From 7e66ec4ba29775f1c24b96f02ecd4ddf7425d4fa Mon Sep 17 00:00:00 2001 From: kosmaty Date: Fri, 3 Jul 2026 13:47:33 +0200 Subject: [PATCH 1/3] jackson upgrade to 2.18.8 jackson-databind 2.18.4 has 2 high-scored vulnerabilities: https://www.cve.org/CVERecord?id=CVE-2026-54512 https://www.cve.org/CVERecord?id=CVE-2026-54513 Due to shadowing of jackson-databind in testcontainers, some scanners (Sonatype Firewall in my case) flags testcontainers as having the same vulnerabilities and blocks its usage. In version 2.18.8 these vulnerabilities have been fixed, so upgrading to that version will also remove these vulnerabilities from testcontainers. --- core/build.gradle | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/core/build.gradle b/core/build.gradle index 66f9fe7dcc0..cc342983bad 100644 --- a/core/build.gradle +++ b/core/build.gradle @@ -56,8 +56,8 @@ tasks.japicmp { configurations.all { resolutionStrategy { - force 'com.fasterxml.jackson.core:jackson-databind:2.18.4' - force 'com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.18.4' + force 'com.fasterxml.jackson.core:jackson-databind:2.18.8' + force 'com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.18.8' } } From 5899de3577282add33027f0ec2c5a7f253cc6c5e Mon Sep 17 00:00:00 2001 From: kosmaty Date: Wed, 8 Jul 2026 09:39:42 +0200 Subject: [PATCH 2/3] jackson upgrade to 2.18.8 --- modules/k3s/build.gradle | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/k3s/build.gradle b/modules/k3s/build.gradle index 645dfd8e68d..5f0adce67c1 100644 --- a/modules/k3s/build.gradle +++ b/modules/k3s/build.gradle @@ -4,7 +4,7 @@ dependencies { api project(":testcontainers") // Synchronize with the jackson version, must match major and minor version - shaded 'com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:2.18.4' + shaded 'com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:2.18.8' testImplementation 'io.fabric8:kubernetes-client:7.6.1' testImplementation 'io.kubernetes:client-java:25.0.0-legacy' From 68c0984f895f1001a303574016a29656cc9900c8 Mon Sep 17 00:00:00 2001 From: kosmaty Date: Wed, 8 Jul 2026 11:12:01 +0200 Subject: [PATCH 3/3] Failing test fix --- .../java/org/testcontainers/JarFileShadingTest.java | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/core/src/jarFileTest/java/org/testcontainers/JarFileShadingTest.java b/core/src/jarFileTest/java/org/testcontainers/JarFileShadingTest.java index 8b6f380f6eb..40a82d54e92 100644 --- a/core/src/jarFileTest/java/org/testcontainers/JarFileShadingTest.java +++ b/core/src/jarFileTest/java/org/testcontainers/JarFileShadingTest.java @@ -26,8 +26,8 @@ void testMetaInf() throws Exception { "services", "versions", "native-image", - "thirdparty-LICENSE", - "FastDoubleParser-NOTICE", + "Schubfach-LICENSE", + "FastDoubleParser-ThirdParty-LICENSE", "FastDoubleParser-LICENSE" ); }