Bump java-jwt to 4.6.1 and jackson-bom to 2.22.2 to address CVEs

[arunav-gandhi]

By submitting a PR to this repository, you agree to the terms within the Auth0 Code of Conduct. Please see the contributing guidelines for how to create and submit a high-quality PR for this repo.

Description

Auto-Owners Insurance Company uses our Guardian SDK and is concerned about these vulnerabilities:

CVE-2026-68497 (High)

CVE-2026-83557 (Medium)

CVE-2026-19032 (Medium)

Context: Their routine Mend scans flagged a transitive dependency "com.fasterxml.jackson.core:jackson-databind:2.22.1" brought in by "com.auth0:java-jwt:4.6.0" brought in by "com.auth0.android:guardian:0.11.1".

Ask: They are saying that com.auth0:java-jwt:4.6.0 has a vulnerability that has been fixed in com.auth0:java-jwt:4.6.1+. They would like us to update the Guardian SDK to use the new version.

Changes

• guardian/build.gradle: Bump com.auth0:java-jwt from 4.6.0 → 4.6.1
• guardian/build.gradle: Update explicit jackson-bom pin from 2.22.1 → 2.22.2 to match what java-jwt:4.6.1 declares transitively
• gradle.properties: Add android.jetifier.ignorelist=bcprov-jdk18on to fix a pre-existing Jetifier incompatibility with bcprov-jdk18on:1.85 (compiled with Java 25, unsupported by Jetifier) that was breaking the sample :app module build

References

Include any links supporting this change such as a:
https://auth0team.atlassian.net/browse/ESD-68331

Testing

• ./gradlew :guardian:build — BUILD SUCCESSFUL

  • ./gradlew :guardian:test — BUILD SUCCESSFUL (all tests pass)
  • ./gradlew :guardian:dependencies --configuration releaseRuntimeClasspath — confirms jackson-databind:2.22.2 and jackson-core:2.22.2 resolve correctly via java-jwt:4.6.1
  • No API changes in java-jwt:4.6.1 — the 4.6.0→4.6.1 delta is purely dependency bumps (BouncyCastle + Jackson) and an unused import removal

• This change adds test coverage for new/changed/fixed functionality

Checklist

• I have added documentation for new/changed functionality in this PR or in auth0.com/docs
• All active GitHub checks for tests, formatting, and security are passing
• The correct base branch is being used, if not the default branch