Security: Upgrade jackson-core to 2.18.6+ to fix GHSA-72hv-8253-57qq (DoS)

[nsabale7]

A security scan has identified a High-severity vulnerability in the jackson-core library bundled within the OpenAPI Generator JAR.

Vulnerability Details:

ID: GHSA-72hv-8253-57qq

Severity: High (7.5)

Package: com.fasterxml.jackson.core:jackson-core

Affected Version: 2.18.2

Fixed Version: 2.18.6

Location in Project:
In the latest CLI release, the vulnerable library is located at:
@openapitools/openapi-generator-cli/versions/7.20.0.jar/META-INF/maven/com.fasterxml.jackson.core/jackson-core/pom.properties

Steps to Reproduce:

Use @openapitools/openapi-generator-cli version 2.30.0 (which pulls generator 7.20.0).

Run a container security scan (e.g., Trivy, Grype, or Prisma Cloud) on the environment.

The scan flags the bundled jackson-core-2.18.2.jar inside the generator JAR.

Suggested Fix:
Update the pom.xml in the OpenAPI Generator root to use jackson-core version 2.18.6 or higher.

[wing328]

should be fixed via #23105

[nsabale7]

Thanks @wing328 for the fix, since this is High-severity vulnerability is currently blocking our security compliance for deployment, do you have an ETA for the next release?

[wing328]

mar 20 according to https://github.com/OpenAPITools/openapi-generator/milestone/74

you can use customized templates (e.g. -t via CLI) for the time being.

[nsabale7]

Thanks for the update.
We are not using openapi-generator directly - we use @openapitools/openapi-generator-cli in a Next.js environment.
It appears this is included transitively via the bundled JAR in that package..