From e639046090177450d005f9fa511d4c03a565a504 Mon Sep 17 00:00:00 2001
From: John Kennedy <65985482+jkennedyvz@users.noreply.github.com>
Date: Tue, 14 Jul 2026 01:56:47 -0700
Subject: [PATCH] fix: patch remaining Java security alerts (#38)

## Summary

Patch the remaining open Java/Maven Dependabot alerts on the Stainless
next branch.

## Changes

- Upgrade Jackson modules from 2.22.0 to 2.22.1.
- Pin vulnerable test dependencies to patched versions:
  - Bouncy Castle modules: 1.84
  - Log4j Core: 2.25.4
  - Plexus Utils: 4.0.3
  - Commons Lang: 3.18.0
- Use explicit versions for the test dependencies so the dependency
graph recognizes the fixes.

## Security Alerts

Resolves the affected alerts for Jackson Databind/Core, Bouncy Castle,
Log4j Core, Plexus Utils, and Commons Lang, including:

- GHSA-5jmj-h7xm-6q6v
- GHSA-5hh8-q8hv-fr38
- GHSA-9fxm-vc8v-hj55
- GHSA-hgj6-7826-r7m5
- GHSA-rmj7-2vxq-3g9f
- GHSA-j3rv-43j4-c7qm
- GHSA-rcqc-6cw3-h962
- GHSA-cj8j-37rh-8475
- GHSA-c3fc-8qff-9hwx
- GHSA-wg6q-6289-32hp
- GHSA-445c-vh5m-36rj
- GHSA-6hg6-v5c8-fphq
- GHSA-3pxv-7cmr-fjr4
- GHSA-vc5p-v9hr-52mj
- GHSA-6fmv-xxpf-w3cw
- GHSA-72hv-8253-57qq

## Verification

- Core test suite passed.
- Kotlin formatting passed.
- Gradle dependency resolution confirms Jackson Databind 2.22.1.
- Diff check passed.
---
 langsmith-java-core/build.gradle.kts          | 14 +++++++-------
 langsmith-java-example/build.gradle.kts       |  2 +-
 langsmith-java-proguard-test/build.gradle.kts |  2 +-
 3 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/langsmith-java-core/build.gradle.kts b/langsmith-java-core/build.gradle.kts
index 61bb6cd5..863a6f6f 100644
--- a/langsmith-java-core/build.gradle.kts
+++ b/langsmith-java-core/build.gradle.kts
@@ -19,7 +19,7 @@ sourceSets.main {
     resources.srcDir(generateVersionProperties)
 }
 
-val jacksonVersion = "2.22.0"
+val jacksonVersion = "2.22.1"
 val jacksonAnnotationsVersion = "2.22"
 
 configurations.matching { it.name in setOf("testCompileClasspath", "testRuntimeClasspath") }.configureEach {
@@ -83,14 +83,14 @@ dependencies {
         testImplementation("org.eclipse.jetty.http2:http2-common") { version { require("12.1.10") } }
         testImplementation("org.eclipse.jetty.http2:http2-hpack") { version { require("12.1.10") } }
         testImplementation("org.eclipse.jetty.http2:http2-server") { version { require("12.1.10") } }
-        testImplementation("org.bouncycastle:bcpg-jdk18on") { version { require("1.84") } }
-        testImplementation("org.bouncycastle:bcpkix-jdk18on") { version { require("1.84") } }
-        testImplementation("org.bouncycastle:bcprov-jdk18on") { version { require("1.84") } }
-        testImplementation("org.apache.logging.log4j:log4j-core") { version { require("2.25.4") } }
+        testImplementation("org.bouncycastle:bcpg-jdk18on:1.84")
+        testImplementation("org.bouncycastle:bcpkix-jdk18on:1.84")
+        testImplementation("org.bouncycastle:bcprov-jdk18on:1.84")
+        testImplementation("org.apache.logging.log4j:log4j-core:2.25.4")
         testImplementation("org.apache.opennlp:opennlp-tools") { version { require("2.5.9") } }
         testImplementation("com.github.jknack:handlebars") { version { require("4.5.2") } }
-        testImplementation("org.codehaus.plexus:plexus-utils") { version { require("4.0.3") } }
-        testImplementation("org.apache.commons:commons-lang3") { version { require("3.20.0") } }
+        testImplementation("org.codehaus.plexus:plexus-utils:4.0.3")
+        testImplementation("org.apache.commons:commons-lang3:3.18.0")
         testImplementation("org.apache.commons:commons-compress") { version { require("1.28.0") } }
         testImplementation("commons-fileupload:commons-fileupload") { version { require("1.6.0") } }
         testImplementation("commons-io:commons-io") { version { require("2.22.0") } }
diff --git a/langsmith-java-example/build.gradle.kts b/langsmith-java-example/build.gradle.kts
index cc87bc4c..f4bc2dc1 100644
--- a/langsmith-java-example/build.gradle.kts
+++ b/langsmith-java-example/build.gradle.kts
@@ -20,7 +20,7 @@ dependencies {
     implementation(kotlin("stdlib"))
 
     // Jackson for JSON handling in examples
-    implementation("com.fasterxml.jackson.core:jackson-databind:2.22.0")
+    implementation("com.fasterxml.jackson.core:jackson-databind:2.22.1")
 
     // Spring Boot dependencies (optional - only needed for Spring Boot example)
     implementation(platform("org.springframework.boot:spring-boot-dependencies:3.5.16"))
diff --git a/langsmith-java-proguard-test/build.gradle.kts b/langsmith-java-proguard-test/build.gradle.kts
index 1a909638..c06db5ab 100644
--- a/langsmith-java-proguard-test/build.gradle.kts
+++ b/langsmith-java-proguard-test/build.gradle.kts
@@ -19,7 +19,7 @@ dependencies {
     testImplementation(kotlin("test"))
     testImplementation("org.junit.jupiter:junit-jupiter-api:5.9.3")
     testImplementation("org.assertj:assertj-core:3.27.7")
-    testImplementation("com.fasterxml.jackson.module:jackson-module-kotlin:2.22.0")
+    testImplementation("com.fasterxml.jackson.module:jackson-module-kotlin:2.22.1")
 }
 
 tasks.shadowJar {