fix(deps): bump jackson to 2.18.8 to fix CVE-2025-52999 (high-severity DoS) (#221)

## Summary
Fixes **CVE-2025-52999** (HIGH, CVSS v4 8.7) in `jackson-core` 2.14.2 —
a `StackOverflowError` when parsing deeply nested JSON that allows an
unauthenticated remote **denial of service**. The fix is jackson-core ≥
2.15.0, which introduces `StreamReadConstraints` (default max nesting
depth = 1000).

## Changes
- Bump `com.fasterxml.jackson.core:jackson-core` and `jackson-databind`
**2.14.2 → 2.18.8** (kept on the same version to avoid core/databind
drift). `jackson-annotations` follows transitively at 2.18.8.
- `shadowJar`: `exclude 'META-INF/versions/21/**'`.

### Why the shadowJar exclude is needed
jackson-core 2.15+ ships as a multi-release JAR that bundles **Java 21
(class-file major 65)** variants under `META-INF/versions/21`. The
Shadow **8.1.1** plugin relocates `com.fasterxml`, and its bundled ASM
cannot read major version 65, failing the build with `Unsupported class
file major version 65`. This is the **same failure that currently blocks
the Dependabot bump in #217** (its CI is red on all `build` jobs).

Dropping the JDK-21-only optimized classes from the **fat jar** is safe:
- The fat jar (`*-all.jar`) is **not the published Maven artifact** —
publishing uses `components.java` (the thin jar) with a normal
dependency POM.
- The base (Java 8) jackson classes remain, and multi-release fallback
covers JDK 17/21 at runtime. `versions/9/11/17` are retained.

A more thorough alternative is to modernize the Shadow plugin
(`com.gradleup.shadow`). I kept that out of this CVE fix because the
Java-8 CI matrix job constrains us to shadow ≤ 8.3.1 and the upgrade
carries package/DSL changes I couldn't validate on a Java 8 build JVM
locally. Happy to do it as a follow-up.

## Verification
- `./gradlew clean build jar compileIntegrationTestJava` → **BUILD
SUCCESSFUL**, 90/90 unit tests pass (JDK 17, Gradle 8.5).
- Confirmed in the produced `*-all.jar`: relocated jackson present,
`StreamReadConstraints` present (the CVE fix), `META-INF/versions/21`
removed, `versions/9/11/17` retained.

## Notes
- Supersedes Dependabot **#217** (which bumps only `jackson-core` and is
red in CI). This PR bumps both modules and unblocks the build. Recommend
closing #217 once this merges.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Medium Risk**
> Touches JSON parsing on all Jackson code paths and changes fat-jar
contents; behavior change is intended (nesting limits) with a targeted
Shadow workaround rather than a plugin upgrade.
> 
> **Overview**
> **Upgrades Jackson** (`jackson-core` and `jackson-databind`) from
**2.14.2 → 2.21.4** in main and test dependencies, addressing
**CVE-2025-52999** (high-severity DoS via deeply nested JSON parsing in
older `jackson-core`).
> 
> **Unblocks the Shadow fat JAR build** after the bump: `shadowJar` now
**excludes `META-INF/versions/21/**`** so Shadow 8.1.1’s relocation of
`com.fasterxml` no longer hits Java 21 (class major 65) multi-release
entries that its ASM cannot process. JDK-21-only optimized classes are
omitted from the `*-all.jar`; the published thin Maven artifact is
unchanged.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
ed1ef40. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------

Co-authored-by: joerg84 <joerg@pinecone.io>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: 3 people

build.gradle

@@ -47,8 +47,8 @@ dependencies {
     implementation 'com.google.api.grpc:proto-google-common-protos:2.14.3'
     implementation 'com.squareup.okhttp3:okhttp:4.12.0'
     implementation 'com.squareup.okhttp3:logging-interceptor:4.12.0'
-    implementation 'com.fasterxml.jackson.core:jackson-databind:2.14.2'
-    implementation 'com.fasterxml.jackson.core:jackson-core:2.14.2'
+    implementation 'com.fasterxml.jackson.core:jackson-databind:2.21.4'
+    implementation 'com.fasterxml.jackson.core:jackson-core:2.21.4'
     implementation 'com.google.code.gson:gson:2.9.1'
     implementation 'io.gsonfire:gson-fire:1.8.5'
     implementation 'org.openapitools:jackson-databind-nullable:0.2.6'
@@ -60,7 +60,7 @@ dependencies {
     testImplementation "org.hamcrest:hamcrest:2.2"
     testImplementation 'org.mockito:mockito-inline:4.8.0'
     testImplementation 'org.slf4j:slf4j-simple:2.0.5'
-    testImplementation 'com.fasterxml.jackson.core:jackson-databind:2.14.2'
+    testImplementation 'com.fasterxml.jackson.core:jackson-databind:2.21.4'
     testImplementation 'org.junit.jupiter:junit-jupiter-api:5.8.0'
     testImplementation 'org.junit.platform:junit-platform-launcher:1.8.0'
     testRuntimeOnly 'org.junit.jupiter:junit-jupiter-engine:5.8.0'
@@ -155,6 +155,12 @@ task integrationTest(type: Test) {
 import com.github.jengelman.gradle.plugins.shadow.transformers.ServiceFileTransformer
 
 shadowJar {
+    // jackson-core (2.15+) is a multi-release JAR that bundles Java 21 (class-file major 65)
+    // variants under META-INF/versions/21. The Shadow 8.1.1 plugin relocates com.fasterxml
+    // and its ASM cannot read major version 65, so it fails with
+    // "Unsupported class file major version 65". These are JDK-21-only optimizations; dropping
+    // them is safe because the base (Java 8) classes remain and multi-release fallback applies.
+    exclude 'META-INF/versions/21/**'
     relocate 'io.grpc', 'io.pinecone.shadow.io.grpc'
     relocate 'com.google', 'io.pinecone.shadow.com.google'
     relocate 'org.slf4j', 'io.pinecone.shadow.org.slf4j'