Fabre

#1135411 jackson-modules-java8: FTBFS: Numeric value (9223372036854775807) out of range of long (-9223372036854775808 - 9223372036854775807) #1135411

Package:: src:jackson-modules-java8

Source:: src:jackson-modules-java8

Submitter:: Santiago Vila

Date:: 2026-10-15 13:09:06 UTC

Severity:: normal

Tags:

#1135411#5

Date:: 2026-05-01 23:12:54 UTC

From:

To:

Dear maintainer:

During a rebuild of all packages in unstable, this package failed to build.

Below you will find the last part of the build log (probably the most
relevant part, but not necessarily). If required, the full build log
is available here:

https://people.debian.org/~sanvila/build-logs/202605/

About the archive rebuild: The build was made on virtual machines from AWS,
using sbuild and a reduced chroot with only build-essential packages.

If you cannot reproduce the bug please contact me privately, as I
am willing to provide ssh access to a virtual machine where the bug is
fully reproducible.

If this is really a bug in one of the build-depends, please use
reassign and add an affects on src:jackson-modules-java8, so that this is still
visible in the BTS web page for this package.

Thanks.
--------------------------------------------------------------------------------
[...]
 debian/rules clean
dh clean
   dh_auto_clean
	bash -c "for dir in \$(find . -name target -type d); do if [ -f \$(echo \$dir | sed -e s/target\$/pom.xml/) ]; then rm -Rf \$dir; fi done"
	mh_unpatchpoms -plibjackson2-modules-java8-java
   dh_clean
 debian/rules binary
dh binary
   dh_update_autotools_config
   dh_autoreconf
   dh_auto_configure
	mh_patchpoms -plibjackson2-modules-java8-java --debian-build --keep-pom-version --maven-repo=/<<BUILDDIR>>/jackson-modules-java8-2.14.2\+ds2/debian/maven-repo
   dh_auto_build
	/usr/lib/jvm/default-java/bin/java -noverify -cp /usr/share/maven/boot/plexus-classworlds-2.x.jar -Dmaven.home=/usr/share/maven -Dmaven.multiModuleProjectDirectory=/<<BUILDDIR>>/jackson-modules-java8-2.14.2\+ds2 -Dclassworlds.conf=/etc/maven/m2-debian.conf -Dproperties.file.manual=/<<BUILDDIR>>/jackson-modules-java8-2.14.2\+ds2/debian/maven.properties org.codehaus.plexus.classworlds.launcher.Launcher -s/etc/maven/settings-debian.xml -Ddebian.dir=/<<BUILDDIR>>/jackson-modules-java8-2.14.2\+ds2/debian -Dmaven.repo.local=/<<BUILDDIR>>/jackson-modules-java8-2.14.2\+ds2/debian/maven-repo --batch-mode package -DskipTests -Dnotimestamp=true -Dlocale=en_US
OpenJDK 64-Bit Server VM warning: Options -Xverify:none and -noverify were deprecated in JDK 13 and will likely be removed in a future release.

[... snipped ...]

[WARNING]
[WARNING] Some problems were encountered while building the effective model for com.fasterxml.jackson.module:jackson-modules-java8:pom:2.14.2
[WARNING] 'build.plugins.plugin.version' for org.apache.maven.plugins:maven-compiler-plugin is missing. @ com.fasterxml:oss-parent:debian, /<<PKGBUILDDIR>>/debian/maven-repo/com/fasterxml/oss-parent/debian/oss-parent-debian.pom, line 173, column 12
[WARNING] 'build.plugins.plugin.version' for org.apache.maven.plugins:maven-surefire-plugin is missing. @ com.fasterxml:oss-parent:debian, /<<PKGBUILDDIR>>/debian/maven-repo/com/fasterxml/oss-parent/debian/oss-parent-debian.pom, line 217, column 12
[WARNING] 'build.plugins.plugin.version' for org.apache.maven.plugins:maven-jar-plugin is missing. @ com.fasterxml:oss-parent:debian, /<<PKGBUILDDIR>>/debian/maven-repo/com/fasterxml/oss-parent/debian/oss-parent-debian.pom, line 226, column 12
[WARNING] 'build.plugins.plugin.version' for org.codehaus.mojo:build-helper-maven-plugin is missing. @ com.fasterxml:oss-parent:debian, /<<PKGBUILDDIR>>/debian/maven-repo/com/fasterxml/oss-parent/debian/oss-parent-debian.pom, line 199, column 12
[WARNING] 'build.plugins.plugin.version' for org.apache.felix:maven-bundle-plugin is missing. @ com.fasterxml:oss-parent:debian, /<<PKGBUILDDIR>>/debian/maven-repo/com/fasterxml/oss-parent/debian/oss-parent-debian.pom, line 221, column 12
[WARNING]
[WARNING] It is highly recommended to fix these problems because they threaten the stability of your build.
[WARNING]
[WARNING] For this reason, future Maven versions might no longer support building such malformed projects.
[WARNING]
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Build Order:
[INFO]
[INFO] Jackson modules: Java 8                                            [pom]
[INFO] Jackson-module-parameter-names                                  [bundle]
[INFO] Jackson datatype: jdk8                                          [bundle]
[INFO] Jackson datatype: JSR310                                        [bundle]
[INFO]
[INFO] ---------< com.fasterxml.jackson.module:jackson-modules-java8 >---------
[INFO] Building Jackson modules: Java 8 2.14.2                            [1/4]
[INFO]   from pom.xml
[INFO] --------------------------------[ pom ]---------------------------------
[INFO] Looking for compatible RELEASE version of plugin org.apache.maven.plugins:maven-compiler-plugin
[INFO] Looking for compatible RELEASE version of plugin org.codehaus.mojo:build-helper-maven-plugin
[INFO] Looking for compatible RELEASE version of plugin org.apache.maven.plugins:maven-surefire-plugin
[INFO] Looking for compatible RELEASE version of plugin org.apache.maven.plugins:maven-jar-plugin
[INFO] Looking for compatible RELEASE version of plugin com.google.code.maven-replacer-plugin:replacer
[INFO] Looking for compatible RELEASE version of plugin org.apache.maven.plugins:maven-resources-plugin
[INFO] Looking for compatible RELEASE version of plugin org.apache.maven.plugins:maven-shade-plugin
[INFO]
[INFO] --- build-helper:3.3.0:add-source (add-generated-sources) @ jackson-modules-java8 ---
[INFO] Source directory: /<<PKGBUILDDIR>>/target/generated-sources added.
[INFO]
[INFO] --- build-helper:3.3.0:add-resource (add-resource) @ jackson-modules-java8 ---
[INFO]
[INFO] ----< com.fasterxml.jackson.module:jackson-module-parameter-names >-----
[INFO] Building Jackson-module-parameter-names 2.14.2                     [2/4]
[INFO]   from parameter-names/pom.xml
[INFO] -------------------------------[ bundle ]-------------------------------
[INFO] Looking for compatible RELEASE version of plugin org.apache.maven.plugins:maven-install-plugin
[INFO] Looking for compatible RELEASE version of plugin org.apache.maven.plugins:maven-deploy-plugin
[INFO]
[INFO] --- build-helper:3.3.0:add-source (add-generated-sources) @ jackson-module-parameter-names ---
[INFO] Source directory: /<<PKGBUILDDIR>>/parameter-names/target/generated-sources added.
[INFO]
[INFO] --- replacer:1.5.3:replace (process-packageVersion) @ jackson-module-parameter-names ---
[INFO] Replacement run on 1 file.
[INFO]
[INFO] --- build-helper:3.3.0:add-resource (add-resource) @ jackson-module-parameter-names ---
[INFO]
[INFO] --- resources:3.3.1:resources (default-resources) @ jackson-module-parameter-names ---
[INFO] Copying 1 resource from src/main/resources to target/classes
[INFO] Copying 0 resource from . to target/classes/META-INF
[INFO]
[INFO] --- compiler:3.13.0:compile (default-compile) @ jackson-module-parameter-names ---
[WARNING]  Parameter 'optimize' (user property 'maven.compiler.optimize') is deprecated: This property is a no-op in javac.
[INFO] Recompiling the module because of changed source code.
[INFO] Compiling 4 source files with javac [debug:lines,source,vars optimize deprecation target 1.8] to target/classes
[WARNING] bootstrap class path is not set in conjunction with -source 8
  not setting the bootstrap class path may lead to class files that cannot run on JDK 8
    --release 8 is recommended instead of -source 8 -target 1.8 because it sets the bootstrap class path automatically
[WARNING] source value 8 is obsolete and will be removed in a future release
[WARNING] target value 8 is obsolete and will be removed in a future release
[WARNING] To suppress warnings about obsolete options, use -Xlint:-options.
[INFO]
[INFO] --- resources:3.3.1:testResources (default-testResources) @ jackson-module-parameter-names ---
[INFO] skip non existing resourceDirectory /<<PKGBUILDDIR>>/parameter-names/src/test/resources
[INFO]
[INFO] --- compiler:3.13.0:testCompile (default-testCompile) @ jackson-module-parameter-names ---
[WARNING]  Parameter 'optimize' (user property 'maven.compiler.optimize') is deprecated: This property is a no-op in javac.
[INFO] Recompiling the module because of changed dependency.
[INFO] Compiling 15 source files with javac [debug:lines,source,vars optimize deprecation target 1.8] to target/test-classes
[WARNING] bootstrap class path is not set in conjunction with -source 8
  not setting the bootstrap class path may lead to class files that cannot run on JDK 8
    --release 8 is recommended instead of -source 8 -target 1.8 because it sets the bootstrap class path automatically
[WARNING] source value 8 is obsolete and will be removed in a future release
[WARNING] target value 8 is obsolete and will be removed in a future release
[WARNING] To suppress warnings about obsolete options, use -Xlint:-options.
[WARNING] /<<PKGBUILDDIR>>/parameter-names/src/test/java/com/fasterxml/jackson/module/paramnames/PersonTest.java:[25,21] isEqualToComparingFieldByField(java.lang.Object) in org.assertj.core.api.AbstractObjectAssert has been deprecated
[WARNING] /<<PKGBUILDDIR>>/parameter-names/src/test/java/com/fasterxml/jackson/module/paramnames/NamingStrategy67Test.java:[46,21] isEqualToComparingFieldByField(java.lang.Object) in org.assertj.core.api.AbstractObjectAssert has been deprecated
[WARNING] /<<PKGBUILDDIR>>/parameter-names/src/test/java/com/fasterxml/jackson/module/paramnames/NamingStrategy67Test.java:[57,21] isEqualToComparingFieldByField(java.lang.Object) in org.assertj.core.api.AbstractObjectAssert has been deprecated
[WARNING] /<<PKGBUILDDIR>>/parameter-names/src/test/java/com/fasterxml/jackson/module/paramnames/DelegatingCreatorTest.java:[71,21] isEqualToComparingFieldByField(java.lang.Object) in org.assertj.core.api.AbstractObjectAssert has been deprecated
[WARNING] /<<PKGBUILDDIR>>/parameter-names/src/test/java/com/fasterxml/jackson/module/paramnames/DelegatingCreatorTest.java:[80,21] isEqualToComparingFieldByField(java.lang.Object) in org.assertj.core.api.AbstractObjectAssert has been deprecated
[WARNING] /<<PKGBUILDDIR>>/parameter-names/src/test/java/com/fasterxml/jackson/module/paramnames/DelegatingCreatorTest.java:[89,21] isEqualToComparingFieldByField(java.lang.Object) in org.assertj.core.api.AbstractObjectAssert has been deprecated
[WARNING] /<<PKGBUILDDIR>>/parameter-names/src/test/java/com/fasterxml/jackson/module/paramnames/CreatorWithNamingStrategy74Test.java:[46,21] isEqualToComparingFieldByField(java.lang.Object) in org.assertj.core.api.AbstractObjectAssert has been deprecated
[WARNING] /<<PKGBUILDDIR>>/parameter-names/src/test/java/com/fasterxml/jackson/module/paramnames/JsonCreatorTest.java:[36,29] isEqualToComparingFieldByField(java.lang.Object) in org.assertj.core.api.AbstractObjectAssert has been deprecated
[INFO]
[INFO] --- surefire:2.22.3:test (default-test) @ jackson-module-parameter-names ---
[INFO]
[INFO] -------------------------------------------------------
[INFO]  T E S T S
[INFO] -------------------------------------------------------
[INFO] Running com.fasterxml.jackson.module.paramnames.EnumNamingTest
[INFO] Tests run: 2, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.182 s - in com.fasterxml.jackson.module.paramnames.EnumNamingTest
[INFO] Running com.fasterxml.jackson.module.paramnames.JDKSerializabilityTest
[INFO] Tests run: 1, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.074 s - in com.fasterxml.jackson.module.paramnames.JDKSerializabilityTest
[INFO] Running com.fasterxml.jackson.module.paramnames.MapKeyNames206Test
[INFO] Tests run: 2, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.006 s - in com.fasterxml.jackson.module.paramnames.MapKeyNames206Test
[INFO] Running com.fasterxml.jackson.module.paramnames.CreatorWithNamingStrategy74Test
[INFO] Tests run: 1, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.037 s - in com.fasterxml.jackson.module.paramnames.CreatorWithNamingStrategy74Test
[INFO] Running com.fasterxml.jackson.module.paramnames.DelegatingCreatorTest
[INFO] Tests run: 3, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.003 s - in com.fasterxml.jackson.module.paramnames.DelegatingCreatorTest
[INFO] Running com.fasterxml.jackson.module.paramnames.PersonTest
[INFO] Tests run: 1, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.003 s - in com.fasterxml.jackson.module.paramnames.PersonTest
[INFO] Running com.fasterxml.jackson.module.paramnames.NamingStrategy67Test
[INFO] Tests run: 2, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0 s - in com.fasterxml.jackson.module.paramnames.NamingStrategy67Test
[INFO] Running com.fasterxml.jackson.module.paramnames.ConstructorDetectorConfigTest
[INFO] Tests run: 3, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.003 s - in com.fasterxml.jackson.module.paramnames.ConstructorDetectorConfigTest
[INFO] Running com.fasterxml.jackson.module.paramnames.JsonCreatorTest
[INFO] Tests run: 1, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.004 s - in com.fasterxml.jackson.module.paramnames.JsonCreatorTest
[INFO] Running com.fasterxml.jackson.module.paramnames.ParameterNamesAnnotationIntrospectorTest
[INFO] Tests run: 3, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.294 s - in com.fasterxml.jackson.module.paramnames.ParameterNamesAnnotationIntrospectorTest
[INFO]
[INFO] Results:
[INFO]
[INFO] Tests run: 19, Failures: 0, Errors: 0, Skipped: 0
[INFO]
[INFO]
[INFO] --------< com.fasterxml.jackson.datatype:jackson-datatype-jdk8 >--------
[INFO] Building Jackson datatype: jdk8 2.14.2                             [3/4]
[INFO]   from datatypes/pom.xml
[INFO] -------------------------------[ bundle ]-------------------------------
[INFO]
[INFO] --- build-helper:3.3.0:add-source (add-generated-sources) @ jackson-datatype-jdk8 ---
[INFO] Source directory: /<<PKGBUILDDIR>>/datatypes/target/generated-sources added.
[INFO]
[INFO] --- replacer:1.5.3:replace (process-packageVersion) @ jackson-datatype-jdk8 ---
[INFO] Replacement run on 1 file.
[INFO]
[INFO] --- build-helper:3.3.0:add-resource (add-resource) @ jackson-datatype-jdk8 ---
[INFO]
[INFO] --- resources:3.3.1:resources (default-resources) @ jackson-datatype-jdk8 ---
[INFO] Copying 1 resource from src/main/resources to target/classes
[INFO] Copying 0 resource from . to target/classes/META-INF
[INFO]
[INFO] --- compiler:3.13.0:compile (default-compile) @ jackson-datatype-jdk8 ---
[WARNING]  Parameter 'optimize' (user property 'maven.compiler.optimize') is deprecated: This property is a no-op in javac.
[INFO] Recompiling the module because of changed source code.
[INFO] Compiling 22 source files with javac [debug:lines,source,vars optimize deprecation target 1.8] to target/classes
[WARNING] bootstrap class path is not set in conjunction with -source 8
  not setting the bootstrap class path may lead to class files that cannot run on JDK 8
    --release 8 is recommended instead of -source 8 -target 1.8 because it sets the bootstrap class path automatically
[WARNING] source value 8 is obsolete and will be removed in a future release
[WARNING] target value 8 is obsolete and will be removed in a future release
[WARNING] To suppress warnings about obsolete options, use -Xlint:-options.
[INFO]
[INFO] --- resources:3.3.1:testResources (default-testResources) @ jackson-datatype-jdk8 ---
[INFO] skip non existing resourceDirectory /<<PKGBUILDDIR>>/datatypes/src/test/resources
[INFO]
[INFO] --- compiler:3.13.0:testCompile (default-testCompile) @ jackson-datatype-jdk8 ---
[WARNING]  Parameter 'optimize' (user property 'maven.compiler.optimize') is deprecated: This property is a no-op in javac.
[INFO] Recompiling the module because of changed dependency.
[INFO] Compiling 21 source files with javac [debug:lines,source,vars optimize deprecation target 1.8] to target/test-classes
[WARNING] bootstrap class path is not set in conjunction with -source 8
  not setting the bootstrap class path may lead to class files that cannot run on JDK 8
    --release 8 is recommended instead of -source 8 -target 1.8 because it sets the bootstrap class path automatically
[WARNING] source value 8 is obsolete and will be removed in a future release
[WARNING] target value 8 is obsolete and will be removed in a future release
[WARNING] To suppress warnings about obsolete options, use -Xlint:-options.
[WARNING] /<<PKGBUILDDIR>>/datatypes/src/test/java/com/fasterxml/jackson/datatype/jdk8/OptionalNumbersTest.java:[45,65] disable(com.fasterxml.jackson.databind.MapperFeature...) in com.fasterxml.jackson.databind.ObjectMapper has been deprecated
[WARNING] /<<PKGBUILDDIR>>/datatypes/src/test/java/com/fasterxml/jackson/datatype/jdk8/StreamTestBase.java:[24,73] none() in org.junit.rules.ExpectedException has been deprecated
[WARNING] /<<PKGBUILDDIR>>/datatypes/src/test/java/com/fasterxml/jackson/datatype/jdk8/OptionalBasicTest.java:[172,50] configureAbsentsAsNulls(boolean) in com.fasterxml.jackson.datatype.jdk8.Jdk8Module has been deprecated
[INFO]
[INFO] --- surefire:2.22.3:test (default-test) @ jackson-datatype-jdk8 ---
[INFO]
[INFO] -------------------------------------------------------
[INFO]  T E S T S
[INFO] -------------------------------------------------------
[INFO] Running com.fasterxml.jackson.datatype.jdk8.ContextualOptional17Test
[INFO] Tests run: 1, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.184 s - in com.fasterxml.jackson.datatype.jdk8.ContextualOptional17Test
[INFO] Running com.fasterxml.jackson.datatype.jdk8.OptionalnclusionTest
[INFO] Tests run: 9, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.026 s - in com.fasterxml.jackson.datatype.jdk8.OptionalnclusionTest
[INFO] Running com.fasterxml.jackson.datatype.jdk8.JDKSerializabilityTest
[INFO] Tests run: 1, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.07 s - in com.fasterxml.jackson.datatype.jdk8.JDKSerializabilityTest
[INFO] Running com.fasterxml.jackson.datatype.jdk8.CreatorTest
[INFO] Tests run: 2, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.008 s - in com.fasterxml.jackson.datatype.jdk8.CreatorTest
[INFO] Running com.fasterxml.jackson.datatype.jdk8.LongStreamSerializerTest
[ERROR] Tests run: 7, Failures: 0, Errors: 2, Skipped: 0, Time elapsed: 0.037 s <<< FAILURE! - in com.fasterxml.jackson.datatype.jdk8.LongStreamSerializerTest
[ERROR] testMultiElements(com.fasterxml.jackson.datatype.jdk8.LongStreamSerializerTest)  Time elapsed: 0.004 s  <<< ERROR!
com.fasterxml.jackson.databind.JsonMappingException:
Numeric value (-9223372036854775808) out of range of long (-9223372036854775808 - 9223372036854775807)
 at [Source: (byte[])"[-9223372036854775808,9223372036854775807,1,0,6,-3]"; line: 1, column: 22] (through reference chain: long[][0])
	at com.fasterxml.jackson.datatype.jdk8.LongStreamSerializerTest.roundTrip(LongStreamSerializerTest.java:77)
	at com.fasterxml.jackson.datatype.jdk8.LongStreamSerializerTest.testMultiElements(LongStreamSerializerTest.java:36)
Caused by: com.fasterxml.jackson.core.exc.InputCoercionException:
Numeric value (-9223372036854775808) out of range of long (-9223372036854775808 - 9223372036854775807)
 at [Source: (byte[])"[-9223372036854775808,9223372036854775807,1,0,6,-3]"; line: 1, column: 22]
	at com.fasterxml.jackson.datatype.jdk8.LongStreamSerializerTest.roundTrip(LongStreamSerializerTest.java:77)
	at com.fasterxml.jackson.datatype.jdk8.LongStreamSerializerTest.testMultiElements(LongStreamSerializerTest.java:36)

[ERROR] testLongStreamCloses(com.fasterxml.jackson.datatype.jdk8.LongStreamSerializerTest)  Time elapsed: 0 s  <<< ERROR!
com.fasterxml.jackson.databind.JsonMappingException:
Numeric value (-9223372036854775808) out of range of long (-9223372036854775808 - 9223372036854775807)
 at [Source: (byte[])"[-9223372036854775808,9223372036854775807,1,0,6,-3]"; line: 1, column: 22] (through reference chain: long[][0])
	at com.fasterxml.jackson.datatype.jdk8.LongStreamSerializerTest.roundTrip(LongStreamSerializerTest.java:77)
	at com.fasterxml.jackson.datatype.jdk8.LongStreamSerializerTest.testLongStreamCloses(LongStreamSerializerTest.java:42)
Caused by: com.fasterxml.jackson.core.exc.InputCoercionException:
Numeric value (-9223372036854775808) out of range of long (-9223372036854775808 - 9223372036854775807)
 at [Source: (byte[])"[-9223372036854775808,9223372036854775807,1,0,6,-3]"; line: 1, column: 22]
	at com.fasterxml.jackson.datatype.jdk8.LongStreamSerializerTest.roundTrip(LongStreamSerializerTest.java:77)
	at com.fasterxml.jackson.datatype.jdk8.LongStreamSerializerTest.testLongStreamCloses(LongStreamSerializerTest.java:42)

[INFO] Running com.fasterxml.jackson.datatype.jdk8.OptionalBooleanTest
[INFO] Tests run: 1, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.001 s - in com.fasterxml.jackson.datatype.jdk8.OptionalBooleanTest
[INFO] Running com.fasterxml.jackson.datatype.jdk8.OptionalBasicTest
[INFO] Tests run: 20, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.042 s - in com.fasterxml.jackson.datatype.jdk8.OptionalBasicTest
[INFO] Running com.fasterxml.jackson.datatype.jdk8.OptionalMergeTest
[INFO] Tests run: 1, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.008 s - in com.fasterxml.jackson.datatype.jdk8.OptionalMergeTest
[INFO] Running com.fasterxml.jackson.datatype.jdk8.StreamSerializerTest
[INFO] Tests run: 10, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.042 s - in com.fasterxml.jackson.datatype.jdk8.StreamSerializerTest
[INFO] Running com.fasterxml.jackson.datatype.jdk8.DoubleStreamSerializerTest
[INFO] Tests run: 7, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.005 s - in com.fasterxml.jackson.datatype.jdk8.DoubleStreamSerializerTest
[INFO] Running com.fasterxml.jackson.datatype.jdk8.OptionalTest
[INFO] Tests run: 13, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.012 s - in com.fasterxml.jackson.datatype.jdk8.OptionalTest
[INFO] Running com.fasterxml.jackson.datatype.jdk8.SchemaVisitorTest
[INFO] Tests run: 3, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.001 s - in com.fasterxml.jackson.datatype.jdk8.SchemaVisitorTest
[INFO] Running com.fasterxml.jackson.datatype.jdk8.PolymorphicOptionalTest
[INFO] Tests run: 1, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0 s - in com.fasterxml.jackson.datatype.jdk8.PolymorphicOptionalTest
[INFO] Running com.fasterxml.jackson.datatype.jdk8.TestConfigureAbsentsAsNulls
[INFO] Tests run: 7, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.015 s - in com.fasterxml.jackson.datatype.jdk8.TestConfigureAbsentsAsNulls
[INFO] Running com.fasterxml.jackson.datatype.jdk8.OptionalWithEmptyTest
[INFO] Tests run: 2, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.001 s - in com.fasterxml.jackson.datatype.jdk8.OptionalWithEmptyTest
[INFO] Running com.fasterxml.jackson.datatype.jdk8.OptionalNumbersTest
[ERROR] Tests run: 20, Failures: 0, Errors: 1, Skipped: 0, Time elapsed: 0.018 s <<< FAILURE! - in com.fasterxml.jackson.datatype.jdk8.OptionalNumbersTest
[ERROR] testOptionalLongPresent(com.fasterxml.jackson.datatype.jdk8.OptionalNumbersTest)  Time elapsed: 0 s  <<< ERROR!
com.fasterxml.jackson.core.exc.InputCoercionException:
Numeric value (9223372036854775807) out of range of long (-9223372036854775808 - 9223372036854775807)
 at [Source: (byte[])"9223372036854775807"; line: 1, column: 20]
	at com.fasterxml.jackson.datatype.jdk8.OptionalNumbersTest.testOptionalLongPresent(OptionalNumbersTest.java:111)

[INFO] Running com.fasterxml.jackson.datatype.jdk8.TestOptionalWithPolymorphic
[INFO] Tests run: 4, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.009 s - in com.fasterxml.jackson.datatype.jdk8.TestOptionalWithPolymorphic
[INFO] Running com.fasterxml.jackson.datatype.jdk8.OptionalUnwrappedTest
[INFO] Tests run: 3, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.01 s - in com.fasterxml.jackson.datatype.jdk8.OptionalUnwrappedTest
[INFO] Running com.fasterxml.jackson.datatype.jdk8.IntStreamSerializerTest
[INFO] Tests run: 7, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.01 s - in com.fasterxml.jackson.datatype.jdk8.IntStreamSerializerTest
[INFO]
[INFO] Results:
[INFO]
[ERROR] Errors:
[ERROR]   LongStreamSerializerTest.testLongStreamCloses:42->StreamTestBase.assertClosesOnSuccess:61->roundTrip:77 » JsonMapping
[ERROR]   LongStreamSerializerTest.testMultiElements:36->roundTrip:77 » JsonMapping Nume...
[ERROR]   OptionalNumbersTest.testOptionalLongPresent:111 » InputCoercion Numeric value ...
[INFO]
[ERROR] Tests run: 119, Failures: 0, Errors: 3, Skipped: 0
[INFO]
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Summary for Jackson modules: Java 8 2.14.2:
[INFO]
[INFO] Jackson modules: Java 8 ............................ SUCCESS [  0.121 s]
[INFO] Jackson-module-parameter-names ..................... SUCCESS [ 32.284 s]
[INFO] Jackson datatype: jdk8 ............................. FAILURE [ 31.748 s]
[INFO] Jackson datatype: JSR310 ........................... SKIPPED
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time:  01:04 min
[INFO] Finished at: 2026-05-01T21:14:17Z
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.apache.maven.plugins:maven-surefire-plugin:2.22.3:test (default-test) on project jackson-datatype-jdk8: There are test failures.
[ERROR]
[ERROR] Please refer to /<<PKGBUILDDIR>>/datatypes/target/surefire-reports for the individual test results.
[ERROR] Please refer to dump files (if any exist) [date].dump, [date]-jvmRun[N].dump and [date].dumpstream.
[ERROR] -> [Help 1]
[ERROR]
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR]
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoFailureException
[ERROR]
[ERROR] After correcting the problems, you can resume the build with the command
[ERROR]   mvn <args> -rf :jackson-datatype-jdk8
dh_auto_test: error: /usr/lib/jvm/default-java/bin/java -noverify -cp /usr/share/maven/boot/plexus-classworlds-2.x.jar -Dmaven.home=/usr/share/maven -Dmaven.multiModuleProjectDirectory=/<<BUILDDIR>>/jackson-modules-java8-2.14.2\+ds2 -Dclassworlds.conf=/etc/maven/m2-debian.conf -Dproperties.file.manual=/<<BUILDDIR>>/jackson-modules-java8-2.14.2\+ds2/debian/maven.properties org.codehaus.plexus.classworlds.launcher.Launcher -s/etc/maven/settings-debian.xml -Ddebian.dir=/<<BUILDDIR>>/jackson-modules-java8-2.14.2\+ds2/debian -Dmaven.repo.local=/<<BUILDDIR>>/jackson-modules-java8-2.14.2\+ds2/debian/maven-repo --batch-mode test returned exit code 1
make: *** [debian/rules:4: binary] Error 25
dpkg-buildpackage: error: debian/rules binary subprocess failed with exit status 2
--------------------------------------------------------------------------------

#1135411#26

Date:: 2026-10-03 02:29:59 UTC

From:

To:

Hi,

I reassigned #1135411 to jackson-core: it comes from CVE-2025-52999.patch
(https://security-tracker.debian.org/tracker/CVE-2025-52999), which
backports the 2.15 number parsing but not the inLongRange() check from
https://github.com/FasterXML/jackson-core/pull/865. Since then every
integer with 19 digits, Long.MIN_VALUE and Long.MAX_VALUE included, fails
with "Numeric value (...) out of range of long". The build skips the
tests, so nobody noticed.

While fixing it I found that the same backport has two more gaps:

- Limits set on a JsonFactory are ignored; the parsers always use the
  defaults.
- The async parser does not enforce maxNumberLength. That is
  CVE-2026-18401 and its follow-up CVE-2026-68494
  (https://security-tracker.debian.org/tracker/CVE-2026-18401,
https://security-tracker.debian.org/tracker/CVE-2026-68494). The
  tracker marks jackson-core not affected because upstream 2.14.1 has no
  number length limit, but Debian's 2.14.1-2 does, from the
  CVE-2025-52999 backport, and its async parser accepts over-long
  numbers. I checked that in unstable.

And #1148826 (CVE-2026-89425,
https://security-tracker.debian.org/tracker/CVE-2026-89425) affects
2.14.1 as well: the DataInput parser reads the whole invalid token into
the error message, so a large one runs out of memory.

One merge request fixes all of it, each as its own patch backported from
upstream: https://salsa.debian.org/java-team/jackson-core/-/merge_requests/8
With it and the jackson-databind fix for #1139511, jackson-modules-java8
builds again and its tests pass.

trixie (2.14.1-2~deb13u1) and bookworm (2.14.1-2~deb12u1) carry the same
patch, so they should have the same problems at run time (I tested
unstable only). Copying the security team for that.

Thanks,
Juan

#1135411#31

Date:: 2026-10-15 13:07:08 UTC

From:

To:

We believe that the bug you reported is fixed in the latest version of
jackson-core, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1135411@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Emmanuel Bourg <ebourg@apache.org> (supplier of updated jackson-core package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Thu, 15 Oct 2026 11:37:01 +0200
Source: jackson-core
Architecture: source
Version: 2.18.11-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org>
Changed-By: Emmanuel Bourg <ebourg@apache.org>
Closes: 1135411 1148826
Changes:
 jackson-core (2.18.11-1) unstable; urgency=medium
 .
   * Team upload.
   * New upstream release
     - Fixes CVE-2026-89425: the DataInput parser now caps the length of
       the token quoted in error messages (Closes: #1148826)
     - 19-digit integers are no longer rejected as out of range of long
       (Closes: #1135411)
     - Removed the patches, no longer needed
     - New build dependency on libfastdoubleparser-java
     - New build dependency on libassertj-core-java
     - Depend on junit5 instead of junit4
     - Updated the parent POMs installed with the package
     - Updated the Maven rules
   * Excluded the Maven wrapper from the source tarball
   * Enabled the test suite
   * Removed the Priority field
   * Removed the Rules-Requires-Root field
   * Converted debian/watch to the version 5 format
Checksums-Sha1:
 61590875839e59a6f674ae1bad2955a385c25c3a 2318 jackson-core_2.18.11-1.dsc
 2b8940a61bc87051ef7f37a59bfbeed04b2d2c30 752152 jackson-core_2.18.11.orig.tar.xz
 74bc3c03ea0775f41ea92b03cbfddd43fbadcef4 14620 jackson-core_2.18.11-1.debian.tar.xz
 f1836d8411ed2dd72183a482d0a4762f1c290aa4 15089 jackson-core_2.18.11-1_source.buildinfo
Checksums-Sha256:
 49e6e337081afd61f221da9087db28697583d18c6666fb12585e48157501cc78 2318 jackson-core_2.18.11-1.dsc
 3f60b8afd8c0924383d408e82561c4fa0ee24df8b7566a8399396afd74f743e2 752152 jackson-core_2.18.11.orig.tar.xz
 cc15f72d3737e764ee25f83b90fdbf7defb3254582040534e3ab9a71308ab5eb 14620 jackson-core_2.18.11-1.debian.tar.xz
 efde5b6a2cd4c27939262a612f13002503dc25c35648b2e4910d64fb42b61dde 15089 jackson-core_2.18.11-1_source.buildinfo
Files:
 d8752ebc683984e97dee3c885744b927 2318 java optional jackson-core_2.18.11-1.dsc
 7d526d76391c142bd5a7ebf332fe5b05 752152 java optional jackson-core_2.18.11.orig.tar.xz
 0974a7cc00a531134e2e631ff787b74d 14620 java optional jackson-core_2.18.11-1.debian.tar.xz
 9cdcc8edaf69d6c27ca5b9249e8b7c35 15089 java optional jackson-core_2.18.11-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQJGBAEBCgAwFiEEuM5N4hCA3PkD4WxA9RPEGeS50KwFAmrQyOESHGVib3VyZ0Bh
cGFjaGUub3JnAAoJEPUTxBnkudCsKooP/jQi6greUNRx95Wn0jIdBQF8it1OnpGb
lHeu2LlIWLjg5YaZIQWJ4rVSdcALu/NMTkq4xV3C8S2OUEr8xjT8npLENcY25/Nd
lsCkVk44YxfdOldgDzbLOfUCOVQdHyhKpRppCdVLKnv+09XsTX12l0viA5OOxNi0
klKApWrM7F5s8P5YE9un9HoKfIgqA1CM2/XdSR1CvLKdDh/0fdbSg4uXYbIt4QxW
CajMbulykJpMXyw2Op4KzW99gVT3X6GL0YqTKRSlxQptJAr4X4nyLARlPMK5KrLv
8Dj/Oh+8Fiv+fxeBUUCyqFTR152Aduz26r6dajhJR2/swki99sR+Pw5YmxBXAlEf
7/AxUdc4AGfY7Hd8294zht6o6euc0aFu7cbHa1U373x1/oTDaLjyRyESM0x9f+WD
yaGtFb4FYw5WdxzkDInNA1r33NZp/c050k9hJwwNt57cSg67g0oW0ITXSO6PfRhh
efn8oEbkneIjhtiX/paXMn5g8vuEMIjDXeCoLqg+GacMp1b1UMYNG3XpktE5ZMc3
AkorqwFVgBkLbtHnEeUW+OyVIgJ3o5wquAex+xm7D0fOlPmzKzvvZlGxZpLOWkB0
Q0HJtwGDfd2PoW4yQj7ss1iB4XltJNIlq8TZCuqVeaAa900eKr4eRPoYjjAwXEQN
7p1xGZSQEUx8
=XctJ
-----END PGP SIGNATURE-----

#1135411 jackson-modules-java8: FTBFS: Numeric value (9223372036854775807) out of range of long (-9223372036854775808 - 9223372036854775807) #1135411

Just Reply to ...

Reply to submitter ...

Send control command (Silently)

Set Architecture Tags (Silently)