[carbon-kernel] Bump Jackson to 2.22.2

[sadilchamishka]

Purpose

Upgrade the Jackson artifacts to the latest stable 2.x release, 2.22.2.

2.21.2 is still within the affected range of GHSA-r7wm-3cxj-wff9 ([2.19.0, 2.21.4)), which is
the follow-up to CVE-2026-18401 and is described upstream as an incomplete fix for it. 2.22.2 is
the current latest on the 2.x line and is clear of both.

Approach

Version property bumps only — no code or logic changes.

parent/pom.xml:

• version.jackson: 2.21.2 → 2.22.2
• version.jackson.databind: 2.21.4 → 2.22.2
• version.jackson.dataformat: 2.21.2 → 2.22.2
• version.jackson.datatype: 2.21.2 → 2.22.2
• version.jackson.annotations: 2.21 → 2.22

jackson-annotations follows a two-segment version scheme, so it keeps its own property value.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yml

Review profile: CHILL

Plan: Team

Run ID: d243fafe-6d2e-4617-949c-2dda4b427d5a

📥 Commits

Reviewing files that changed from the base of the PR and between e34cbaf and 88b9433.

📒 Files selected for processing (1)

• parent/pom.xml

Included review availability: Your plan provides up to 2 included reviews per hour; 1 remains after this review.

---

📝 Summary

Summary by CodeRabbit

• Chores
  • Updated the Jackson library versions used by the application to the 2.22.x release line.

Walkthrough

The parent Maven POM updates shared Jackson version properties from the 2.21.x line to the 2.22.x line.

Changes

Jackson dependency upgrade

Layer / File(s)	Summary
Update Jackson version properties parent/pom.xml	The Jackson core, annotations, databind, dataformat, and datatype properties are updated to version 2.22.2 or 2.22.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to 88b94

This updates the shared Jackson dependencies to 2.22.2 without application logic changes. The version properties are aligned and no current merge-readiness risk remains.

Suggested reviewers: wso2-jenkins-bot, dilshansenarath

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description explains the purpose and implementation, but it omits most template sections, including Goals, User stories, Release note, Documentation, Training, Certification, Marketing, Automation…	Complete the missing template sections. Enter "N/A" with a brief explanation where a section does not apply, and provide test, security, release-note, documentation, and migration details as applicable.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely identifies the main change: upgrading Jackson to version 2.22.2 for the carbon-kernel component.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description explains the purpose and implementation, but it omits most template sections, including Goals, User stories, Release note, Documentation, Training, Certification, Marketing, Automation tests, Security checks, Samples, Related PRs, Migrations, Test environment, and Learning.

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

🟢 Approval recommended

The PR only adjusts Maven version properties for Jackson and the changes are self-contained within the parent POM.

Pull request overview

Updates the parent Maven dependency version properties to align Jackson artifacts with the latest stable 2.x release, addressing the GHSA-r7wm-3cxj-wff9 affected range without introducing code or logic changes.

Changes:

• Bumped version.jackson, version.jackson.databind, version.jackson.dataformat, and version.jackson.datatype to 2.22.2.
• Bumped version.jackson.annotations to 2.22.

File summaries

File	Description
parent/pom.xml	Updates Jackson-related Maven properties used by dependencyManagement to pull in Jackson 2.22.2 (and annotations 2.22).

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[jenkins-is-staging]

PR builder started
Link: https://github.com/wso2/product-is/actions/runs/33838528609

[jenkins-is-staging]

PR builder completed
Link: https://github.com/wso2/product-is/actions/runs/33838528609
Status: success

[jenkins-is-staging]

Approving the pull request based on the successful pr build https://github.com/wso2/product-is/actions/runs/33838528609