Skip to content

chore(deps): bump com.fasterxml.jackson.core:jackson-databind from 2.13.4.2 to 2.18.9 in /java8.al2023/event-bridge-schema-maven/{{cookiecutter.project_name}}/{{cookiecutter.function_name}} - #559

Open
dependabot[bot] wants to merge 2 commits into
masterfrom
dependabot/maven/java8.al2023/event-bridge-schema-maven/{{cookiecutter.project_name}}/{{cookiecutter.function_name}}/com.fasterxml.jackson.core-jackson-databind-2.18.9
Open

dependabot[bot] wants to merge 2 commits into
masterfrom
dependabot/maven/java8.al2023/event-bridge-schema-maven/{{cookiecutter.project_name}}/{{cookiecutter.function_name}}/com.fasterxml.jackson.core-jackson-databind-2.18.9

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 20, 2026

Copy link
Copy Markdown
Contributor

Bumps com.fasterxml.jackson.core:jackson-databind from 2.13.4.2 to 2.18.9.

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [com.fasterxml.jackson.core:jackson-databind](https://github.com/FasterXML/jackson) from 2.13.4.2 to 2.18.9.
- [Commits](https://github.com/FasterXML/jackson/commits)

---
updated-dependencies:
- dependency-name: com.fasterxml.jackson.core:jackson-databind
  dependency-version: 2.18.9
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update Java code labels Jul 20, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner July 20, 2026 19:58
@dependabot dependabot Bot added the java Pull requests that update Java code label Jul 20, 2026
roger-zhangg
roger-zhangg previously approved these changes Sep 3, 2026
jackson-databind 2.18.9 references com.fasterxml.jackson.annotation.JsonTypeInfo$Value,
which does not exist in jackson-annotations 2.13.2, leaving a dangling classpath
reference in the generated project. The template's unit test is skipped in CI so this
is not caught there. Bump jackson-annotations and jackson-datatype-jsr310 to 2.18.9
so all three artifacts are on the same Jackson line.
@roger-zhangg

Copy link
Copy Markdown
Member

Pushed a follow-up commit aligning jackson-annotations and jackson-datatype-jsr310 with the bumped jackson-databind.

Dependabot bumped jackson-databind alone, leaving jackson-annotations pinned at 2.13.2. Comparing the databind jar's constant pool against the annotations jar shows dangling references that would fail at runtime in the generated project:

  • databind 2.22.0 vs annotations 2.13.2 → missing JsonSerializeAs, JsonDeserializeAs, JsonTypeInfo$Value
  • databind 2.18.9 vs annotations 2.13.2 → missing JsonTypeInfo$Value

The sibling event-bridge-maven PRs hit exactly this as NoClassDefFoundError: com/fasterxml/jackson/annotation/JsonSerializeAs in AppTest. This template's unit test is skipped in CI, so the same defect was not surfaced here. After the bump all three artifacts are on one Jackson line and resolve cleanly.

@roger-zhangg

Copy link
Copy Markdown
Member

The remaining red checks here (Rust, golang 1.x, Java 11 AL2, NodeJS 20/22/24) are not caused by this PR — the identical set is failing on every open PR in the repo, including PRs touching completely unrelated files. Root causes and fixes are in #560, where all 57 checks pass.

This PR's own checks are green: every Java Test/Invoke job passes.

@dependabot @github

dependabot Bot commented on behalf of github Sep 29, 2026

Copy link
Copy Markdown
Contributor Author

A newer version of com.fasterxml.jackson.core:jackson-databind exists, but since this PR has been edited by someone other than Dependabot I haven't updated it. You'll get a PR for the updated version as normal once this PR is merged.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file java Pull requests that update Java code pr/internal

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant