[tonygermano]

Supersedes #493, which bumps jackson-core alone to 2.18.11.

Summary

A comment in libs.versions.toml says the Jackson family can't be upgraded until the AWS SDK and Swagger are. This PR does all three in an order that keeps every library working with the Jackson version it gets:

Library	Before	After
AWS SDK	2.15.28 (netty-nio-client already on 2.20.140)	2.55.12
Jackson	core 2.18.8, rest of the family 2.14.3	2.18.11
swagger-core	2.0.10	2.2.41

Jackson 2.18.11 and the newer copy of jackson-core bundled in the AWS SDK together clear 15 CVEs. Each commit lists its CVEs in its trailers.

The AWS SDK upgrade changes some behavior that channel scripts calling the SDK directly could notice. See Changes for channel scripts.

Why

jackson-databind 2.16 removed APIs that swagger-core 2.0.10 and AWS SDK 2.15.28 call, so the family was held on 2.14.3. Only jackson-core was bumped, for a security fix. databind 2.14.3 now has eleven open advisories.

The AWS SDK mix was already broken on its own:

• netty-nio-client 2.20.140 calls members that utils and http-client-spi 2.15.28 don't have, such as ProxySystemSetting.HTTPS_PROXY_HOST and SdkHttpRequest.forEachHeader.
• s3 2.15.28 needs the arns module, which wasn't shipped. Parsing an S3 ARN failed with NoClassDefFoundError.

Commits

1. Align the AWS SDK family on 2.55.12.
   • 2.55.12 is the newest release past Renovate's 14-day minimum age, as of 2026-10-22.
   • Since 2.17 the SDK parses JSON with its own shaded copy of Jackson (third-party-jackson-core), so it no longer depends on com.fasterxml.jackson at all. In 2.55.12 that copy is jackson-core 2.21.7, which has no advisories. 2.20.140, the version netty-nio-client was on, bundles 2.15.2, which has three.
   • New runtime modules, placed with the rest of the SDK: arns, checksums, checksums-spi, crt-core, endpoints-spi, http-auth, http-auth-aws, http-auth-aws-eventstream, http-auth-spi, identity-spi, json-utils, retries, retries-spi, third-party-jackson-core and utils-lite.
   • No other library changes. The SDK's POMs ask for newer netty, httpcore, slf4j and reactive-streams, but every reference resolves against the versions we already ship. The only new non-AWS entries in verification-metadata.xml are two BOM POMs: junit-bom, imported by the SDK's bom-internal, and jetty-bom, imported by netty-nio-client's POM. No jars come from them.
   • apache5-client is left out. Since 2.46 it's the default HTTP client of the service clients, but our S3 connector sets ApacheHttpClient explicitly. Without apache5-client on the classpath, a client bui
     lt without an HTTP client still gets ApacheHttpClient, as before.
   • The client still ships only regions and utils. Those cover the only calls it makes (Region.regions() and Region.id()). The region list grows from 31 to 53.
2. Realign Jackson on 2.18.11 and upgrade Swagger to 2.2.41. Neither Swagger version works with the other's Jackson, so both move together.
   • Jackson 2.18.11: it's the first release with no open advisories in any module we ship. 2.18.8 still has nine in databind and two in core. The 2.19 line is no longer maintained, and its last release has sixteen.
   • Swagger 2.2.41: it's the first release that keeps DashboardStatus.childStatuses in /api/openapi.json. The first release built for Jackson 2.18 (2.2.28) drops that property. 2.2.41 is built against J
     ackson 2.19.2, but every Jackson member it references exists in 2.18.11.
   • It adds no new runtime dependencies.
3. Pin the operationIds of overloaded API methods.
   • Swagger names the second of two overloaded methods <name>_1. 2.2.41 reads the methods in the opposite order from 2.0.10, so ten pairs swapped IDs. For example, getEvents moved from GET /events to POST /events/_search.
   • The 20 affected operations now set operationId explicitly, using the names from one run of the previous spec.

Checksums in verification-metadata.xml were regenerated with a cold cache, as CONTRIBUTING.md describes.

Changes for channel scripts

Channel scripts can call the AWS SDK directly. These changes between 2.15.28 and 2.55.12 could affect them:

• S3 checksums (since 2.30): S3 clients send a CRC32 checksum on upload and validate checksums on download. AWS S3 supports this, but some S3-compatible stores reject it. Our S3 connector now sends and valid
  ates checksums too. It only talks to AWS endpoints, so it shouldn't break this way, but S3 reads and writes are on the manual test list. To turn it off, set requestChecksumCalculation(RequestChecksumCalculation .WHEN_REQUIRED) on the client builder or AWS_REQUEST_CHECKSUM_CALCULATION=when_required in the environment.

• Service client versions (since 2.53): the SDK core needs service client modules of 2.28.1 or later. Older AWS service jars added to custom-lib (DynamoDB, SQS and so on) stop working and should be updated t
  o 2.55.12.

• Netty proxy settings (since 2.25): the async Netty client now takes its proxy settings from environment variables and system properties by default, as the Apache client already did.

• Removed APIs, which break any caller, scripts included:

  • JavaSystemSetting.USER_REGION;
  • core.util.json.JacksonUtils;
  • the services.s3.checksums classes;
  • the metadata classes of retired AWS services.

• Changed APIs that break only compiled Java code (such as extensions) or classes that extend the SDK's. Rhino resolves calls at run time, so scripts that only call these aren't affected.

  • HttpCredentialsProvider is now an interface instead of an abstract class.
  • The STS credential providers' getUpdatedCredentials returns AwsSessionCredentials.
  • NoOpSigner is final.
  • The JSON protocol factories use the SDK's shaded JsonFactory.

  The credential interfaces moved to identity-spi, but existing calls still work.

Changes to the OpenAPI document

The API's responses don't change: payloads are written by XStream, not Jackson. The generated spec does change, and each change makes it describe those payloads correctly:

• byte[] properties (Attachment.content, RawMessage.rawBytes, EncryptionSettings.secretKey) are now type: string, format: byte. The old spec said they were arrays of strings. The server has always
  sent a base64 string, e.g. "rawBytes":"aGk=".
• CodeTemplateLibrarySaveResult names its exception librariesCause instead of cause. librariesCause is the name the server sends.
• Form parameters of the channel, statistics and login operations now have their descriptions.

oasdiff breaking flags the first two changes. It reports 18 errors for the type change and 2 warnings for the removed cause property. They only affect clients generated from the old spec, and those clients c
ouldn't read the real responses for these fields anyway.

On main, the operationIds of overloaded methods could change between restarts, because Swagger 2.0.10 followed Java's method order. 2.2.41 sorts the methods itself, so they're now fixed. The 20 pinned here keep the names one run of main produced.

Testing

Claude checked:

• ./gradlew clean build dist: all 722 tests pass.
• Every class in the distribution, with a scratch ASM tool. Every reference into software.amazon.awssdk, com.fasterxml.jackson and io.swagger resolves, except:
  • the optional aws-crt native library, which wasn't shipped before either;
  • three Bean Validation 2.0 constraints that only models annotated with them would reach;
  • log4j-core's optional XML and YAML layouts, which were unresolved before.
• The server started from the distribution:
  • /api/openapi.json, /api/openapi.yaml and Swagger UI load.
  • The spec has the same 212 operations as before, with the same operationIds as the run of main it was compared with.
• The client's region calls, which run with only regions and utils on the classpath.
• The SDK's public API, 2.15.28 against 2.55.12, with japicmp, excluding internal packages. That gave the changes listed above. Claude checked the "removed method" hits by hand: methods that only moved to a superclass aren't listed.

To compare the specs yourself:

• oasdiff changelog on the old and new specs (strip the examples keys first, because they reference external files);
• or diff <(jq -S . old.json) <(jq -S . new.json).

Still to test by hand: See this commit for test results on the following:

• File connector reading from and writing to S3, including an S3 ARN
• KMS
• AWS region dropdown in the client

Release notes

• AWS SDK upgraded to 2.55.12. It ships the arns module that S3 ARN parsing needs, and its bundled JSON parser has no known advisories. Channel scripts that call the SDK directly should review Changes for channel scripts, in particular the S3 checksum default and the 2.28.1 minimum for other AWS service jars. S3 access point ARNs now work in the File connector's S3 Bucket field, in the colon form arn:aws:s3:<region>:<account>:accesspoint:<name>/<prefix>. The slash form the AWS console shows (...:accesspoint/<name>) fails with "Invalid ARN".
• Jackson upgraded to 2.18.11 (CVE fixes).
• Swagger upgraded to 2.2.41. The OpenAPI document now describes byte[] fields as base64 strings and names CodeTemplateLibrarySaveResult.librariesCause correctly. Clients generated from the spec may need to
  be regenerated.

---

🤖 Drafted with Claude Code

[github-actions]

Test Results

129 files  ±0  129 suites  ±0   4m 15s ⏱️ + 1m 51s
737 tests ±0  737 ✅ ±0  0 💤 ±0  0 ❌ ±0 
827 runs  ±0  821 ✅ ±0  6 💤 ±0  0 ❌ ±0 

Results for commit 543e341. ± Comparison against base commit 6d348a0.

[pacmano1]

None of the "Still to test by hand" boxes were ticked. An SDK jump of almost six years (2.15.28 from November 2020 to 2.55.12 from October 2026) shouldn't merge without touching real AWS, so I ran them against a real bucket, queue and KMS key, on main and on this branch. All fine on this branch:

• S3: File Writer and Reader, including an access point ARN. Uploads carry CRC32. The ARN only works in the colon form (arn:aws:s3:us-west-2:<account>:accesspoint:<name>/<prefix>). The slash form the console shows fails with "Invalid ARN", because the connector cuts the host at the first /. Worth a line in the release notes.
• KMS: a channel script calling KmsClient to encrypt and decrypt with a real key, and the File Reader reading an object encrypted with that key.
• Region dropdown: 53 regions in the real Administrator, and a region only the new SDK knows (ca-west-1) now selects instead of falling back to Custom.

Please tick the boxes and point them here.

operationIds. Main never had a fixed set: Swagger 2.0.10 takes Java's method order as is, and across four boots of main (Java 17, 21 twice, 25) 8 of the 16 overloaded names moved, getAlertInfo even between the two Java 21 boots. 2.2.41 sorts classes and methods itself, so this branch gave the same IDs every time, pinned or not. Your pins copy one run of main; my first Java 21 boot of main had setChannelEnabled and setChannelInitialState the other way round. Please reword "All operationIds are unchanged" to say main's moved between boots and this fixes them. Pinning the other six overloaded names (exportMessagesServer, getMessages, removeMessages, sendTestEmail, testConnection, testWrite) is optional; it would stop a future Swagger change from moving them.

Aside for @gibson9583, since this breaks sqs-source-connector:

• 1.0.2 fails at channel start on this branch: NoClassDefFoundError: software/amazon/awssdk/protocols/query/interceptor/QueryParametersToBodyInterceptor. That's the "service client modules of 2.28.1 or later" note above.
• Built with -Daws.sdk.version=2.55.12, it sends and receives on a real queue. It needs two test-only changes first: server/pom.xml needs aws-json-protocol as provided, because SQS moved to the JSON protocol in 2.21, and SqsQueueInspectorWireTest fakes a query-protocol XML reply, so it needs a JSON one.
• That build doesn't run on 4.6 or 4.7 (NoClassDefFoundError: software/amazon/awssdk/awscore/AwsClient), so it needs its own release line, with the engine bounds set in plugin.xml and the catalog.

[tonygermano]

@pacmano1 I checked the boxes for the AWS tests and updated the PR description to point to your commit. Thanks for doing that. I'm not an AWS user.

I don't understand what the additional ask is, but you can push changes that you feel are necessary to this PR. I was just trying to upgrade these problem libraries while breaking as little as possible. If you feel something needs mentioning in the release notes, please propose the exact text that should go in the release notes, and I will add it to the PR description (or you can).

[pacmano1]

Edited the description: reworded the three operationId lines and added the access point ARN form to the release notes. Ignore my bit about pinning the other six; 2.2.41 sorts the methods, so they can't move.