolver<JsonMapper> - JsonUtil.mapper / prettyMapper are typed as JsonMapper (they already are JsonMapper instances) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
|
dadoonet
added
update
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #2419
Summary
Migrates FSCrawler from Jackson 2.22 to Jackson 3.1.4.
com.fasterxml.jackson→tools.jackson(3.1.4). Annotations intentionally stay oncom.fasterxml.jackson.core:jackson-annotations(2.x line), per the Jackson 3 design.gestalt-yaml-jackson3,gestalt-json-jackson3) so it shares FSCrawler's Jackson 3 instead of pulling its own Jackson 2 line.com.fasterxml.jackson:jackson-bom(2.22.0) import is kept to pin the Jackson 2.x still pulled transitively by Tika (jackson-databind) to a patched release; the same version feeds the Spotless formatter.JsonUtilmappers rebuilt through the new immutable builder API (JsonMapper.builder(),YAMLMapper.builder()).JavaTimeModule/jsr310 dropped —java.timesupport is now built intojackson-databind.setDefaultPropertyInclusion(NON_EMPTY)is reproduced by setting both value and content inclusion toNON_EMPTY.SerializationContext,tools.jackson.*packages,JsonParser.getString()).JacksonException); adaptedthrows/catchinJsonUtil,FsSettingsParser,DocUtils,XmlDocParser.JsonNode.fieldNames()→properties().JacksonFeature(Jackson 2) with the Jackson 3 JAX-RS providertools.jackson.jakarta.rs:jackson-jakarta-rs-json-provider. The Jackson 3 provider resolves its mapper viaContextResolver<JsonMapper>, soRestJsonProvideris typed onJsonMapper(otherwise the provider falls back to a default mapper and drops the custom serializers). Removed the now-unusedjersey-media-json-jacksonfrom the FSCrawler modules. Migrated the REST integration-test clients accordingly.Behaviour change (documented in release notes)
Jackson 3 serializes bean properties alphabetically by default. We adopt this default, so indexed documents, generated
_settings.yaml/_checkpoint.json, and REST API responses now have their fields ordered alphabetically. Purely cosmetic. Documentation examples of FSCrawler-generated output were updated to match; Tikameta.rawmaps are unaffected.Security
Jackson 3.1.2/3.1.3 are affected by CVE-2026-54512 / CVE-2026-54513 (PolymorphicTypeValidator bypass), fixed in 3.1.4 — hence the target version. The transitive Jackson 2 (Tika) is pinned to 2.22.0 (outside the vulnerable range). FSCrawler does not use polymorphic deserialization, but the OSS Index audit (score ≥ 7.0) correctly blocks the vulnerable versions.
Test plan
mvn clean test-compile— full reactor compiles (20 modules)mvn test -DskipIntegTests— all unit tests greenmvn spotless:check— greenmvn verifyOSS Index dependency audit — green (no vulnerable components)FsCrawlerRestIT— full class (14 tests) green against a TestContainers Elasticsearch, exercisingGET /, document upload, external tags and crawler control end-to-end🤖 Generated with Claude Code