[FLINK-40071][build] Bump jackson-bom to 2.21.5

[spuru9]

What is the purpose of the change

jackson-databind 2.21.3 was affected by several recently published CVEs (CVE-2026-54512 through 54518). 2.21.4 fixed all of them except CVE-2026-54515, which had no released fix in any jackson 2.x line at the time. jackson-databind 2.21.5 has since been released and fixes CVE-2026-54515 (GHSA-5jmj-h7xm-6q6v: vulnerable range >= 2.19.0, < 2.21.5), so bumping to 2.21.5 clears all seven CVEs.

Brief change log

• jackson-bom.version 2.21.3 → 2.21.5 in the root pom
• Updated the NOTICE files of the 11 modules bundling non-shaded jackson (jackson-annotations stays at 2.21, matching the bom)

Verifying this change

This change is a dependency version bump without code changes. The affected bundling modules build cleanly, and the bundled jackson-databind version inside the shaded jars (flink-kubernetes, flink-s3-fs-hadoop) was verified to be 2.21.5 via the relocated PackageVersion.class.

Does this pull request potentially affect one of the following parts:

• Dependencies (does it add or upgrade a dependency): (yes — jackson 2.21.3 → 2.21.5, patch release)
• The public API, i.e., is any changed class annotated with @Public(Evolving): (no)
• The serializers: (no)
• The runtime per-record code paths (performance sensitive): (no)
• Anything that affects deployment or recovery: JobManager (and its components), Checkpointing, Kubernetes/Yarn, ZooKeeper: (no)
• The S3 file system connector: (no)

Documentation

• Does this pull request introduce a new feature? (no)
• If yes, how is the feature documented? (not applicable)

---

Was generative AI tooling used to co-author this PR?

• Yes: Claude Code

Generated-by: Claude Code (claude-fable-5)

[flinkbot]

CI report:

• b8b5003 Azure: SUCCESS

Bot commands

The @flinkbot bot supports the following commands:

• @flinkbot run azure re-run the last Azure build

[snuyanzin]

jackson-databind 2.21.3 is affected by several recently published CVEs (54512 through 54518). Bumping jackson-bom to 2.21.4 fixes all of them except 54515, which has no released fix in any jackson 2.x line yet (its announced fix versions 2.21.5/2.22.1 are unreleased, and 2.22.0 is also affected) — that one needs a follow-up once upstream ships.

existence of CVE in 3rd party doesn't necessary mean Flink is impacted

if we bump dependency now it doesn't mean a new Flink release, which means nothing is changed for end user.

So the question: why we should update now rather than wait for full fix from jackson and update?

[spuru9]

Ok will move to draft, and add this to the JIRA. Will open with the latest version close to the release.

[MartijnVisser]

I think also we should first bump Jackson etc in flink-shaded before doing it inside of Flink itself

[snuyanzin]

PR in shaded is present apache/flink-shaded#160
also waiting for fix from Jackson (unless we want to release shaded earlier)

[spuru9]

I think also we should first bump Jackson etc in flink-shaded before doing it inside of Flink itself

That was also a reason I created the PR, the shaded is already having a PR to move to 2.21.4. https://github.com/apache/flink-shaded/pull/160/changes

[MartijnVisser]

Ah good, let's then wait for a definitive fix and address everything in one go

[spuru9]

2.21.5 have been released. Will see if its CVE free.
Will reopen when shaded is release.