Repository navigation
Bump tools.jackson.core:jackson-databind from 3.2.1 to 3.2.3 - #376
Conversation
Bumps [tools.jackson.core:jackson-databind](https://github.com/FasterXML/jackson-databind) from 3.2.1 to 3.2.3. - [Commits](FasterXML/jackson-databind@jackson-databind-3.2.1...jackson-databind-3.2.3) --- updated-dependencies: - dependency-name: tools.jackson.core:jackson-databind dependency-version: 3.2.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
Code Coverage Report
|
deweyjose
left a comment
There was a problem hiding this comment.
Summary
Dependabot patch bump of tools.jackson.core:jackson-databind 3.2.1 → 3.2.3 in examples/graphqlcodegen-example/kotlin-jackson3/pom.xml:24 (the tools-jackson.version property). Single file, 1 insertion / 1 deletion, dependency-metadata only. This module exists solely to exercise the jacksonVersions parameter end-to-end (generate Kotlin + deserialize real JSON through a Jackson 3 ObjectMapper).
Build result
CI is not trustworthy here (Java CI doesn't run on fork PRs), so I built locally against this HEAD (e4372d6):
./mvnw -B -ntp clean install -Dcodegen.server.schemaUrl=http://localhost:8000/main.graphqls→ BUILD SUCCESS (full reactor: plugin + all 5 example modules).kotlin-jackson3'sJackson3DeserializationTestran green (2/2), so the bumpedjackson-databind 3.2.3is actually deserialized at runtime, not merely compiled../mvnw -B -ntp spotless:check -pl graphqlcodegen-maven-plugin→ BUILD SUCCESS (XML-only change; no Java formatting impact).
Wiring completeness
N/A — no new/changed @Parameter, no touch to Codegen.java, CodegenConfigProvider, CodegenExecutor, or CodeGenConfigBuilder. No boolean-gap risk.
Backwards compatibility
Not breaking. The change lives entirely in an example/test module. Release is scoped to -pl graphqlcodegen-maven-plugin (publish.yaml), so no published artifact and no consumer depends on this module. jackson-databind is not on the generation path (graphql-dgs-codegen-core / kotlinpoet / graphql-java), so generated output is unaffected. No @Parameter removed/renamed/retyped, no default changed, no Java/Maven floor or goal/phase change, no consumer-facing transitive altered.
Risks
Negligible. A Jackson patch could in principle shift deserialization behavior, but Jackson3DeserializationTest passes against 3.2.3, covering the one path this module cares about.
Verdict
APPROVE. Meets all Dependabot auto-merge conditions (dependabot author, semver-patch, off generation-path, pom-only, local verify-superset build clean, no breaking-change label). Merging.
Generated by Claude Code
Bumps tools.jackson.core:jackson-databind from 3.2.1 to 3.2.3.
Commits
4179a66[maven-release-plugin] prepare release jackson-databind-3.2.337c8a72Prep for 3.2.3 release5fa7881Merge branch '3.1' into 3.2c9f17a2Post-release dep version bump1ea1c40[maven-release-plugin] prepare for next development iteration2968e8f[maven-release-plugin] prepare release jackson-databind-3.1.7d61810bPrep for 3.1.7 releasee065a09Merge branch '2.x' into 3.1fd189a7Merge branch '2.22' into 2.x211faf7Post-release dep version bumpDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)