Vulnerable Jackson version in dependencies

[kalinochkind]

software.amazon.neptune:gremlin-client:4.0.2 depends on org.apache.tinkerpop:gremlin-driver:3.7.3. It uses org.apache.tinkerpop:gremlin-shaded:3.7.3 with bundled com.fasterxml.jackson.core:jackson-databind:2.15.2. Jackson 2.15.2 has vulnerabilities CVE-2026-54512, CVE-2026-54513. Forcing Jackson version with a fix is impossible because it is shaded. It would be nice to update dependencies so that the vulnerable version is no longer on classpath

[spmallette]

This is a TinkerPop issue. In the future, consider filing a JIRA in the TinkerPop Community for these sorts of updates. TinkerPop expects the Jackson version to go to 2.18.9 for the 3.7.7 release which is set to be made official in another week or so. When that is published we can update here accordingly. Will leave this open until that happens since it seems there is interest in seeing this fixed.