grobidOrg / grobid / 28186317424

39%

master: 39%

Pull #1469

github

fix: upgrade jackson to 2.21.4 for CVE-2026-54513

jackson-databind < 2.21.4 (in the 2.21.x line) is affected by
CVE-2026-54513: BasicPolymorphicTypeValidator.allowIfSubTypeIsArray()
allowlists array types without validating their component type, so a
non-allowlisted EvilType[] can bypass an otherwise restrictive PTV.

GROBID does not use the vulnerable polymorphic-typing API, so this is a
precautionary bump that also clears the Trivy alert. All four pinned
jackson modules (core, databind, afterburner, dataformat-yaml) are moved
2.21.3 -> 2.21.4 together to stay aligned.

8669 of 24958 branches covered (34.73%)

Branch coverage included in aggregate %.

18460 of 45270 relevant lines covered (40.78%)

1.65 hits per line