Pin jackson to 2.18.11 for dependabot alerts

[stasimus]

play-json 3.0.6 (latest stable) still pulls jackson 2.14.3, which trips the jackson-core and jackson-databind dependabot alerts. Added jackson-core and jackson-databind 2.18.11 as explicit deps so the patched version gets resolved.

Summary by CodeRabbit

• Chores
  • Updated the project’s build configuration to include additional components for JSON processing. No changes to application features or user-facing behavior are included in this update.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: evolution-gaming/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 6ed16d4c-73fa-4188-9063-54164207bf61

📥 Commits

Reviewing files that changed from the base of the PR and between ed6dcba and 79cf91d.

📒 Files selected for processing (2)

• build.sbt
• project/Version.scala

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The Play JSON project now declares play-json, jackson-core, and jackson-databind as dependencies. project/Version.scala adds the Jackson version constant 2.18.11.

Changes

Play JSON dependencies

Layer / File(s)	Summary
Jackson dependency declarations project/Version.scala, build.sbt	Version.jackson is set to 2.18.11. The Play JSON project declares play-json, jackson-core, and jackson-databind as dependencies.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~5 minutes

Change: Other

Suggested reviewers: mr-git

Merge Risk: ⚪ Minimal · up to 79cf9

The project pins Jackson core and databind to 2.18.11 for Play JSON. No actionable merge-blocking issue is established by the inspected dependency and mapper paths.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 79cf9

The change is aimed at using newer Jackson libraries and does not change application access controls. No introduced security defect is evident, but the effective versions and downstream consumer behavior have not been verified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The relevant exposure is the module's resolved Jackson classpath and any consumers that inherit it; the available evidence does not establish which downstream applications are exposed.

Trust Boundaries and Controls

• observed — The changed ranges contain dependency declarations and a version constant, not a change to a runtime trust-boundary control.

Hardening Proposals

• proposed — Confirm the resolved and published dependency graphs select the intended Jackson versions, including in representative downstream consumers, before relying on the pin to address the alerts.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: pinning Jackson dependencies to version 2.18.11 to address Dependabot alerts.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}