Wiretap
All releases

v5.2.1

clean-closure

A security-focused patch that updates both Jackson families, removes every fixable scanner finding, and refreshes the Java, build and documentation dependency sets.

Highlights

  • 01

    Jackson 2 and 3 patched as complete families

    The Jackson 2 BOM moves to 2.22.3 and the Jackson 3 BOM to 3.2.3, keeping core, databind, data formats and related modules aligned while fixing the newly disclosed parser and databind CVEs.

  • 02

    Runtime closures clean in current scanners

    The exact runtime jars shipped by wiretap-core and wiretap-spring-boot were rebuilt and scanned with Trivy 0.75.0 and OSV-Scanner 2.6.0. No fixable critical, high or medium vulnerability remains.

  • 03

    Current Java and build tooling

    JUnit, JSON Schema Validator, lz4-java, Confluent serializers and the compatible Maven plugin set are refreshed. Compatibility pins remain explicit for Kafka 4.2.1 and Confluent's protobuf 4.34.0.

  • 04

    Patched documentation toolchain

    Next.js moves to 16.3.8 to close the ImageResponse RCE advisory, brace-expansion moves to 5.0.12, and the remaining compatible site packages and AI skill version references are current.

Full notes

Changed

  • Upgraded the Jackson 2 BOM to 2.22.3, Jackson 3 BOM to 3.2.3, JUnit to 6.1.3, NetworkNT JSON Schema Validator to 3.0.8, lz4-java to 1.12.0, and Confluent serializers to 8.3.2.
  • Upgraded Maven Compiler to 3.16.0, Surefire and Failsafe to 3.6.0, Enforcer to 3.6.3, Jar to 3.5.1, Source to 3.4.0, the Ascopes Protobuf plugin to 5.1.11, and the Maven wrapper to 3.9.11. Failsafe's skipITs follows the existing skipTests property so dependency-only CI builds still skip both test phases.
  • Refreshed the real-broker differential matrix to the latest patches on each supported line: Kafka 3.9.2, 4.0.2 and 4.2.2.
  • Upgraded the documentation site to Next.js 16.3.8, React 19.3.0 and the latest compatible supporting packages; refreshed the Wiretap AI skill and cheatsheet for 5.2.1.

Security

  • Fixed CVE-2026-89407, CVE-2026-89425, CVE-2026-91776 and CVE-2026-91777 by upgrading the complete Jackson 2 and Jackson 3 BOMs.
  • Fixed the Next.js ImageResponse RCE advisory GHSA-vcvr-r3jv-pc5j and three brace-expansion denial-of-service advisories; current Trivy and OSV scans report no remaining fixable critical, high or medium finding.
  • Reviewed CVE-2026-93687 in braces 3.0.3. Upstream has no patched release; it is development-only through the Next.js ESLint plugin, receives no untrusted patterns here, and is absent from production output.