From 7a29886267f5d94341eb26af772cc4acca120b45 Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Sun, 30 Aug 2026 07:06:39 +0000
Subject: [PATCH 1/3] Bump jackson to 2.12.7 to fix CVE-2020-36518

Co-Authored-By: Wes Convery <2wconvery@gmail.com>
---
 build.gradle             | 3 +++
 ftgo-common/build.gradle | 6 +++---
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/build.gradle b/build.gradle
index 6fa08eacc..d8ce17337 100644
--- a/build.gradle
+++ b/build.gradle
@@ -23,6 +23,9 @@ subprojects {
 
     group = "net.chrisrichardson.ftgo"
 
+    // Overrides the Jackson version managed by the Spring Boot BOM.
+    ext['jackson.version'] = '2.12.7'
+
     repositories {
         mavenCentral()
         jcenter()
diff --git a/ftgo-common/build.gradle b/ftgo-common/build.gradle
index d7845937a..2a702f8dc 100644
--- a/ftgo-common/build.gradle
+++ b/ftgo-common/build.gradle
@@ -5,10 +5,10 @@ dependencies {
     compile "org.springframework.boot:spring-boot-starter-data-jpa:$springBootVersion"
     compile "org.springframework.boot:spring-boot-starter-web:$springBootVersion"
 
-    compile group: 'com.fasterxml.jackson.core', name: 'jackson-core', version: '2.9.7'
-    compile group: 'com.fasterxml.jackson.core', name: 'jackson-databind', version: '2.9.7'
+    compile group: 'com.fasterxml.jackson.core', name: 'jackson-core', version: '2.12.7'
+    compile group: 'com.fasterxml.jackson.core', name: 'jackson-databind', version: '2.12.7'
     compile group: 'commons-lang', name: 'commons-lang', version: '2.6'
-    compile "com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.9.7"
+    compile "com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.12.7"
 
     compile 'mysql:mysql-connector-java:8.0.33'
 

From de0f4211172fb44b3a0f95e29cab38509f3576f2 Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Sun, 30 Aug 2026 07:08:27 +0000
Subject: [PATCH 2/3] Use jackson 2.13.5 so databind also covers
 CVE-2022-42003/42004

Co-Authored-By: Wes Convery <2wconvery@gmail.com>
---
 build.gradle             | 2 +-
 ftgo-common/build.gradle | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/build.gradle b/build.gradle
index d8ce17337..24f96d139 100644
--- a/build.gradle
+++ b/build.gradle
@@ -24,7 +24,7 @@ subprojects {
     group = "net.chrisrichardson.ftgo"
 
     // Overrides the Jackson version managed by the Spring Boot BOM.
-    ext['jackson.version'] = '2.12.7'
+    ext['jackson.version'] = '2.13.5'
 
     repositories {
         mavenCentral()
diff --git a/ftgo-common/build.gradle b/ftgo-common/build.gradle
index 2a702f8dc..446c3b146 100644
--- a/ftgo-common/build.gradle
+++ b/ftgo-common/build.gradle
@@ -5,10 +5,10 @@ dependencies {
     compile "org.springframework.boot:spring-boot-starter-data-jpa:$springBootVersion"
     compile "org.springframework.boot:spring-boot-starter-web:$springBootVersion"
 
-    compile group: 'com.fasterxml.jackson.core', name: 'jackson-core', version: '2.12.7'
-    compile group: 'com.fasterxml.jackson.core', name: 'jackson-databind', version: '2.12.7'
+    compile group: 'com.fasterxml.jackson.core', name: 'jackson-core', version: '2.13.5'
+    compile group: 'com.fasterxml.jackson.core', name: 'jackson-databind', version: '2.13.5'
     compile group: 'commons-lang', name: 'commons-lang', version: '2.6'
-    compile "com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.12.7"
+    compile "com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.13.5"
 
     compile 'mysql:mysql-connector-java:8.0.33'
 

From b66887d2141d9a02140a3c142b5aa6730ed1e991 Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Sun, 30 Aug 2026 07:09:42 +0000
Subject: [PATCH 3/3] Bump jackson to 2.15.4 for jackson-core stream read
 constraints

Co-Authored-By: Wes Convery <2wconvery@gmail.com>
---
 build.gradle             | 2 +-
 ftgo-common/build.gradle | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/build.gradle b/build.gradle
index 24f96d139..83b92405b 100644
--- a/build.gradle
+++ b/build.gradle
@@ -24,7 +24,7 @@ subprojects {
     group = "net.chrisrichardson.ftgo"
 
     // Overrides the Jackson version managed by the Spring Boot BOM.
-    ext['jackson.version'] = '2.13.5'
+    ext['jackson.version'] = '2.15.4'
 
     repositories {
         mavenCentral()
diff --git a/ftgo-common/build.gradle b/ftgo-common/build.gradle
index 446c3b146..a6d837986 100644
--- a/ftgo-common/build.gradle
+++ b/ftgo-common/build.gradle
@@ -5,10 +5,10 @@ dependencies {
     compile "org.springframework.boot:spring-boot-starter-data-jpa:$springBootVersion"
     compile "org.springframework.boot:spring-boot-starter-web:$springBootVersion"
 
-    compile group: 'com.fasterxml.jackson.core', name: 'jackson-core', version: '2.13.5'
-    compile group: 'com.fasterxml.jackson.core', name: 'jackson-databind', version: '2.13.5'
+    compile group: 'com.fasterxml.jackson.core', name: 'jackson-core', version: '2.15.4'
+    compile group: 'com.fasterxml.jackson.core', name: 'jackson-databind', version: '2.15.4'
     compile group: 'commons-lang', name: 'commons-lang', version: '2.6'
-    compile "com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.13.5"
+    compile "com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.15.4"
 
     compile 'mysql:mysql-connector-java:8.0.33'