From 4a860aa049a04745f4fa1dbfb55d3a8317396f3b Mon Sep 17 00:00:00 2001
From: "alexandria.gomez" <alexandria.gomez@laserfiche.com>
Date: Fri, 21 Aug 2026 13:29:33 -0400
Subject: [PATCH] fix(security): bump Jackson to 2.21 LTS line

Remediates CVE-2026-59889 (JsonView authorization bypass) in
jackson-databind. Targets the 2.21 LTS line rather than the latest
2.22.x release for long-term stability in this client library.

jackson-annotations no longer publishes patch-level versions past
2.20, so it now has its own jackson-annotations-version property
separate from the shared jackson-version used by jackson-core and
jackson-databind.
---
 CHANGELOG.md | 6 ++++++
 pom.xml      | 8 +++++---
 2 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0c6bf7da..810d3311 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,11 @@
 # Changelog
 
+## 1.0.4
+
+### Chore & Maintenance
+
+- Update `jackson-databind`, `jackson-core`, and `jackson-annotations` dependencies to the 2.21 LTS line due to vulnerability
+
 ## 1.0.3
 
 ### Chore & Maintenance
diff --git a/pom.xml b/pom.xml
index 87300363..e6c98935 100644
--- a/pom.xml
+++ b/pom.xml
@@ -5,7 +5,7 @@
   <artifactId>lf-repository-api-client-v2</artifactId>
   <packaging>jar</packaging>
   <name>Laserfiche Repository API Client V2</name>
-  <version>1.0.0</version>
+  <version>1.0.4</version>
   <url>https://github.com/Laserfiche/lf-repository-api-client-java</url>
   <description>The Java Laserfiche Repository API Client library for accessing the v2 Laserfiche Repository APIs.</description>
   <scm>
@@ -240,7 +240,7 @@
     <dependency>
       <groupId>com.fasterxml.jackson.core</groupId>
       <artifactId>jackson-annotations</artifactId>
-      <version>${jackson-version}</version>
+      <version>${jackson-annotations-version}</version>
     </dependency>
     <dependency>
       <groupId>com.fasterxml.jackson.core</groupId>
@@ -309,7 +309,9 @@
     <maven.compiler.target>${java.version}</maven.compiler.target>
     <gson-fire-version>1.8.0</gson-fire-version>
     <swagger-core-version>2.0.0</swagger-core-version>
-    <jackson-version>2.18.2</jackson-version>
+    <!-- [AI-Generated] by claude-sonnet-5 v0.001 on 2026-08-21: bumped Jackson to 2.21 LTS line, fixes CVE-2026-59889 -->
+    <jackson-version>2.21.6</jackson-version>
+    <jackson-annotations-version>2.21</jackson-annotations-version>
     <retrofit-version>2.9.0</retrofit-version>
     <threetenbp-version>1.3.5</threetenbp-version>
     <oltu-version>1.0.2</oltu-version>