#176CLOSED Pull Request
Bump Jackson 3 to 3.2.4 to address vulns
mateusz-borek-da21-10-2026
Standard-Changeno-release-note
Black Duck fails blackduck-scan on main and every PR because jackson-databind 3.2.2 has two High advisories (CVE-2026-91776, CVE-2026-91777, fixed in 3.2.3), tripping the "more than 1 High vulnerability" policy. This bumps jackson-core and jackson-databind to 3.2.4, which also clears jackson-core GHSA-7hhh-6rmp-j9qf; jackson-annotations stays at 2.22.