From d0fc3b6a63212f3200d726e86531ff5b37bfb4ca Mon Sep 17 00:00:00 2001
From: hemchandra <hemchandra@testmuai.com>
Date: Thu, 23 Jul 2026 17:41:29 +0530
Subject: [PATCH] fix(deps): bump netty 4.2.16 & jackson 2.18.9 to clear
 report-fatjar CVEs

The karate-reports fatjar (com.lambdatest:karate-reports, built from the
karate-core shaded jar) bundled vulnerable transitive deps flagged by the
hyperexecute-postprocessing-service DockerfileSecure vulnerability scan:

  netty 4.2.15.Final     -> CVE-2026-55831, CVE-2026-55833, CVE-2026-55851
  jackson-databind 2.18.8 -> CVE-2026-59889, GHSA-mhm7-754m-9p8w

Bump the karate-core dependencyManagement pins to the patched releases
(netty-bom 4.2.16.Final; jackson-core/databind/annotations 2.18.9) and
bump lt.patch.version 1 -> 2 so lt-reports-cd republishes as 1.5.3.2.

Downstream: hyperexecute-job-artefacts must bump KARATE_REPORTS_VERSION
1.5.3.1 -> 1.5.3.2 after this publishes.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 karate-core/pom.xml | 8 ++++----
 pom.xml             | 2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/karate-core/pom.xml b/karate-core/pom.xml
index f9804ec8e..9cf60ea90 100644
--- a/karate-core/pom.xml
+++ b/karate-core/pom.xml
@@ -20,24 +20,24 @@
             <dependency>
                 <groupId>io.netty</groupId>
                 <artifactId>netty-bom</artifactId>
-                <version>4.2.15.Final</version>
+                <version>4.2.16.Final</version>
                 <scope>import</scope>
                 <type>pom</type>
             </dependency>
             <dependency>
                 <groupId>com.fasterxml.jackson.core</groupId>
                 <artifactId>jackson-core</artifactId>
-                <version>2.18.8</version>
+                <version>2.18.9</version>
             </dependency>
             <dependency>
                 <groupId>com.fasterxml.jackson.core</groupId>
                 <artifactId>jackson-databind</artifactId>
-                <version>2.18.8</version>
+                <version>2.18.9</version>
             </dependency>
             <dependency>
                 <groupId>com.fasterxml.jackson.core</groupId>
                 <artifactId>jackson-annotations</artifactId>
-                <version>2.18.8</version>
+                <version>2.18.9</version>
             </dependency>
         </dependencies>
     </dependencyManagement>
diff --git a/pom.xml b/pom.xml
index d334aaa06..81bfb40bf 100644
--- a/pom.xml
+++ b/pom.xml
@@ -35,7 +35,7 @@
         <!-- LambdaTest fork patch counter, kept separate from the upstream-tracking
              <version> above. lt-reports-cd publishes ${project.version}.${lt.patch.version};
              bump this on every change that needs a republish. -->
-        <lt.patch.version>1</lt.patch.version>
+        <lt.patch.version>2</lt.patch.version>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <java.version>17</java.version>
         <maven.compiler.version>3.13.0</maven.compiler.version>