From 586947c9a368fe49c9ee93ba0342d5a26f8f2a62 Mon Sep 17 00:00:00 2001
From: "alexandria.gomez" <alexandria.gomez@laserfiche.com>
Date: Fri, 21 Aug 2026 13:28:58 -0400
Subject: [PATCH] fix(security): bump Jackson to 2.21 LTS line

Remediates CVE-2026-59889 (JsonView authorization bypass) in
jackson-databind. Targets the 2.21 LTS line rather than the latest
2.22.x release for long-term stability in this client library.

jackson-annotations no longer publishes patch-level versions past
2.20, so it now has its own jackson-annotations-version property
separate from the shared jackson-version used by jackson-core and
jackson-databind.
---
 CHANGELOG.md | 6 ++++++
 pom.xml      | 8 +++++---
 2 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1a96ba2..04d51d0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,9 @@
+## 2.2.6
+
+### Maintenance
+
+- Update `jackson-databind`, `jackson-core`, and `jackson-annotations` dependencies to the 2.21 LTS line due to vulnerability
+
 ## 2.2.5
 
 ### Maintenance
diff --git a/pom.xml b/pom.xml
index ca2f5bc..526737e 100644
--- a/pom.xml
+++ b/pom.xml
@@ -5,7 +5,7 @@
   <artifactId>lf-api-client-core</artifactId>
   <packaging>jar</packaging>
   <name>Laserfiche API Client Core</name>
-  <version>2.2.5</version>
+  <version>2.2.6</version>
   <url>https://github.com/Laserfiche/lf-api-client-core-java</url>
   <description>Java implementation of various foundational APIs for Laserfiche, including authorization APIs such as
     OAuth 2.0 flows for secure and easy access to Laserfiche APIs.
@@ -215,7 +215,7 @@
     <dependency>
       <groupId>com.fasterxml.jackson.core</groupId>
       <artifactId>jackson-annotations</artifactId>
-      <version>${jackson-version}</version>
+      <version>${jackson-annotations-version}</version>
     </dependency>
     <dependency>
       <groupId>com.fasterxml.jackson.core</groupId>
@@ -260,7 +260,9 @@
     <maven.compiler.source>${java.version}</maven.compiler.source>
     <maven.compiler.target>${java.version}</maven.compiler.target>
     <swagger-core-version>2.0.0</swagger-core-version>
-    <jackson-version>2.18.8</jackson-version>
+    <!-- [AI-Generated] by claude-sonnet-5 v0.001 on 2026-08-21: bumped Jackson to 2.21 LTS line, fixes CVE-2026-59889 -->
+    <jackson-version>2.21.6</jackson-version>
+    <jackson-annotations-version>2.21</jackson-annotations-version>
     <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
   </properties>
 </project>