Bump jackson-core to 2.18.6 in ferstl-depgraph-dependencies (CVE-2025-52999) by Copilot · Pull Request #21868 · github/codeql

Copilot · 2026-05-19T11:44:20Z

jackson-core 2.14.1 bundled in ferstl-depgraph-dependencies is vulnerable to CVE-2025-52999 (StackOverflowError on deeply nested JSON, fixed in 2.15.0). This updates the companion github/codeql integration-test expected files to match the rebuilt plugin bundle.

Expected file updates

The internal semmle-code companion PR rebuilds depgraph-maven-plugin with:

Jackson 2.14.1 → 2.18.6 (fixes CVE; aligns with main CodeQL Java dependency set)
Plugin coordinate 4.0.3-CodeQL → 4.0.3-CodeQL-2 (ensures Maven cache invalidation)
jackson-parent 2.14 → 2.18.4, com/fasterxml/oss-parent 48 → 69 (transitive POM parents)

Updated files:

maven-fetches.expected (×3: buildless-maven, buildless-maven-existing-settings-xml, buildless-maven-mirrorof) — new Jackson/oss-parent paths and plugin coordinate
diagnostics.expected (×2: buildless-maven-timeout, buildless-maven-tolerate-unavailable-dependency) — plugin version string in diagnostic messages

Auto-update script

Adds java/ql/integration-tests/update-ferstl-depgraph-dependencies.sh to automate future dependency bumps. The script:

Clones ferstl/depgraph-maven-plugin at tag depgraph-maven-plugin-4.0.3
Patches pom.xml (version suffix, Guava, Jackson)
Builds with mvn package install -DskipTests
Packages the resolved local repo into a zip (to be dropped into semmle-code)
Rewrites all affected *.expected files in-place

# Default: Jackson 2.18.6, Guava 33.4.0-jre
./java/ql/integration-tests/update-ferstl-depgraph-dependencies.sh

# Override versions explicitly
./java/ql/integration-tests/update-ferstl-depgraph-dependencies.sh 2.19.0 33.4.0-jre

Requires JDK 17, Maven 3.9.x (not 4.x), git, python3.

…-52999) - Update 3 maven-fetches.expected files: jackson 2.14.1→2.18.6, jackson-parent 2.14→2.18.4, oss-parent 48→69, plugin version 4.0.3-CodeQL→4.0.3-CodeQL-2 - Update 2 diagnostics.expected files: plugin version reference 4.0.3-CodeQL→4.0.3-CodeQL-2 - Add update-ferstl-depgraph-dependencies.sh auto-update script

Copilot

Pull request overview

Updates the buildless Java extractor’s bundled ferstl-depgraph-dependencies integration-test expectations to reflect a rebuilt depgraph-maven-plugin bundle that pulls in a non-vulnerable Jackson version (addressing CVE-2025-52999), and adds an automation script to reproduce these updates.

Changes:

Add a new script to rebuild/package the ferstl/depgraph-maven-plugin dependency bundle and rewrite affected *.expected files.
Update maven-fetches.expected fixtures to reflect Jackson 2.18.6 (and updated transitive parent POMs) plus the bumped plugin coordinate 4.0.3-CodeQL-2.
Update diagnostics.expected fixtures to reflect the new plugin version string in diagnostic messages.

Show a summary per file

File	Description
java/ql/integration-tests/update-ferstl-depgraph-dependencies.sh	New automation script to rebuild the depgraph plugin bundle and update integration-test expected files.
java/ql/integration-tests/java/buildless-maven/maven-fetches.expected	Updates expected Maven fetches to new Jackson + plugin coordinate.
java/ql/integration-tests/java/buildless-maven-existing-settings-xml/maven-fetches.expected	Same expected-fetch updates for the existing-settings scenario.
java/ql/integration-tests/java/buildless-maven-mirrorof/maven-fetches.expected	Same expected-fetch updates for the mirror-of scenario.
java/ql/integration-tests/java/buildless-maven-timeout/diagnostics.expected	Updates diagnostic message to reference the new plugin version.
java/ql/integration-tests/java/buildless-maven-tolerate-unavailable-dependency/diagnostics.expected	Updates diagnostic message to reference the new plugin version.

Copilot's findings

Files reviewed: 6/6 changed files
Comments generated: 3

+OLD_JACKSON="$(grep -oP 'jackson-core/\K[^/]+(?=/)' "${EXPECTED_FILE}" | head -1)"
+OLD_PLUGIN="$(grep -oP 'depgraph-maven-plugin/\K[^/]+(?=/)' "${EXPECTED_FILE}" | head -1)"
+OLD_OSS_PARENT="$(grep -oP 'fasterxml/oss-parent/\K[^/]+(?=/)' "${EXPECTED_FILE}" | head -1)"
+OLD_JACKSON_PARENT="$(grep -oP 'jackson-parent/\K[^/]+(?=/)' "${EXPECTED_FILE}" | head -1)"
+
+# Resolve new parent versions from the artifacts Maven just resolved.
+NEW_JACKSON_PARENT="$(find "${LOCAL_REPO}/com/fasterxml/jackson/jackson-parent" \
+    -name "jackson-parent-*.pom" | sort | tail -1 | grep -oP '[\d.]+(?=\.pom)')"
+NEW_OSS_PARENT="$(find "${LOCAL_REPO}/com/fasterxml/oss-parent" \
+    -name "oss-parent-*.pom" | sort | tail -1 | grep -oP '[0-9]+(?=\.pom)')"


+NEW_JACKSON_PARENT="$(find "${LOCAL_REPO}/com/fasterxml/jackson/jackson-parent" \
+    -name "jackson-parent-*.pom" | sort | tail -1 | grep -oP '[\d.]+(?=\.pom)')"
+NEW_OSS_PARENT="$(find "${LOCAL_REPO}/com/fasterxml/oss-parent" \
+    -name "oss-parent-*.pom" | sort | tail -1 | grep -oP '[0-9]+(?=\.pom)')"
+


+echo "  1. Copy ${ZIP_OUT} -> semmle-code resources/lib/ferstl-depgraph-dependencies/ferstl-depgraph-dependencies.zip"
+echo "  2. In semmle-code, update autobuild/src/com/semmle/util/build/Maven.java:"
+echo "     bump the plugin version constant to '${PLUGIN_CODEQL_VERSION}'"
+echo "  3. Commit and raise PRs in both repositories."
+trap - EXIT


oscarsj · 2026-05-21T09:34:22Z

@copilot Could you change the script to only include runtime jars? Something like this (quick AI-made change, untested):

diff --git a/java/ql/integration-tests/update-ferstl-depgraph-dependencies.sh b/java/ql/integration-tests/update-ferstl-depgraph-dependencies.sh
index 9fb034f5c17..56c63f05995 100755
--- a/java/ql/integration-tests/update-ferstl-depgraph-dependencies.sh
+++ b/java/ql/integration-tests/update-ferstl-depgraph-dependencies.sh
@@ -86,12 +86,51 @@ print(f'  pom.xml patched: version={new_version}, guava={new_guava}, jackson={ne
 PYEOF
 
 # ---------------------------------------------------------------------------
-# Step 3 — Build
+# Step 3 — Build the plugin, then resolve its *runtime* deps into a clean repo
 # ---------------------------------------------------------------------------
-LOCAL_REPO="${WORK_DIR}/local-repo"
+#
+# Two separate local repos (mirrors the layout described in the README at
+# semmle-code:resources/lib/ferstl-depgraph-dependencies/ferstl-depgraph-dependencies.README):
+#
+#   BUILD_REPO  Throwaway cache for the plugin's own `mvn package install` —
+#               accumulates build-lifecycle plugins (compiler, surefire, jar,
+#               site, plugin-plugin, javadoc parents, ASM, byte-buddy, junit,
+#               mockito, dom4j, xerces, sisu-guice, aether, ...) that the
+#               extractor never invokes at runtime. Discarded.
+#
+#   DIST_REPO   Clean repo populated only with the freshly built plugin and
+#               its runtime transitive deps, resolved via the plugin's own
+#               `:graph` goal against a stub project. This is what gets zipped.
+#
+BUILD_REPO="${WORK_DIR}/build-repo"
+DIST_REPO="${WORK_DIR}/dist-repo"
+
 echo "[3/5] Building plugin (mvn package + install, skipping tests) ..."
 cd "${WORK_DIR}/plugin-src"
-mvn package install -DskipTests -q -Dmaven.repo.local="${LOCAL_REPO}"
+mvn package install -DskipTests -q -Dmaven.repo.local="${BUILD_REPO}"
+
+echo "      Resolving runtime dependencies into clean dist repo ..."
+
+# Seed DIST_REPO with the freshly built plugin jar+pom so the `:graph` run
+# below resolves *its* transitive deps (rather than re-downloading the
+# unpatched upstream artifact from Central).
+PLUGIN_REL="com/github/ferstl/depgraph-maven-plugin/${PLUGIN_CODEQL_VERSION}"
+mkdir -p "${DIST_REPO}/${PLUGIN_REL}"
+cp "${BUILD_REPO}/${PLUGIN_REL}/depgraph-maven-plugin-${PLUGIN_CODEQL_VERSION}.jar" \
+   "${BUILD_REPO}/${PLUGIN_REL}/depgraph-maven-plugin-${PLUGIN_CODEQL_VERSION}.pom" \
+   "${DIST_REPO}/${PLUGIN_REL}/"
+
+# Stub project used purely as a vehicle for invoking `:graph`.
+cd "${WORK_DIR}"
+mvn -q -B archetype:generate -DinteractiveMode=false \
+    -DarchetypeGroupId=org.apache.maven.archetypes \
+    -DarchetypeArtifactId=maven-archetype-quickstart \
+    -DgroupId=com.mycompany.app -DartifactId=my-app \
+    -Dmaven.repo.local="${BUILD_REPO}"
+cd "${WORK_DIR}/my-app"
+mvn -q "com.github.ferstl:depgraph-maven-plugin:${PLUGIN_CODEQL_VERSION}:graph" \
+    -Dmaven.repo.local="${DIST_REPO}"
+cd "${WORK_DIR}"
 
 # ---------------------------------------------------------------------------
 # Step 4 — Package local-repo zip
@@ -100,7 +139,7 @@ echo "[4/5] Packaging local Maven repo into zip ..."
 
 # Remove build-time-only noise (but keep _remote.repositories for Maven
 # cache-validation compatibility).
-find "${LOCAL_REPO}" \( \
+find "${DIST_REPO}" \( \
     -name "resolver-status.properties" \
     -o -name "*.lastUpdated" \
     -o -name "m2e-lastUpdated.properties" \
@@ -122,11 +161,11 @@ if [[ -n "${SHA1_CMD}" ]]; then
         if [[ ! -f "${f}.sha1" ]]; then
             ${SHA1_CMD} "${f}" | awk '{print $1}' > "${f}.sha1"
         fi
-    done < <(find "${LOCAL_REPO}" \( -name "*.jar" -o -name "*.pom" \) -print0)
+    done < <(find "${DIST_REPO}" \( -name "*.jar" -o -name "*.pom" \) -print0)
 fi
 
 ZIP_OUT="${WORK_DIR}/ferstl-depgraph-dependencies.zip"
-(cd "${LOCAL_REPO}" && zip -r -q "${ZIP_OUT}" .)
+(cd "${DIST_REPO}" && zip -r -q "${ZIP_OUT}" .)
 
 echo ""
 echo "  Zip created: ${ZIP_OUT}"
@@ -150,9 +189,9 @@ OLD_OSS_PARENT="$(grep -oP 'fasterxml/oss-parent/\K[^/]+(?=/)' "${EXPECTED_FILE}
 OLD_JACKSON_PARENT="$(grep -oP 'jackson-parent/\K[^/]+(?=/)' "${EXPECTED_FILE}" | head -1)"
 
 # Resolve new parent versions from the artifacts Maven just resolved.
-NEW_JACKSON_PARENT="$(find "${LOCAL_REPO}/com/fasterxml/jackson/jackson-parent" \
+NEW_JACKSON_PARENT="$(find "${DIST_REPO}/com/fasterxml/jackson/jackson-parent" \
     -name "jackson-parent-*.pom" | sort | tail -1 | grep -oP '[\d.]+(?=\.pom)')"
-NEW_OSS_PARENT="$(find "${LOCAL_REPO}/com/fasterxml/oss-parent" \
+NEW_OSS_PARENT="$(find "${DIST_REPO}/com/fasterxml/oss-parent" \
     -name "oss-parent-*.pom" | sort | tail -1 | grep -oP '[0-9]+(?=\.pom)')"
 
 echo "  Jackson:        ${OLD_JACKSON} -> ${JACKSON_VERSION}"

- Use BUILD_REPO/DIST_REPO split so zip contains only runtime deps (build-lifecycle plugins, test jars, etc. stay in throwaway BUILD_REPO) - Minimal inline stub pom.xml (no deps) instead of archetype:generate to avoid polluting DIST_REPO with stub project's own dependencies - Replace grep -oP (PCRE, unavailable on macOS BSD grep) with Python re - Use version-aware Python version_key() for max POM version selection (lexicographic sort fails for e.g. 2.18.10 vs 2.18.6; release > snapshot) - Write zip to caller's working directory; keep cleanup trap active; remove `trap - EXIT` which was leaving WORK_DIR behind

Copilot · 2026-05-21T09:42:13Z

@copilot Could you change the script to only include runtime jars? Something like this (quick AI-made change, untested):

Done in the latest commit. Changes made:

BUILD_REPO / DIST_REPO split: the plugin is compiled into a throwaway BUILD_REPO; the plugin jar+pom is then seeded into a clean DIST_REPO and depgraph:graph is invoked against a minimal stub project (empty pom, no deps) so only the plugin's runtime transitive deps land in DIST_REPO. That's what gets zipped.
Instead of archetype:generate (which would pull in quickstart's junit dep into DIST_REPO), the stub is written as an inline heredoc — no external network call and no test-scope artifacts.

I also took the opportunity to fix the three issues from the automated review:

grep -oP → Python re (portable on macOS)
lexicographic sort | tail -1 → Python version_key tuple comparison (correct for 2.18.10 vs 2.18.6, and release > snapshot)
removed trap - EXIT at the end; zip is now written to $(pwd) so the cleanup trap keeps working throughout.

oscarsj · 2026-05-21T09:53:08Z

@copilot fix the "[5/5] Updating integration-test expected files ...
grep: invalid option -- P" option problem when the script is run in mac, keeping the compatibility with linux

Copilot · 2026-05-21T09:57:27Z

@copilot fix the "[5/5] Updating integration-test expected files ...
grep: invalid option -- P" option problem when the script is run in mac, keeping the compatibility with linux

Fixed in the latest commit. The root cause was that heredocs (<< 'PYEOF') nested inside command substitutions ($(...)) are mishandled by macOS's bash 3.2 — the heredoc body leaks to the outer shell, causing lines like extract(r'jackson-core/([^/]+)/') to be interpreted as shell commands (which invoked grep -P).

The fix writes the two Python helpers as actual files in ${WORK_DIR} (extract_versions.py, max_versions.py) using top-level cat > ... << 'PYEOF' (not inside $()), then the read -r ... <<< "$(python3 "${WORK_DIR}/...")" calls are simple command substitutions with no nested heredoc. The remaining python3 - ... << 'PYEOF' on the main update loop is also a top-level invocation (not inside $()), so it's fine on all bash versions.

oscarsj · 2026-05-21T12:03:13Z

@copilot Fix: [5/5] Updating integration-test expected files ...
grep: invalid option -- P

…p 5)

Copilot · 2026-05-21T12:07:59Z

@copilot Fix: [5/5] Updating integration-test expected files ...
grep: invalid option -- P

Fixed in the latest commit. There were two remaining patterns that could trigger this on macOS bash 3.2:

$(python3 "${WORK_DIR}/max_versions.py" \ ... \ ...) — backslash continuation inside $(...), which bash 3.2 can mishandle. Fixed by capturing the output into an intermediate variable first, then feeding it to read via <<< "${var}".
python3 - args << 'PYEOF' ... PYEOF with many \ continuations — the heredoc at the end of a long multi-line \ chain. Fixed by writing the update script to ${WORK_DIR}/update_expected.py (same pattern as the other helpers) and calling it with explicit arguments.

All Python helpers are now written to files and invoked cleanly — no heredocs in potentially problematic positions remain.

Initial plan

63a0948

Copilot AI assigned Copilot and oscarsj May 19, 2026

Copilot started work on behalf of oscarsj May 19, 2026 11:44 View session

Copilot AI changed the title ~~[WIP] Update jackson-core to version 2.15.0 for CVE-2025-52999~~ Bump jackson-core to 2.18.6 in ferstl-depgraph-dependencies (CVE-2025-52999) May 19, 2026

Copilot finished work on behalf of oscarsj May 19, 2026 11:53

Copilot AI requested a review from oscarsj May 19, 2026 11:53

github-actions Bot added the Java label May 19, 2026

oscarsj added 2 commits May 19, 2026 14:30

Do not remove zip file if the process succeeds

8b799f8

Merge branch 'main' into copilot/bump-jackson-core-to-2150

b9bf81e

oscarsj marked this pull request as ready for review May 20, 2026 12:00

oscarsj requested a review from a team as a code owner May 20, 2026 12:00

oscarsj requested review from Copilot and navntoft May 20, 2026 12:00

Copilot started reviewing on behalf of oscarsj May 20, 2026 12:01 View session

oscarsj approved these changes May 20, 2026

View reviewed changes

Copilot AI reviewed May 20, 2026

View reviewed changes

Copilot started work on behalf of oscarsj May 21, 2026 09:34 View session

Copilot finished work on behalf of oscarsj May 21, 2026 09:42

Copilot AI requested a review from oscarsj May 21, 2026 09:42

Copilot started work on behalf of oscarsj May 21, 2026 09:53 View session

Fix macOS bash 3.2 heredoc-in-$() portability issue in update script

8170c20

Copilot finished work on behalf of oscarsj May 21, 2026 09:58

Copilot started work on behalf of oscarsj May 21, 2026 12:03 View session

Fix remaining macOS bash 3.2 portability issues in update script (ste…

0f3c9ab

…p 5)

Copilot finished work on behalf of oscarsj May 21, 2026 12:08

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump jackson-core to 2.18.6 in ferstl-depgraph-dependencies (CVE-2025-52999)#21868

Bump jackson-core to 2.18.6 in ferstl-depgraph-dependencies (CVE-2025-52999)#21868
Copilot wants to merge 7 commits into
mainfrom
copilot/bump-jackson-core-to-2150

Copilot AI commented May 19, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

oscarsj commented May 21, 2026

Uh oh!

Copilot AI commented May 21, 2026

Uh oh!

oscarsj commented May 21, 2026

Uh oh!

Copilot AI commented May 21, 2026

Uh oh!

oscarsj commented May 21, 2026

Uh oh!

Copilot AI commented May 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

Copilot AI commented May 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Expected file updates

Auto-update script

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

oscarsj commented May 21, 2026

Uh oh!

Copilot AI commented May 21, 2026

Uh oh!

oscarsj commented May 21, 2026

Uh oh!

Copilot AI commented May 21, 2026

Uh oh!

oscarsj commented May 21, 2026

Uh oh!

Copilot AI commented May 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented May 19, 2026 •

edited

Loading