[kiview]

Why

core/build.gradle forces jackson-databind and jackson-datatype-jsr310 to the same version (currently 2.18.4). Jackson is not shaded. It comes in through docker-java's api dependencies, so the forced version is what users get on their classpath. Keeping it at a conservative floor avoids conflicts like #3433 (see #3579, #3602).

dependabot.yml already ignores minor/patch updates for jackson-datatype-jsr310 (#7143) so it stays aligned with databind. jackson-databind itself was never ignored, so #12119 bumped it alone to 2.22.3. That:

• breaks the databind/jsr310 alignment (2.22.3 vs 2.18.4)
• pulls in jackson-core 2.22.3, which has different license files (Schubfach-LICENSE, FastDoubleParser-ThirdParty-LICENSE, no FastDoubleParser-NOTICE / thirdparty-LICENSE). Those files fail JarFileShadingTest.testMetaInf in core (17) / core (21).

Change

Add the same minor/patch ignore rule for com.fasterxml.jackson.core:jackson-databind in the /core entry. Jackson bumps stay a deliberate manual change, as in #10258.

After merge, #12119 should be recreated without the Jackson bump (@dependabot recreate if needed).

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Automatic updates for Jackson Databind are now limited to major versions; minor and patch updates are ignored.

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

• Configuration used: Repository UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 4e3b3fc4-63a7-4973-99f3-0d02d9e42459

📥 Commits

Reviewing files that changed from the base of the PR and between 9b18ab0 and 3d9aff5.

📒 Files selected for processing: 1

• .github/dependabot.yml

+------------------+
| I see dead code. |
+------------------+
  \
   \   (\__/)
       (•ㅅ•)
       / 　 づ

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}