fix(security): raise Jackson floor to 2.22.3 (4 high Dependabot alerts)

[mattinannt]

What & why

Was: jackson in gradle/libs.versions.toml is floored at 2.22.2, which is affected by four high-severity advisories:

Advisory	Package	Issue
GHSA-7hhh-6rmp-j9qf	jackson-core	unbounded StringBuilder growth (DoS)
GHSA-p6pp-m3f8-5c89	jackson-core	ReDoS in NumberInput.PATTERN_FLOAT
GHSA-cxp5-3px4-pw24	jackson-databind	quadratic forward-reference completion
GHSA-wv8q-qhhj-9h54	jackson-databind	retains every unknown raw type ID

Now: the floor is 2.22.3, the patched release for all four. One-line change; the same version drives both the jackson-bom platform on Dokka's buildscript classpath and the resolutionStrategy floor in android/build.gradle.kts.

Jackson only arrives through Dokka's engine, so the published AAR and POM are unaffected.

How this was checked

I couldn't read the Dependabot alert list (the API returns 403 to this token), so I resolved the dependency graph and queried OSV for every coordinate instead.

Check	Outcome
./gradlew buildEnvironment :android:buildEnvironment, every coordinate against OSV	before: 4 high Jackson advisories + 1 moderate Kotlin; after: only the moderate Kotlin one
:android:dependencies (SDK runtime/test classpaths) against OSV	no findings
jackson-core, jackson-databind, jackson-bom 2.22.3 on Maven Central	all return 200
assembleRelease / Dokka	not run locally (no Android SDK in the sandbox) — left to CI

Not addressed

kotlin-gradle-plugin 2.2.10 (GHSA-r937-wjx7-w2jp, moderate) wants 2.4.20-Beta1. It is below the high/critical bar and needs a toolchain bump rather than a pin.

Alerts close on merge, since dependency-submission.yml only runs on push: main.

🤖 Generated with Claude Code

https://claude.ai/code/session_017wK7KCUHKqHQEhVmoSeX1B

---

Generated by Claude Code

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: d296a563-8755-4a6f-944f-b8c86a1d81bd

---

📥 Commits

Reviewing files that changed from the base of the PR and between f77bf5e and 760f0d4.

---

📒 Files selected for processing (1)

• gradle/libs.versions.toml

---

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

---

Walkthrough

The Jackson version floor in the Gradle version catalog changes from 2.22.2 to 2.22.3.

Priority: ➖ Normal

Merge Risk: ⚪ Minimal · up to 760f0

The configured Jackson floor now uses the version listed as fixed for the four reported core and databind advisories. No concrete merge-blocking risk is established.

Pre-merge checks | 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check		The title clearly and concisely describes the main change: raising the Jackson security floor to version 2.22.3 to address four high-severity Dependabot alerts.
Description check		The description directly explains the version change, the affected advisories, validation steps, test limitations, and the remaining moderate Kotlin advisory.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud