From cf9e65c67ed5a8b0f8ecd492d20ab91a0826c445 Mon Sep 17 00:00:00 2001
From: Valera V Harseko <vharseko@3a-systems.ru>
Date: Fri, 7 Aug 2026 12:03:00 +0300
Subject: [PATCH] Upgrade Jackson to 2.18.9 (GHSA-r7wm-3cxj-wff9,
 CVE-2026-54512, CVE-2026-54513)

Import jackson-bom ahead of the commons parent BOM so the fixed version
overrides the vulnerable 2.18.6 pinned there.
---
 pom.xml | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/pom.xml b/pom.xml
index 23cdba7234..51497309d4 100644
--- a/pom.xml
+++ b/pom.xml
@@ -36,6 +36,9 @@
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <localized.jars.classifier>i18n</localized.jars.classifier>
         <commons.version>3.1.2</commons.version>
+        <!-- Overrides the version pinned by org.openidentityplatform.commons:parent
+             (GHSA-r7wm-3cxj-wff9, CVE-2026-54512, CVE-2026-54513 are fixed in 2.18.8) -->
+        <jackson.version>2.18.9</jackson.version>
         <freemarker.version>2.3.34</freemarker.version>
         <metrics-core.version>4.2.30</metrics-core.version>
         <bc.fips.version>2.1.3</bc.fips.version>
@@ -151,6 +154,15 @@
 	</pluginRepositories>
     <dependencyManagement>
         <dependencies>
+        	<!-- Must be imported before org.openidentityplatform.commons:parent:
+        	     the first BOM that manages an artifact wins -->
+        	<dependency>
+        		<groupId>com.fasterxml.jackson</groupId>
+        		<artifactId>jackson-bom</artifactId>
+        		<version>${jackson.version}</version>
+        		<type>pom</type>
+        		<scope>import</scope>
+        	</dependency>
         	<dependency>
         		<groupId>org.openidentityplatform.commons</groupId>
         		<artifactId>parent</artifactId>