[identity-api-user] Bump Jackson to 2.22.2

[sadilchamishka]

Purpose

Upgrade the Jackson artifacts to the latest stable 2.x release, 2.22.2.

2.21.2 is still within the affected range of GHSA-r7wm-3cxj-wff9 ([2.19.0, 2.21.4)), which is
the follow-up to CVE-2026-18401 and is described upstream as an incomplete fix for it. 2.22.2 is
the current latest on the 2.x line and is clear of both.

Approach

Version property bumps only — no code or logic changes.

pom.xml:

• jackson-databind.version: 2.21.2 → 2.22.2
• jackson-jaxrs-json-provider.version: 2.21.2 → 2.22.2
• jackson-dataformat-xml.version: 2.21.2 → 2.22.2

jackson.version (1.9.13) is the legacy Codehaus Jackson 1.x, a different artifact, and is left
untouched.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 2c1a9466-a09c-4f32-98d3-a58dc89a23dc

📥 Commits

Reviewing files that changed from the base of the PR and between a274de3 and 10ca01a.

📒 Files selected for processing (1)

• pom.xml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Summary

Summary

• Updated Jackson 2.x dependencies from 2.21.2 to 2.22.2 in pom.xml.
• Updated jackson-databind, jackson-jaxrs-json-provider, and jackson-dataformat-xml.
• Kept the legacy Codehaus Jackson 1.x version unchanged.

Walkthrough

The pull request updates three Jackson Maven properties in pom.xml from version 2.21.2 to 2.22.2:

• jackson-jaxrs-json-provider.version
• jackson-databind.version
• jackson-dataformat-xml.version

Suggested reviewers: wso2-jenkins-bot, hwupathum, rovinkyk

Merge Risk: ⚪ Minimal · up to 10ca0

This updates the Jackson 2.x dependency versions to 2.22.2 without application logic changes. No current merge-blocking risk is identified.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description explains the purpose and approach, and it lists the three updated Jackson properties. However, it omits most template sections, including Goals, User stories, the mandatory Developer C…	Complete the missing template sections. Mark each non-applicable section as N/A with a brief explanation, and complete the mandatory Developer Checklist requirement.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely states the main change: upgrading Jackson to version 2.22.2.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description explains the purpose and approach, and it lists the three updated Jackson properties. However, it omits most template sections, including Goals, User stories, the mandatory Developer Checklist, Release note, Documentation, Training, Certification, Marketing, Automation tests, Security checks, Samples, Related PRs, Migrations, Test environment, and Learning.

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

🟢 Approval recommended

The change is a straightforward Maven property version bump with no code/logic modifications and consistent usage via dependencyManagement.

Pull request overview

This PR upgrades the project’s Jackson 2.x dependencies to 2.22.2 to address the affected range for GHSA-r7wm-3cxj-wff9 (and its related CVE), while intentionally leaving the legacy Codehaus Jackson 1.x property untouched.

Changes:

• Bump jackson-databind.version from 2.21.2 to 2.22.2.
• Bump jackson-jaxrs-json-provider.version from 2.21.2 to 2.22.2.
• Bump jackson-dataformat-xml.version from 2.21.2 to 2.22.2.

File summaries

File	Description
pom.xml	Updates Jackson 2.x version properties used in dependencyManagement to 2.22.2.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[jenkins-is-staging]

PR builder started
Link: https://github.com/wso2/product-is/actions/runs/33833191922

[jenkins-is-staging]

PR builder completed
Link: https://github.com/wso2/product-is/actions/runs/33833191922
Status: success

[jenkins-is-staging]

Approving the pull request based on the successful pr build https://github.com/wso2/product-is/actions/runs/33833191922