[tonygermano]

Supersedes #493, which bumps jackson-core alone to 2.18.11.

Summary

A comment in libs.versions.toml says the Jackson family can't be upgraded until the AWS SDK and Swagger are. This PR does all three in an order that keeps every library working with the Jackson version it gets:

Library	Before	After
AWS SDK	2.15.28 (netty-nio-client already on 2.20.140)	2.55.12
Jackson	core 2.18.8, rest of the family 2.14.3	2.18.11
swagger-core	2.0.10	2.2.41

Jackson 2.18.11 and the newer copy of jackson-core bundled in the AWS SDK together clear 15 CVEs. Each commit lists its CVEs in its trailers.

The AWS SDK upgrade changes some behavior that channel scripts calling the SDK directly could notice. See Changes for channel scripts.

Why

jackson-databind 2.16 removed APIs that swagger-core 2.0.10 and AWS SDK 2.15.28 call, so the family was held on 2.14.3. Only jackson-core was bumped, for a security fix. databind 2.14.3 now has eleven open advisories.

The AWS SDK mix was already broken on its own:

• netty-nio-client 2.20.140 calls members that utils and http-client-spi 2.15.28 don't have, such as ProxySystemSetting.HTTPS_PROXY_HOST and SdkHttpRequest.forEachHeader.
• s3 2.15.28 needs the arns module, which wasn't shipped. Parsing an S3 ARN failed with NoClassDefFoundError.

Commits

1. Align the AWS SDK family on 2.55.12.
   • 2.55.12 is the newest release past Renovate's 14-day minimum age, as of 2026-10-22.
   • Since 2.17 the SDK parses JSON with its own shaded copy of Jackson (third-party-jackson-core), so it no longer depends on com.fasterxml.jackson at all. In 2.55.12 that copy is jackson-core 2.21.7, which has no advisories. 2.20.140, the version netty-nio-client was on, bundles 2.15.2, which has three.
   • New runtime modules, placed with the rest of the SDK: arns, checksums, checksums-spi, crt-core, endpoints-spi, http-auth, http-auth-aws, http-auth-aws-eventstream, http-auth-spi, identity-spi, json-utils, retries, retries-spi, third-party-jackson-core and utils-lite.
   • No other library changes. The SDK's POMs ask for newer netty, httpcore, slf4j and reactive-streams, but every reference resolves against the versions we already ship. The only new non-AWS entries in verification-metadata.xml are two BOM POMs: junit-bom, imported by the SDK's bom-internal, and jetty-bom, imported by netty-nio-client's POM. No jars come from them.
   • apache5-client is left out. Since 2.46 it's the default HTTP client of the service clients, but our S3 connector sets ApacheHttpClient explicitly. Without apache5-client on the classpath, a client bui
     lt without an HTTP client still gets ApacheHttpClient, as before.
   • The client still ships only regions and utils. Those cover the only calls it makes (Region.regions() and Region.id()). The region list grows from 31 to 53.
2. Realign Jackson on 2.18.11 and upgrade Swagger to 2.2.41. Neither Swagger version works with the other's Jackson, so both move together.
   • Jackson 2.18.11: it's the first release with no open advisories in any module we ship. 2.18.8 still has nine in databind and two in core. The 2.19 line is no longer maintained, and its last release has sixteen.
   • Swagger 2.2.41: it's the first release that keeps DashboardStatus.childStatuses in /api/openapi.json. The first release built for Jackson 2.18 (2.2.28) drops that property. 2.2.41 is built against J
     ackson 2.19.2, but every Jackson member it references exists in 2.18.11.
   • It adds no new runtime dependencies.
3. Pin the operationIds of overloaded API methods.
   • Swagger names the second of two overloaded methods <name>_1. 2.2.41 reads the methods in the opposite order from 2.0.10, so ten pairs swapped IDs. For example, getEvents moved from GET /events to POST /events/_search.
   • The 20 affected operations now set operationId explicitly, using the names the previous spec published.

Checksums in verification-metadata.xml were regenerated with a cold cache, as CONTRIBUTING.md describes.

Changes for channel scripts

Channel scripts can call the AWS SDK directly. These changes between 2.15.28 and 2.55.12 could affect them:

• S3 checksums (since 2.30): S3 clients send a CRC32 checksum on upload and validate checksums on download. AWS S3 supports this, but some S3-compatible stores reject it. Our S3 connector now sends and valid
  ates checksums too. It only talks to AWS endpoints, so it shouldn't break this way, but S3 reads and writes are on the manual test list. To turn it off, set requestChecksumCalculation(RequestChecksumCalculation .WHEN_REQUIRED) on the client builder or AWS_REQUEST_CHECKSUM_CALCULATION=when_required in the environment.

• Service client versions (since 2.53): the SDK core needs service client modules of 2.28.1 or later. Older AWS service jars added to custom-lib (DynamoDB, SQS and so on) stop working and should be updated t
  o 2.55.12.

• Netty proxy settings (since 2.25): the async Netty client now takes its proxy settings from environment variables and system properties by default, as the Apache client already did.

• Removed APIs, which break any caller, scripts included:

  • JavaSystemSetting.USER_REGION;
  • core.util.json.JacksonUtils;
  • the services.s3.checksums classes;
  • the metadata classes of retired AWS services.

• Changed APIs that break only compiled Java code (such as extensions) or classes that extend the SDK's. Rhino resolves calls at run time, so scripts that only call these aren't affected.

  • HttpCredentialsProvider is now an interface instead of an abstract class.
  • The STS credential providers' getUpdatedCredentials returns AwsSessionCredentials.
  • NoOpSigner is final.
  • The JSON protocol factories use the SDK's shaded JsonFactory.

  The credential interfaces moved to identity-spi, but existing calls still work.

Changes to the OpenAPI document

The API's responses don't change: payloads are written by XStream, not Jackson. The generated spec does change, and each change makes it describe those payloads correctly:

• byte[] properties (Attachment.content, RawMessage.rawBytes, EncryptionSettings.secretKey) are now type: string, format: byte. The old spec said they were arrays of strings. The server has always
  sent a base64 string, e.g. "rawBytes":"aGk=".
• CodeTemplateLibrarySaveResult names its exception librariesCause instead of cause. librariesCause is the name the server sends.
• Form parameters of the channel, statistics and login operations now have their descriptions.

oasdiff breaking flags the first two changes. It reports 18 errors for the type change and 2 warnings for the removed cause property. They only affect clients generated from the old spec, and those clients c
ouldn't read the real responses for these fields anyway.

All operationIds are unchanged.

Testing

Claude checked:

• ./gradlew clean build dist: all 722 tests pass.
• Every class in the distribution, with a scratch ASM tool. Every reference into software.amazon.awssdk, com.fasterxml.jackson and io.swagger resolves, except:
  • the optional aws-crt native library, which wasn't shipped before either;
  • three Bean Validation 2.0 constraints that only models annotated with them would reach;
  • log4j-core's optional XML and YAML layouts, which were unresolved before.
• The server started from the distribution:
  • /api/openapi.json, /api/openapi.yaml and Swagger UI load.
  • The spec has the same 212 operations as before, with the same operationIds.
• The client's region calls, which run with only regions and utils on the classpath.
• The SDK's public API, 2.15.28 against 2.55.12, with japicmp, excluding internal packages. That gave the changes listed above. Claude checked the "removed method" hits by hand: methods that only moved to a superclass aren't listed.

To compare the specs yourself:

• oasdiff changelog on the old and new specs (strip the examples keys first, because they reference external files);
• or diff <(jq -S . old.json) <(jq -S . new.json).

Still to test by hand:

• File connector reading from and writing to S3, including an S3 ARN
• KMS
• AWS region dropdown in the client

Release notes

• AWS SDK upgraded to 2.55.12. It ships the arns module that S3 ARN parsing needs, and its bundled JSON parser has no known advisories. Channel scripts that call the SDK directly should review Changes for cha
  nnel scripts, in particular the S3 checksum default and the 2.28.1 minimum for other AWS service jars.
• Jackson upgraded to 2.18.11 (CVE fixes).
• Swagger upgraded to 2.2.41. The OpenAPI document now describes byte[] fields as base64 strings and names CodeTemplateLibrarySaveResult.librariesCause correctly. Clients generated from the spec may need to
  be regenerated.

---

🤖 Drafted with Claude Code

[github-actions]

Test Results

129 files  ±0  129 suites  ±0   4m 15s ⏱️ + 1m 51s
737 tests ±0  737 ✅ ±0  0 💤 ±0  0 ❌ ±0 
827 runs  ±0  821 ✅ ±0  6 💤 ±0  0 ❌ ±0 

Results for commit 543e341. ± Comparison against base commit 6d348a0.