Jackson 2.22.3 and 3.1.7: clear the CVEs reported against 2.22.2 and 3.1.5

Author: Mark Pollack

CHANGELOG.md

@@ -7,6 +7,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Security
+
+- Jackson 2.22.2 → **2.22.3** and Jackson 3.1.5 → **3.1.7**, clearing CVE-2026-89407, CVE-2026-89425,
+  CVE-2026-91776, CVE-2026-91777 (both lines) and CVE-2026-19032, CVE-2026-68497, CVE-2026-83557 (Jackson 3).
+  0.18.0 shipped with the affected versions; applications can override the versions now.
+
+### Security
+
+- Jackson 2.22.2 → **2.22.3** and Jackson 3.1.5 → **3.1.7**, clearing CVE-2026-89407, CVE-2026-89425,
+  CVE-2026-91776, CVE-2026-91777 (both lines) and CVE-2026-19032, CVE-2026-68497, CVE-2026-83557 (Jackson 3).
+  0.18.0 shipped with the affected versions; applications can override the versions now.
+
 ### Changed
 
 - **Breaking (unstable providers API): the provider identifier is `providerId`, on the wire and in

pom.xml

@@ -66,10 +66,10 @@
 
         <!-- Dependency versions -->
         <reactor.version>2025.0.7</reactor.version>
-        <jackson.version>2.22.2</jackson.version>
+        <jackson.version>2.22.3</jackson.version>
         <!-- Jackson 3 for acp-json-jackson3: the version Spring Boot 4.1 manages. It reads
              the jackson-annotations 2.x that jackson.version manages. -->
-        <jackson3.version>3.1.5</jackson3.version>
+        <jackson3.version>3.1.7</jackson3.version>
 
         <slf4j.version>2.0.18</slf4j.version>
         <jspecify.version>1.0.0</jspecify.version>