fix(java,python): bump jackson-databind to 2.22.4 and the httpx2 floor to 2.12.0

Merged
AS
2d ago
+18-7

Summary

  • javav2: jackson-databind 2.22.1 → 2.22.4 (jsr310 and jdk8 to 2.22.4 to match the BOM; annotations stays at 2.22). Versions before 2.22.3 cache a deserializer per distinct polymorphic type id with no bound. The generated SDK's custom type-id resolver returns the Unknown* fallback for unrecognised discriminators, so a server returning many unique ids grows the static mapper's cache without limit (GHSA-wv8q-qhhj-9h54). 2.22.4 also clears the other open jackson-databind advisories, none of which are reachable from generated code.
  • pythonv2: httpx2 floor >=2.10.0 → >=2.12.0 (opt-in client via httpClientLibrary: httpx2). Versions before 2.12.0 inflate each compressed read in a single allocation, so a compressed response bomb can exhaust client memory on any endpoint (GHSA-8xx6-hgc6-gc2m). The 2.12.0 floor also covers the two moderate httpx2 advisories. Python 3.10 users still resolve 2.14.x.

Patch releases within 2.22.x are drop-in; no behaviour changes. The review javav2 SDK pins jackson 2.16.0 through additionalDependencies to exercise that override, so no checked-in SDK output changes.

Test plan

  • tsgo --project templates/templates/javav2 and pythonv2 pass
  • prettier check on both config files
  • CI javav2 and pythonv2 suites

Summary by cubic

Bumps jackson-databind to 2.22.4 and raises the httpx2 floor to 2.12.0 to close two memory-exhaustion advisories.

  • jackson-databind before 2.22.3 caches a deserializer per distinct polymorphic type id with no bound; the generated client's Unknown* fallback lets a server with many unique discriminators grow the static mapper's cache without limit (GHSA-wv8q-qhhj-9h54). 2.22.4 bounds the cache and also covers the other open jackson-databind advisories. jackson-datatype-jsr310 and jackson-datatype-jdk8 move to 2.22.4 to match the BOM; annotations stays at 2.22.
  • httpx2 before 2.12.0 inflates each compressed read in a single allocation, so a compressed response bomb can exhaust memory on any endpoint (GHSA-8xx6-hgc6-gc2m). The 2.12.0 floor also covers the two moderate httpx2 advisories; Python 3.10 users still resolve 2.14.x.

Both are patch-level, drop-in version bumps. The review javav2 SDK stays on jackson-databind 2.16.0 via additionalDependencies; its regenerated build.gradle picks up the datatype bumps but keeps databind pinned.