SONARPHP-1941 Upgrade Jackson to 2.22.3 in SonarPHP integration tests - #1818
Conversation
hashicorp-vault-sonar-prod
Bot
changed the title
## Summary - Upgrade the Jackson BOM from 2.22.2 to 2.22.3 to address [GHSA-p6pp-m3f8-5c89](GHSA-p6pp-m3f8-5c89). - The JFrog Gradle plugin brings Jackson into the shared `gradle-modules` runtime classpath. The BOM now resolves its transitive `jackson-core` dependency to the patched version. This addresses the remaining build-logic dependency path seen in SonarPHP. After this PR merges, SonarPHP still needs to advance its `build-logic/common` submodule pointer. The two SonarPHP integration-test paths are handled in [SonarPHP PR #1818](SonarSource/sonar-php#1818). ## Validation - `./gradlew :gradle-modules:dependencyInsight --configuration runtimeClasspath --dependency com.fasterxml.jackson.core:jackson-core --console=plain` — resolves 2.22.3. - `./gradlew :gradle-modules:check --console=plain` — passed.
Code Review ✅ Approved🟡 Medium risk · Updates Jackson versions across integration-test runtime classpaths and build logic. Upgrades Jackson to 2.22.3 in SonarPHP integration tests to address CVE GHSA-p6pp-m3f8-5c89, regenerating lockfiles for both Review coverage🧪 Functional validation No results 📋 Rules No rules evaluated 🤖 Auto-approval Not enabled · Set up OptionsAuto-apply is off → Gitar will not commit updates to this branch. Comment with these commands to change the behavior for this request:
Was this helpful? React with 👍 / 👎 | Gitar |
|
roberto-orlandi-sonarsource
left a comment
roberto-orlandi-sonarsource
left a comment
There was a problem hiding this comment.
LGTM
2 participants
Summary
its/pluginandits/rulinglockfiles. Both integration-test runtime classpaths now resolvejackson-core:2.22.3.build-logic/commonsubmodule to the merged cloud-native-gradle-modules PR #142, which upgrades its Jackson BOM to 2.22.3.These changes cover the three reported Jackson dependency paths in SonarPHP. The SCA finding should clear after this PR merges and
masteris rescanned.Validation
./gradlew :its:plugin:dependencies :its:ruling:dependencies --write-locks --console=plain.dependencyInsightforjackson-coreon each integration-test runtime classpath; both resolve 2.22.3../gradlew :its:plugin:compileIntegrationTestJava :its:ruling:compileIntegrationTestJava --console=plain— passed../gradlew help --console=plain— passed with the updated build-logic submodule.