Upgrade jackson-databind 2.22.0 to 2.22.1 due to 3rdparty vulnerability CVE-2026-59889

Current Situation

Currently JS7 components Controller, Agent and JOC ship with jackson-databind version 2.19.0 (JS7 2.7.8) and 2.22.0 (JS7 2.8.4) respectively which are both affected by a 3rd party vulnerability CVE-2026-59889.

• impact: LOW
• The issue is not exploitable with the provided SOS Components (Controller, Agent, JOC Cockpit). To exploit the vulnerability an attacker needs to introduce an own crafted Java class with the mentioned annotations from the CVE description in the environment to be able to process the mentioned crafted malvolent json. Because we do not process any java-json mapping classes besides our own provided classes any classes from an attacker would need far more access right to the environment running any JS7 component to be able to change the JS7 components as a whole to even be able to accept anything from the outside.

Desired Behavior

JS7 components Controller, Agent and JOC should use jackson-databind version 2.22.1 which solves the vulnerability mentioned above even with our components not being affected.