Fix: Deeply nested json in jackson-databind

[WesternConcrete]

Summary

Finding: Deeply nested json in jackson-databind (CVE-2020-36518) in COG-GTM/ftgo-monolith.

Fix approach: bump the Jackson dependencies pinned in ftgo-common from the end-of-life 2.9.7 line to 2.12.7, which contains the fix for CVE-2020-36518 (patched in 2.12.6.1).

The explicit pins alone are not sufficient: ftgo-application applies io.spring.dependency-management, whose Spring Boot 2.0.3 BOM would force jackson back to 2.9.6 on the runtime classpath. The root build.gradle therefore also overrides the BOM property:

subprojects {
    ext['jackson.version'] = '2.12.7'
}

Verified with ./gradlew :ftgo-application:dependencies --configuration runtimeClasspath, which now shows jackson-databind:2.9.6 -> 2.12.7; :ftgo-application:compileJava and the :ftgo-common / :ftgo-domain test tasks pass.

Link to Devin session: https://app.devin.ai/sessions/7c734a49fa1849bc9ef496bfc9c72d10
Open in Devin Desktop: https://app.devin.ai/desktop/session/7c734a49fa1849bc9ef496bfc9c72d10?variant=devin
Requested by: @WesternConcrete

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

---

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

Devin Review found 1 potential issue.

[devin-ai-integration]

📝 Info: Packaged Jackson modules remain aligned

The library report retains two 2.9.6 modules, but application packaging applies jackson.version. The deployed artifact resolves every Jackson module to 2.15.4.

---

Was this helpful? React with 👍 or 👎 to provide feedback.