Jsondb / jsondb-core / 5761001e-6f58-4bbc-bd74-f2f328d32ce8

81%

push

circleci

Major security upgrade: update all dependencies to patched versions.

This commit addresses numerous known critical and high severity
vulnerabilities in outdated runtime and test dependencies.

Runtime upgrades:
- Jackson 2.9.9 -> 2.18.8 (BOM): fixes critical/high CVEs including
  CVE-2025-52999 (JSON nesting DoS) and CVE-2026-54512/54513
  (polymorphic deserialization bypass)
- Guava 19.0 -> 33.6.0-jre: resolves multiple historical CVEs in
  very old Guava releases
- commons-beanutils 1.9.3 -> 1.11.0: fixes CVE-2025-48734 (high)
- commons-jxpath 1.3 -> 1.4.0
- reflections 0.9.10 -> 0.10.2 (drops direct javassist pin)
- slf4j-api 1.7.21 -> 1.7.36

Test-only upgrades:
- JUnit 4.12 -> 4.13.2 (CVE-2020-15250)
- Hamcrest 1.3 -> 2.2

Removed unused dependencies with known CVE exposure:
- spring-beans 4.3.3.RELEASE
- spring-test 4.3.3.RELEASE

Also pin commons-collections to 3.2.2 (latest 3.x) via resolution
strategy for beanutils transitive dependencies.

Verified locally: ./gradlew clean test jacocoTestReport build (146 tests pass).

483 of 602 branches covered (80.23%)

1513 of 1925 relevant lines covered (78.6%)

0.79 hits per line