[Snyk] Security upgrade com.fasterxml.jackson.core:jackson-databind from 2.14.2 to 2.18.9

[benjaminhuo]

Snyk has created this PR to fix 1 vulnerabilities in the maven dependencies of this project.

Snyk changed the following file(s):

• functions-framework-invoker/pom.xml

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score	Upgrade
	Improperly Controlled Modification of Dynamically-Determined Object Attributes SNYK-JAVA-COMFASTERXMLJACKSONCORE-17457695	738	com.fasterxml.jackson.core:jackson-databind: 2.14.2 -> 2.18.9 Proof of Concept

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Improperly Controlled Modification of Dynamically-Determined Object Attributes

[benjaminhuo]

This upgrade of Jackson Databind from 2.14.2 to 2.18.9 is a minor version update but spans several feature releases, introducing new default behaviors that require verification.

Key Changes and Potential Impacts:

• New Processing Limits (v2.15+): To mitigate potential Denial of Service (DoS) attacks, Jackson now enforces default limits on incoming JSON documents. Exceeding these limits will throw a StreamConstraintsException. This is a potential breaking change for applications that handle very large or deeply nested JSON. The default limits include:
  • Max number value length: 1,000 characters. [1, 6]
  • Max string value length: 20 million characters (initially 5M in 2.15.0, increased in 2.15.1). [1]
  • Max nesting depth: 1,000 levels. [6]
• Change in Exception Details (v2.16+): The default for StreamReadFeature.INCLUDE_SOURCE_IN_LOCATION has been changed to false for security reasons. If your application relies on parsing source information from JsonLocation in exceptions, this will be a breaking change. [11]
• POJO Introspection Rewrite (v2.18+): Version 2.18 includes a complete rewrite of the core POJO property introspection logic. While this fixed numerous bugs, such a significant internal change carries a risk of subtle behavioral regressions. [8]
• Kotlin Support (v2.18+): Support for Kotlin 1.7.x has been dropped. The jackson-module-kotlin now requires version 1.8 or newer. [15, 17]

Recommendation:

Verify that your application's JSON payloads do not exceed the new default processing limits. If they do, you will need to configure a custom StreamReadConstraints on your JsonFactory or ObjectMapper. Additionally, test deserialization logic thoroughly to check for any regressions from the property introspection rewrite, especially around complex POJOs, creators, and annotations.

Source: Jackson 2.15 Release Notes, Jackson 2.16 Release Notes, Jackson 2.18 Release Notes

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}