Release 1.18.2 with jackson 2.22.3 fix: parquet-jackson 1.18.1 bundles jackson 2.22.2 (GHSA-7hhh-6rmp-j9qf, GHSA-p6pp-m3f8-5c89, GHSA-cxp5-3px4-pw24, GHSA-wv8q-qhhj-9h54) #3857

Summary

parquet-jackson-1.18.1.jar bundles a shaded copy of jackson-core and jackson-databind 2.22.2. Vulnerability scanners (grype) flag these as High against the bundled copy, even when the application itself uses jackson 2.22.3 on the classpath.

The jackson 2.22.3 bump is already merged on the maintenance branch (#3846, parquet-1.18.x, merged 2026-10-10), but there is no 1.18.2 release on Maven Central yet, so downstream users on 1.18.1 cannot pick up the fix.

Affected findings (grype, against parquet-jackson-1.18.1.jar)

• GHSA-7hhh-6rmp-j9qf (jackson-core, High)
• GHSA-p6pp-m3f8-5c89 (jackson-core, High)
• GHSA-cxp5-3px4-pw24 (jackson-databind, High)
• GHSA-wv8q-qhhj-9h54 (jackson-databind, High)

Fixed version reported by grype: 2.22.3.

Workaround attempted and why it does not work

Excluding parquet-jackson from parquet-hadoop / parquet-avro removes the shaded classes, and our write-path tests then fail:

NoClassDefFound: shaded/parquet/com/fasterxml/jackson/databind/ObjectMapper
NoClassDefFound: org.apache.parquet.hadoop.metadata.ParquetMetadata (Could not initialize class)

parquet-hadoop (crypto/keytools HadoopFSKeyMaterialStore, KeyMaterial) references the shaded jackson classes directly, so downstream consumers cannot drop the shaded jar without breaking parquet writes.

Request

1. Is a 1.18.2 (or equivalent) release planned from parquet-1.18.x with the jackson 2.22.3 bump? Any target date?
2. Related open issues that look connected: When planning to release with Vulnerability Fix CVE-2026-54512 and CVE-2026-54513 #3668 (planned release with CVE-2026-54512/54513), Audit third-party code bundled in published JARs #3690 (audit of third-party code bundled in published JARs), Libraries 1.17.1 fails vulnerability scans #3693 (1.17.1 fails vulnerability scans).

Versions observed: parquet 1.18.1 (latest on Maven Central), jackson 2.22.2 bundled.