build(deps): force patched jackson-core on Dokka classpath (GHSA-r7wm-3cxj-wff9)

[jamesarich]

Why

Dependabot #60 flags com.fasterxml.jackson.core:jackson-core < 2.18.8 — GHSA-r7wm-3cxj-wff9, an async-parser maxNumberLength bypass causing unbounded TextBuffer allocation (memory exhaustion, CWE-770, High / CVSS 8.7).

jackson-core is not a declared dependency anywhere in the app or gradle/libs.versions.toml. It is a build-time-only transitive of Dokka 2.2.0:

org.jetbrains.dokka:dokka-gradle-plugin → dokka-core
   → jackson-dataformat-xml / jackson-module-kotlin 2.15.3 → jackson-core 2.15.3

It rides Dokka's generator classpath (dokkaHtmlGeneratorRuntime), never ships in the APK, and the vulnerable path (a reactive HTTP server fed attacker-controlled chunked JSON) is unreachable here. Dokka 2.2.0 is already the latest release in every channel (Maven Central, GitHub tags, JetBrains dev/beta) — there is no version bump that moves it off 2.15.3, so a resolutionStrategy.force is the only route to a patched jackson-core.

🛠️ What changed

build-logic/convention/.../Dokka.kt: force jackson-core to 2.18.8 on every Dokka configuration, centralized in the existing Dokka convention plugin and applied from both configureDokka() (per-module) and configureDokkaAggregation() (root).

• 2.18.8 is the first patched release and the closest maintenance line to Dokka's transitive 2.15.3 (advisory patched lines: 2.18.8 / 2.21.4 / 2.22.1).
• Forcing only jackson-core while its siblings (databind/dataformat-xml/module-kotlin) stay at 2.15.3 is the officially-safe "core-ahead" direction within Jackson 2.x.
• No allprojects {} / subprojects {} iteration — kept compatible with Gradle Isolated Projects, matching the existing convention.

✅ Testing Performed

• dependencyInsight: resolves 2.15.3 -> 2.18.8 (forced, By constraint) on both the root aggregation classpath and :core:model.
• ./gradlew spotlessCheck detekt — pass.
• ./gradlew :core:model:dokkaGenerateModuleHtml — BUILD SUCCESSFUL, no jackson version-mismatch (NoSuchMethodError/NoClassDefFoundError/AbstractMethodError) at execution time.
• App baseline (assembleDebug/test/allTests) intentionally not run: this touches only the Dokka docs classpath and cannot affect app compilation or runtime.

Note for reviewers

When a future Dokka release bundles a patched jackson, this force becomes a harmless no-op (it only fires if jackson-core is still below 2.18.8 on the Dokka classpath) and can be dropped. If Dependabot's rescan uses static parsing rather than live resolution, alert #60 may not auto-close on merge — it can then be dismissed citing the build-time-only + patched-force rationale.

Summary by CodeRabbit

• Bug Fixes
  • Improved documentation build reliability by ensuring Dokka uses a patched Jackson Core version consistently across standard and aggregated documentation builds.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 3ee63e12-98c9-4970-ac19-50218f82efd7

📥 Commits

Reviewing files that changed from the base of the PR and between 3c32ffa and 18c6382.

📒 Files selected for processing (1)

• build-logic/convention/src/main/kotlin/org/meshtastic/buildlogic/Dokka.kt

---

📝 Walkthrough

Walkthrough

Dokka build conventions now force a patched jackson-core version on matching configurations for both standard Dokka and Dokka aggregation setup.

Changes

Dokka dependency pinning

Layer / File(s)	Summary
Force patched jackson-core for Dokka build-logic/convention/src/main/kotlin/org/meshtastic/buildlogic/Dokka.kt	Adds a shared configuration-resolution helper and invokes it from standard and aggregation Dokka configuration paths.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the Dokka classpath dependency force added in this change.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}