Maintenance: bump Jackson to 2.22.3 to address CVE-2026-89425 and CVE-2026-89407 #2639

Summary

The latest release (v2.10.0) ships with Jackson 2.21.1, so consumers of modules such as powertools-tracing resolve jackson-core and jackson-databind 2.21.1, which are affected by several HIGH severity advisories. main was bumped to 2.22.1 in #2574, but that version is still affected by:

• jackson-core: CVE-2026-89425 (GHSA-7hhh-6rmp-j9qf), CVE-2026-89407 (GHSA-p6pp-m3f8-5c89)
• jackson-databind: CVE-2026-91777 (GHSA-cxp5-3px4-pw24), CVE-2026-68497 (GHSA-q4xh-88c3-wmh7), CVE-2026-91776 (GHSA-wv8q-qhhj-9h54)

All of these are fixed in Jackson 2.22.3, which has no known advisories at the time of writing.

Why is this needed?

Customers scanning their dependencies get HIGH severity findings coming from Powertools transitive dependencies and have asked for a release that resolves them.

Which area does this relate to?

Governance, Tracer, Serialization, Other

Solution

• Bump jackson.version (Jackson BOM) to 2.22.3 in the root pom.xml
• Align the Jackson versions used in the examples (powertools-examples-kafka/tools, powertools-examples-core-utilities/gradle). Note that since 2.20 jackson-annotations no longer has a patch version, so the Gradle example currently references a non-existent jackson-annotations:2.22.1.
• Cut a release so customers can pick up the fix. In the meantime, customers can pin com.fasterxml.jackson:jackson-bom:2.22.3 in their own dependencyManagement.

Acknowledgment

• This request meets Powertools for AWS Lambda (Java) Tenets
• Should this be considered in other Powertools for AWS Lambda languages? i.e. Python, TypeScript