Merge pull request #192 from Azure/fix/jackson-2.21.5-cve-54515

fix: bump Jackson to 2.21.5 to remediate CVE-2026-54515 (5.3.4)

Author: tanmaya-panda1

README.md

@@ -807,6 +807,7 @@ the [Release History](README.md#17-release-history) section of this document.
 | 5.3.1           | 2026-05-20   | <ul><li>Security fix: Bump Netty to 4.2.13.Final to remediate CVE-2026-42583, CVE-2026-42579, CVE-2026-42584, CVE-2026-42587, CVE-2026-41417, CVE-2026-42580, CVE-2026-42581, CVE-2026-42585, and CVE-2026-42578</li></ul> |
 | 5.3.2           | 2026-06-15   | <ul><li>Security fix: Bump Netty to 4.2.15.Final to remediate CVE-2026-47244, CVE-2026-48043, CVE-2026-44249, CVE-2026-45416, CVE-2026-45674, CVE-2026-47691, CVE-2026-45673, and CVE-2026-45536</li></ul> |
 | 5.3.3           | 2026-07-01   | <ul><li>Security fix: Pin Jackson to 2.21.4 (via jackson-bom) to remediate CVE-2026-54512, CVE-2026-54513, and CVE-2026-54514 in jackson-databind, and align databind/annotations (previously 2.16.0) with jackson-core</li></ul> |
+| 5.3.4           | 2026-07-07   | <ul><li>Security fix: Bump Jackson to 2.21.5 (via jackson-bom) to remediate CVE-2026-54515 in jackson-databind</li></ul> |
 
 ## 18. Contributing
 

pom.xml

@@ -8,7 +8,7 @@
     <artifactId>kafka-sink-azure-kusto</artifactId>
     <packaging>jar</packaging>
     <description>A Kafka Connect plugin for Azure Data Explorer (Kusto) Database</description>
-    <version>5.3.3</version>
+    <version>5.3.4</version>
     <properties>
         <!-- Compile dependencies -->
         <az.core.version>1.57.0</az.core.version>
@@ -47,12 +47,12 @@
         <!-- Shade plugin -->
         <maven.shade.plugin.version>3.6.0</maven.shade.plugin.version>
         <kusto.shade.prefix>kusto_kafka_connector_shaded</kusto.shade.prefix>
-        <!-- Bumped 2026-07-01: jackson-bom 2.21.4 remediates CVE-2026-54512, CVE-2026-54513 (HIGH,
-             PolymorphicTypeValidator bypasses) and CVE-2026-54514 (InetSocketAddress eager DNS), and aligns
-             jackson-databind/annotations (previously 2.16.0) with jackson-core. CVE-2026-54515 (MEDIUM) is
-             fixed only in 2.21.5/2.18.9 (not yet published) or Jackson 3.1.4; bump to 2.21.5 when released.
+        <!-- Bumped 2026-07-07: jackson-bom 2.21.5 remediates CVE-2026-54515 (@JsonIgnoreProperties bypass
+             under ACCEPT_CASE_INSENSITIVE_PROPERTIES). 2.21.4 previously remediated CVE-2026-54512,
+             CVE-2026-54513 (HIGH, PolymorphicTypeValidator bypasses) and CVE-2026-54514 (InetSocketAddress
+             eager DNS), and aligned jackson-databind/annotations (previously 2.16.0) with jackson-core.
              See https://github.com/FasterXML/jackson-databind/security/advisories -->
-        <jackson.version>2.21.4</jackson.version>
+        <jackson.version>2.21.5</jackson.version>
         <!-- Bumped 2026-06-15: 4.2.15.Final remediates CVE-2026-47244, CVE-2026-48043 (netty-codec-http2),
              CVE-2026-44249, CVE-2026-45416 (netty-handler), CVE-2026-45674, CVE-2026-47691, CVE-2026-45673
              (netty-resolver-dns) and CVE-2026-45536 (netty-transport-native-epoll/kqueue).