From 236313b80cb194670235514a78e107d575a6098d Mon Sep 17 00:00:00 2001 From: Akash Kumar <116457960+akashchamp@users.noreply.github.com> Date: Thu, 22 Oct 2026 22:58:58 +0530 Subject: [PATCH 1/2] build: upgrade Jackson to 2.21.7 (1.4.x) Motivation: Jackson has fixed several CVEs in recent releases. The 1.4.x branch is on 2.21.5, while the latest 2.21.x patch release is 2.21.7. Modification: Bump jacksonDatabindVersion in project/Dependencies.scala from 2.21.5 to 2.21.7. jackson-dataformat-xml (test/docs) follows the same version. Result: pekko-http-jackson resolves jackson-databind and jackson-core 2.21.7, still on the 2.21 line. Tests: - sbt "http-jackson/Test/testOnly org.apache.pekko.http.javadsl.marshallers.jackson.JacksonTest" - 6 passed, 0 failed - sbt http-jackson/dependencyTree - jackson-databind 2.21.7, jackson-core 2.21.7 References: Fixes #1354 --- project/Dependencies.scala | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/project/Dependencies.scala b/project/Dependencies.scala index 7b2cc2d71..bd41d64df 100644 --- a/project/Dependencies.scala +++ b/project/Dependencies.scala @@ -18,7 +18,7 @@ import scala.language.implicitConversions object Dependencies { import DependencyHelpers._ - val jacksonDatabindVersion = "2.21.5" + val jacksonDatabindVersion = "2.21.7" val jacksonXmlVersion = jacksonDatabindVersion val junitVersion = "4.13.2" val h2specVersion = "2.6.0" From 5b5b102da9573569518163fcb05a2caaeb37c0f4 Mon Sep 17 00:00:00 2001 From: PJ Fanning Date: Thu, 22 Oct 2026 19:45:16 +0100 Subject: [PATCH 2/2] ci: upgrade sbt/setup-sbt to 1.5.12 setup-sbt 1.5.7 pulls in an action that is no longer on the ASF allow list, which fails the sbt-based CI jobs on the 1.5.x branch. --- .github/workflows/dependency-graph.yml | 2 +- .github/workflows/headers.yml | 2 +- .github/workflows/link-validator.yml | 2 +- .github/workflows/nightly.yml | 2 +- .github/workflows/publish-1.0-docs.yml | 2 +- .github/workflows/publish-1.0-snapshots.yml | 2 +- .github/workflows/publish-1.1-docs.yml | 2 +- .github/workflows/publish-1.1-snapshots.yml | 2 +- .github/workflows/publish-1.2-docs.yml | 2 +- .github/workflows/publish-1.3-docs.yml | 2 +- .github/workflows/publish-1.4-docs.yml | 2 +- .github/workflows/publish.yml | 4 ++-- .github/workflows/stage-release-candidate.yml | 2 +- .github/workflows/validate-and-test.yml | 4 ++-- 14 files changed, 16 insertions(+), 16 deletions(-) diff --git a/.github/workflows/dependency-graph.yml b/.github/workflows/dependency-graph.yml index eb8713101..0c1f77a6e 100644 --- a/.github/workflows/dependency-graph.yml +++ b/.github/workflows/dependency-graph.yml @@ -28,7 +28,7 @@ jobs: steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Install sbt - uses: sbt/setup-sbt@8feba82adc7f01ddcf8165b86f778bdb5b82cebc # v1.5.7 + uses: sbt/setup-sbt@ecad189dd245444b9ae0a0cd5922fd938b88906f # v1.5.12 - uses: scalacenter/sbt-dependency-submission@f43202114d7522a4b233e052f82c2eea8d658134 # v3.2.1 with: modules-ignore: pekko-http-tests_3 pekko-http-docs_3 diff --git a/.github/workflows/headers.yml b/.github/workflows/headers.yml index 127f62627..5c1ac3065 100644 --- a/.github/workflows/headers.yml +++ b/.github/workflows/headers.yml @@ -37,7 +37,7 @@ jobs: java-version: 8 - name: Install sbt - uses: sbt/setup-sbt@8feba82adc7f01ddcf8165b86f778bdb5b82cebc # v1.5.7 + uses: sbt/setup-sbt@ecad189dd245444b9ae0a0cd5922fd938b88906f # v1.5.12 - name: Cache Coursier cache uses: coursier/cache-action@95e5b1029b6b86e7bac033ee44a0697d8a527d2d # v8.1.1 diff --git a/.github/workflows/link-validator.yml b/.github/workflows/link-validator.yml index ae383c064..ac858d67b 100644 --- a/.github/workflows/link-validator.yml +++ b/.github/workflows/link-validator.yml @@ -38,7 +38,7 @@ jobs: java-version: 8 - name: Install sbt - uses: sbt/setup-sbt@8feba82adc7f01ddcf8165b86f778bdb5b82cebc # v1.5.7 + uses: sbt/setup-sbt@ecad189dd245444b9ae0a0cd5922fd938b88906f # v1.5.12 - name: Cache Coursier cache uses: coursier/cache-action@95e5b1029b6b86e7bac033ee44a0697d8a527d2d # v8.1.1 diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml index 765138976..452616a9a 100644 --- a/.github/workflows/nightly.yml +++ b/.github/workflows/nightly.yml @@ -38,7 +38,7 @@ jobs: java-version: ${{ matrix.JDK }} - name: Install sbt - uses: sbt/setup-sbt@8feba82adc7f01ddcf8165b86f778bdb5b82cebc # v1.5.7 + uses: sbt/setup-sbt@ecad189dd245444b9ae0a0cd5922fd938b88906f # v1.5.12 - name: Cache Coursier cache uses: coursier/cache-action@95e5b1029b6b86e7bac033ee44a0697d8a527d2d # v8.1.1 diff --git a/.github/workflows/publish-1.0-docs.yml b/.github/workflows/publish-1.0-docs.yml index 1b70f9406..bd94e580d 100644 --- a/.github/workflows/publish-1.0-docs.yml +++ b/.github/workflows/publish-1.0-docs.yml @@ -40,7 +40,7 @@ jobs: java-version: 8 - name: Install sbt - uses: sbt/setup-sbt@8feba82adc7f01ddcf8165b86f778bdb5b82cebc # v1.5.7 + uses: sbt/setup-sbt@ecad189dd245444b9ae0a0cd5922fd938b88906f # v1.5.12 - name: Cache Coursier cache uses: coursier/cache-action@95e5b1029b6b86e7bac033ee44a0697d8a527d2d # v8.1.1 diff --git a/.github/workflows/publish-1.0-snapshots.yml b/.github/workflows/publish-1.0-snapshots.yml index ecc2b95e0..2d96dd1cc 100644 --- a/.github/workflows/publish-1.0-snapshots.yml +++ b/.github/workflows/publish-1.0-snapshots.yml @@ -33,7 +33,7 @@ jobs: java-version: 8 - name: Install sbt - uses: sbt/setup-sbt@8feba82adc7f01ddcf8165b86f778bdb5b82cebc # v1.5.7 + uses: sbt/setup-sbt@ecad189dd245444b9ae0a0cd5922fd938b88906f # v1.5.12 - name: Cache Coursier cache uses: coursier/cache-action@95e5b1029b6b86e7bac033ee44a0697d8a527d2d # v8.1.1 diff --git a/.github/workflows/publish-1.1-docs.yml b/.github/workflows/publish-1.1-docs.yml index 751585fff..fbf7d8142 100644 --- a/.github/workflows/publish-1.1-docs.yml +++ b/.github/workflows/publish-1.1-docs.yml @@ -40,7 +40,7 @@ jobs: java-version: 8 - name: Install sbt - uses: sbt/setup-sbt@8feba82adc7f01ddcf8165b86f778bdb5b82cebc # v1.5.7 + uses: sbt/setup-sbt@ecad189dd245444b9ae0a0cd5922fd938b88906f # v1.5.12 - name: Cache Coursier cache uses: coursier/cache-action@95e5b1029b6b86e7bac033ee44a0697d8a527d2d # v8.1.1 diff --git a/.github/workflows/publish-1.1-snapshots.yml b/.github/workflows/publish-1.1-snapshots.yml index f7688938c..137eee81d 100644 --- a/.github/workflows/publish-1.1-snapshots.yml +++ b/.github/workflows/publish-1.1-snapshots.yml @@ -33,7 +33,7 @@ jobs: java-version: 8 - name: Install sbt - uses: sbt/setup-sbt@8feba82adc7f01ddcf8165b86f778bdb5b82cebc # v1.5.7 + uses: sbt/setup-sbt@ecad189dd245444b9ae0a0cd5922fd938b88906f # v1.5.12 - name: Cache Coursier cache uses: coursier/cache-action@95e5b1029b6b86e7bac033ee44a0697d8a527d2d # v8.1.1 diff --git a/.github/workflows/publish-1.2-docs.yml b/.github/workflows/publish-1.2-docs.yml index 7c73ec300..d6827ce94 100644 --- a/.github/workflows/publish-1.2-docs.yml +++ b/.github/workflows/publish-1.2-docs.yml @@ -39,7 +39,7 @@ jobs: java-version: 8 - name: Install sbt - uses: sbt/setup-sbt@8feba82adc7f01ddcf8165b86f778bdb5b82cebc # v1.5.7 + uses: sbt/setup-sbt@ecad189dd245444b9ae0a0cd5922fd938b88906f # v1.5.12 - name: Cache Coursier cache uses: coursier/cache-action@95e5b1029b6b86e7bac033ee44a0697d8a527d2d # v8.1.1 diff --git a/.github/workflows/publish-1.3-docs.yml b/.github/workflows/publish-1.3-docs.yml index 85de49687..b7d30486f 100644 --- a/.github/workflows/publish-1.3-docs.yml +++ b/.github/workflows/publish-1.3-docs.yml @@ -40,7 +40,7 @@ jobs: java-version: 8 - name: Install sbt - uses: sbt/setup-sbt@8feba82adc7f01ddcf8165b86f778bdb5b82cebc # v1.5.7 + uses: sbt/setup-sbt@ecad189dd245444b9ae0a0cd5922fd938b88906f # v1.5.12 - name: Cache Coursier cache uses: coursier/cache-action@95e5b1029b6b86e7bac033ee44a0697d8a527d2d # v8.1.1 diff --git a/.github/workflows/publish-1.4-docs.yml b/.github/workflows/publish-1.4-docs.yml index 966afb0e7..4d1464dc5 100644 --- a/.github/workflows/publish-1.4-docs.yml +++ b/.github/workflows/publish-1.4-docs.yml @@ -40,7 +40,7 @@ jobs: java-version: 8 - name: Install sbt - uses: sbt/setup-sbt@c7d2d6258b4bd0d3ec5129e6b3453199d3c79729 # v1.5.8 + uses: sbt/setup-sbt@ecad189dd245444b9ae0a0cd5922fd938b88906f # v1.5.12 - name: Cache Coursier cache uses: coursier/cache-action@95e5b1029b6b86e7bac033ee44a0697d8a527d2d # v8.1.1 diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index e303ecaa1..8e0359ecf 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -41,7 +41,7 @@ jobs: java-version: 8 - name: Install sbt - uses: sbt/setup-sbt@8feba82adc7f01ddcf8165b86f778bdb5b82cebc # v1.5.7 + uses: sbt/setup-sbt@ecad189dd245444b9ae0a0cd5922fd938b88906f # v1.5.12 - name: Cache Coursier cache uses: coursier/cache-action@95e5b1029b6b86e7bac033ee44a0697d8a527d2d # v8.1.1 @@ -74,7 +74,7 @@ jobs: java-version: 8 - name: Install sbt - uses: sbt/setup-sbt@8feba82adc7f01ddcf8165b86f778bdb5b82cebc # v1.5.7 + uses: sbt/setup-sbt@ecad189dd245444b9ae0a0cd5922fd938b88906f # v1.5.12 - name: Cache Coursier cache uses: coursier/cache-action@95e5b1029b6b86e7bac033ee44a0697d8a527d2d # v8.1.1 diff --git a/.github/workflows/stage-release-candidate.yml b/.github/workflows/stage-release-candidate.yml index 613cf1bf4..620bed909 100644 --- a/.github/workflows/stage-release-candidate.yml +++ b/.github/workflows/stage-release-candidate.yml @@ -212,7 +212,7 @@ jobs: java-version: 8 - name: Install sbt - uses: sbt/setup-sbt@8feba82adc7f01ddcf8165b86f778bdb5b82cebc # v1.5.7 + uses: sbt/setup-sbt@ecad189dd245444b9ae0a0cd5922fd938b88906f # v1.5.12 - name: Install Graphviz run: |- diff --git a/.github/workflows/validate-and-test.yml b/.github/workflows/validate-and-test.yml index e440184c6..540980681 100644 --- a/.github/workflows/validate-and-test.yml +++ b/.github/workflows/validate-and-test.yml @@ -38,7 +38,7 @@ jobs: java-version: 8 - name: Install sbt - uses: sbt/setup-sbt@8feba82adc7f01ddcf8165b86f778bdb5b82cebc # v1.5.7 + uses: sbt/setup-sbt@ecad189dd245444b9ae0a0cd5922fd938b88906f # v1.5.12 - name: Cache Coursier cache uses: coursier/cache-action@95e5b1029b6b86e7bac033ee44a0697d8a527d2d # v8.1.1 @@ -86,7 +86,7 @@ jobs: java-version: ${{ matrix.JDK }} - name: Install sbt - uses: sbt/setup-sbt@8feba82adc7f01ddcf8165b86f778bdb5b82cebc # v1.5.7 + uses: sbt/setup-sbt@ecad189dd245444b9ae0a0cd5922fd938b88906f # v1.5.12 - name: Cache Coursier cache uses: coursier/cache-action@95e5b1029b6b86e7bac033ee44a0697d8a527d2d # v8.1.1