jackson-databind_2.18.11-1_source.changes ACCEPTED into unstable

[Debian FTP Masters]

Thank you for your contribution to Debian.



Accepted:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Thu, 15 Oct 2026 09:28:11 +0200
Source: jackson-databind
Architecture: source
Version: 2.18.11-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Java Maintainers <pkg-java-maintainers at lists.alioth.debian.org>
Changed-By: Emmanuel Bourg <ebourg at apache.org>
Closes: 1145887 1146640 1147507
Changes:
 jackson-databind (2.18.11-1) unstable; urgency=medium
 .
   * Team upload.
   * New upstream release
     - Fixes CVE-2026-54512, CVE-2026-54513, CVE-2026-54514 and CVE-2026-54515
       (Closes: #1145887)
     - Fixes CVE-2026-83557: Comparable was missing from the unsafe base
       types of DefaultBaseTypeLimitingValidator (Closes: #1146640)
     - Fixes CVE-2026-68497: the XML datatype deserializers did not bound
       the length of stringified numbers (Closes: #1147507)
     - Updated the Maven rules
     - Removed the patches, no longer needed
     - Tightened the dependencies on jackson-core and jackson-annotations
   * Converted debian/watch to the version 5 format
Checksums-Sha1:
 ba3831fa45c2dbf1ef1667d067ed5e1ab4603a50 2427 jackson-databind_2.18.11-1.dsc
 4e114dbb08c9b92c162ced5a1d7a84d7633a7bd8 1170644 jackson-databind_2.18.11.orig.tar.xz
 f18d3c14478cad2d79000c1d9b4007e6c259a05d 7804 jackson-databind_2.18.11-1.debian.tar.xz
 dcb098e82e26b554b2e8ead1d8f1c76d573c3cc0 20099 jackson-databind_2.18.11-1_source.buildinfo
Checksums-Sha256:
 0b0c8dc995a1cf78b19a68650dab0f160608f3b420e7d8a9a9ce0a1c8724da23 2427 jackson-databind_2.18.11-1.dsc
 7953119f3ebf50c226fdb8fbe88455b193584ceefb7cd9454ab1a6695d231628 1170644 jackson-databind_2.18.11.orig.tar.xz
 19356d3a80146bc1b19aa6d5a5afa2e6dfb924891253cbf6de22715a54628648 7804 jackson-databind_2.18.11-1.debian.tar.xz
 c4fe24ba350344e2dbfefa6442cc4978884bce9f3f9564790a0e0ab972410eb4 20099 jackson-databind_2.18.11-1_source.buildinfo
Files:
 d514eb00bf94bd721b73ce68c12a6c96 2427 java optional jackson-databind_2.18.11-1.dsc
 057a642aa2a319add0ea4f864e08b321 1170644 java optional jackson-databind_2.18.11.orig.tar.xz
 108ff1d3cc42a393aa75c88aee0e9f2c 7804 java optional jackson-databind_2.18.11-1.debian.tar.xz
 a73e70765d2dbae7d6e1023de3c20547 20099 java optional jackson-databind_2.18.11-1_source.buildinfo

-----BEGIN PGP SIGNATURE-----

iQJGBAEBCgAwFiEEuM5N4hCA3PkD4WxA9RPEGeS50KwFAmrQzG4SHGVib3VyZ0Bh
cGFjaGUub3JnAAoJEPUTxBnkudCsDFIQAJTLxLe2bJjhQa0NS/Lj/8LOMzuGXD6x
lPmxacmX3pjqevjiK/SWuE62Q7c0hZnGDNwl2don0V7rLcHmU3R/x5LHcpMC1i6e
6tlmdPuQMgRShionp71/r649DvaCrT9c2cixTEJnwgODsEjR9Qu0+bfEz0LMS0P/
BF9eZ3KathkaPARxWCbeNTBV+6eAd3jE+GjutaAOI5B14Ne03camT3gLADXtecjf
352CVv4lNCMBB1ehzdOq5l43qjYvIiBPf7JY262pBsY17tyuu9nFuPfswowXQNky
15t30OfGrHjsY99VWa3a0CNYNKck1ilKey7UMW/tNEGw7PuW1voshi3UeDC08gO8
Mcujiw56qGHxlhciGjXJ9e7GUOA3QnVrQgorpB1Co4CoBefhQsVOfMg1NLv5nrXS
78Edig/J6NHXi5Q+8xRnBL3eYVXaioIzO2VdadNKmDEAxU3ooBX52MRQ9k31WAhn
CqtYc+TNeH5CPqWL40zaYIuSC02ni2DMmoeee8ewE5jEmyA0jrz14BBOJfP1gLnW
8fOln1h9D6IYUdDXCaOfglKAumlUP+QCcivgLogTtQx7kIooOdjmEFmf5vL0biJA
ZQ8GeY5aIaQneP0d8JPZXkWOuvAxlSfHhK8bI7e+4ssuCLwqlKP4+k4WuOwi2eMj
vL8c01hft3zz
=Ir20
-----END PGP SIGNATURE-----

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 228 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-java-maintainers/attachments/20261015/dfeee483/attachment.sig>