[Git][java-team/jackson-core][master] Import Debian changes 2.14.1-2

[Emmanuel Bourg (@ebourg)]

Emmanuel Bourg pushed to branch master at Debian Java Maintainers / jackson-core


Commits:
812698d9 by Markus Koschany at 2026-10-14T18:23:50+02:00
Import Debian changes 2.14.1-2

jackson-core (2.14.1-2) unstable; urgency=medium
.
  * Team upload.
.
  [ Markus Koschany and Emmanuel Arias ]
  * CVE-2025-52999:
    A limit was added to avoid a StackoverflowError if the parsed JSON is very
    deeply nested. The StackoverflowError issue happens in jackson-databind but
    this change in jackson-core stops it from happening unless you increase the
    StreamReadConstraints.maxNestingDepth() to a high number. (Closes: #1108367).
  * Declare compliance with Debian Policy 4.7.4.

- - - - -


4 changed files:

- debian/changelog
- debian/control
- + debian/patches/CVE-2025-52999.patch
- debian/patches/series


Changes:

=====================================
debian/changelog
=====================================
@@ -1,3 +1,17 @@
+jackson-core (2.14.1-2) unstable; urgency=medium
+
+  * Team upload.
+
+  [ Markus Koschany and Emmanuel Arias ]
+  * CVE-2025-52999:
+    A limit was added to avoid a StackoverflowError if the parsed JSON is very
+    deeply nested. The StackoverflowError issue happens in jackson-databind but
+    this change in jackson-core stops it from happening unless you increase the
+    StreamReadConstraints.maxNestingDepth() to a high number. (Closes: #1108367).
+  * Declare compliance with Debian Policy 4.7.4.
+
+ -- Markus Koschany <apo at debian.org>  Wed, 15 Apr 2026 13:27:34 +0200
+
 jackson-core (2.14.1-1) unstable; urgency=medium
 
   * Team upload.


=====================================
debian/control
=====================================
@@ -16,7 +16,7 @@ Build-Depends-Indep:
  libmaven-bundle-plugin-java,
  libmaven-enforcer-plugin-java,
  libreplacer-java
-Standards-Version: 4.6.2
+Standards-Version: 4.7.4
 Rules-Requires-Root: no
 Vcs-Git: https://salsa.debian.org/java-team/jackson-core.git
 Vcs-Browser: https://salsa.debian.org/java-team/jackson-core


=====================================
debian/patches/CVE-2025-52999.patch
=====================================
The diff for this file was not included because it is too large.

=====================================
debian/patches/series
=====================================
@@ -1,2 +1,3 @@
 02-skip-jacoco.patch
 01-no-bundle.patch
+CVE-2025-52999.patch



View it on GitLab: https://salsa.debian.org/java-team/jackson-core/-/commit/812698d9203e1a132af89392e8698ed6880354f9

-- 
View it on GitLab: https://salsa.debian.org/java-team/jackson-core/-/commit/812698d9203e1a132af89392e8698ed6880354f9
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/pkg-java-commits/attachments/20261014/73ec4c9a/attachment.htm>