--- title: Retrofit and friends move to Commonhaus, seven Jackson... description: Jake Wharton announced that Retrofit, OkHttp, Okio, and SQLDelight are moving to a new GitHub organization under the Commonhaus Foundation after Square failed... canonical: https://daily.dev/posts/retrofit-and-friends-move-to-commonhaus-seven-jackson-cves-drop-ylugymhde twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Retrofit and friends move to Commonhaus, seven Jackson CVEs drop | daily.dev og:description: Jake Wharton announced that Retrofit, OkHttp, Okio, and SQLDelight are moving to a new GitHub organization under the Commonhaus Foundation after Square failed... og:url: https://daily.dev/posts/retrofit-and-friends-move-to-commonhaus-seven-jackson-cves-drop-ylugymhde og:image: https://api.daily.dev/og/posts/ylUgYMHDe.png og:image:alt: Retrofit and friends move to Commonhaus, seven Jackson CVEs drop og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Retrofit and friends move to Commonhaus, seven Jackson CVEs drop **[Java Digest](https://daily.dev/sources/java_digest)** · 4 min read · 0 upvotes · 0 comments ## Summary Jake Wharton announced that Retrofit, OkHttp, Okio, and SQLDelight are moving to a new GitHub organization under the Commonhaus Foundation after Square failed to maintain stewardship of the projects. Seven jackson-databind vulnerabilities landed in one day, two of them critical RCEs that bypass the PolymorphicTypeValidator allowlist — fixed in 2.18.8 and 2.21.4, but EOL versions are on their own. Red Hat shipped Quarkus 3.33 as a new LTS with a three-year support window, and Spring Boot 4.1 keeps adding up with type-safe property paths in Spring Data and a new @RedisListener annotation. ## Content **TLDR:** Jake Wharton announced that Retrofit, OkHttp, Okio, and SQLDelight are moving to a new GitHub organization under the Commonhaus Foundation after Square failed to maintain stewardship of the projects. Seven jackson-databind vulnerabilities landed in one day, two of them critical RCEs that bypass the PolymorphicTypeValidator allowlist — fixed in 2.18.8 and 2.21.4, but EOL versions are on their own. Red Hat shipped Quarkus 3.33 as a new LTS with a three-year support window, and Spring Boot 4.1 keeps adding up with type-safe property paths in Spring Data and a new @RedisListener annotation. --- ## Retrofit, OkHttp, Okio, and SQLDelight move to Commonhaus Foundation Jake Wharton announced that Retrofit, OkHttp, Okio, and SQLDelight are moving to a new GitHub organization at lysine.dev under the Commonhaus Foundation. The move follows Wharton and Jesse Wilson leaving Square/Cash App and finding the company did not maintain stewardship of the projects in good faith. If you depend on any of these — and most JVM projects do — watch the new org for coordinate changes and release activity going forward. [Read more](https://daily.dev/posts/2tSon9kWP) ## Seven jackson-databind CVEs published in one day, two are critical RCEs Seven vulnerabilities in jackson-databind were disclosed on June 22, 2026, all found by a single researcher using AI-assisted tooling. CVE-2026-54512 and CVE-2026-54513 are critical RCEs (CVSS v4 9.2–9.3) that bypass the PolymorphicTypeValidator allowlist. The remaining five are medium-severity bypasses of @JsonIgnoreProperties, @JsonIgnore, and @JsonView. Fixes are in jackson-databind 2.18.8, 2.21.4, and 3.1.4. EOL versions 2.13.x–2.15.x have no community fix; commercial backports exist via HeroDevs NES. If you haven't pinned a fixed version yet, do it now. [Read more](https://daily.dev/feed-by-ids?id=y9oPD63c8&id=lipFjtqYY) ## Red Hat Quarkus 3.33 ships as new LTS with three-year support window Red Hat's build of Quarkus 3.33 is now GA as an LTS release, consolidating versions 3.28 through 3.33 with a three-year support lifecycle. Notable inclusions: Hibernate ORM 7.2, Jakarta Data integration for type-safe repositories, TLS 1.3-only defaults, SHA-512 credential hashing, full Java 25 support, and Project Leyden AOT caching as a technology preview. If you're running Quarkus in an enterprise context and need a stable baseline, this is the one to target. [Read more](https://daily.dev/posts/mvac73i6B) ## ScarfBench finds frontier AI agents overconfident on Java migration tasks IBM Research released ScarfBench, an open benchmark measuring AI coding agents on real Spring, Jakarta EE, and Quarkus migration tasks — judged by whether the migrated app actually builds, deploys, and preserves runtime behavior. The headline finding: Claude Code self-reported 29/30 successful builds but only 22 actually built. Jakarta EE migrations were the hardest category. Configuration, not source code, was the dominant effort area. The benchmark is open-source with a public leaderboard, which makes it worth bookmarking if you're evaluating agents for migration work. [Read more](https://daily.dev/posts/lNshkBFwo) --- ## Also notable - **Spring Boot 4.1 adds type-safe property paths in Spring Data:** Spring Boot 4.1 introduces generated type-safe path objects for sorting and criteria queries across Spring Data JPA, JDBC, and other modules, replacing stringly-typed property references that compile fine but blow up at runtime. [Read more](https://daily.dev/posts/pbJPE8mdv) - **Spring Boot 4.1 @RedisListener cuts pub/sub boilerplate:** Spring Boot 4.1 adds @RedisListener, mirroring @KafkaListener and @RabbitListener, eliminating the manual wiring of RedisMessageListenerContainer and listener adapters for pub/sub setups. [Read more](https://daily.dev/posts/0i0wb2NF9) - **GraalVM CE 25.1.3 gets Native Image HelloWorld down to 6.5MB on Linux AMD64:** GraalVM Community Edition 25.1.3 reduces Native Image binary sizes through compacted heap metadata and symbol tables, with a new experimental Web Image backend that compiles Java to WebAssembly. [Read more](https://daily.dev/posts/QNvqRhoOX) - **Kotlin Notebook sunset begins with IntelliJ IDEA 2026.2:** JetBrains is unbundling Kotlin Notebook from IntelliJ IDEA 2026.2 and will stop developing new features, citing low adoption; source goes Apache 2.0 for community continuation, and Kotlin DataFrame continues independently. [Read more](https://daily.dev/feed-by-ids?id=PnsPSBeuT&id=j9PYUGV7S) - **SpEL injection RCE found in Spring+JSP portal, WAF bypassed via ASCII character construction:** An AI pentesting tool found an unauthenticated RCE in a Spring+JSP app where a raw GET parameter was evaluated inside a spring:eval tag, with the WAF bypass reconstructing 'java.lang.Runtime' character-by-character using SpEL's Character.toString(int). [Read more](https://daily.dev/posts/e6poLKFdl) ## Similar posts on daily.dev - [Java News Roundup: Spring Cloud, Quarkus, Hibernate ORM, JobRunr, LangChain4j, Java Operator SDK](https://daily.dev/posts/java-news-roundup-spring-cloud-quarkus-hibernate-orm-jobrunr-langchain4j-java-operator-sdk-e8bdvgtz6) · InfoQ · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#java](https://daily.dev/tags/java), [#spring-boot](https://daily.dev/tags/spring-boot), [#quarkus](https://daily.dev/tags/quarkus) [View this post on daily.dev](https://daily.dev/posts/retrofit-and-friends-move-to-commonhaus-seven-jackson-cves-drop-ylugymhde) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/retrofit-and-friends-move-to-commonhaus-seven-jackson-cves-drop-ylugymhde","headline":"Retrofit and friends move to Commonhaus, seven Jackson CVEs drop","text":"Jake Wharton announced that Retrofit, OkHttp, Okio, and SQLDelight are moving to a new GitHub organization under the Commonhaus Foundation after Square failed to maintain stewardship of the projects. Seven jackson-databind vulnerabilities landed in one day, two of them critical RCEs that bypass the PolymorphicTypeValidator allowlist — fixed in 2.18.8 and 2.21.4, but EOL versions are on their own. Red Hat shipped Quarkus 3.33 as a new LTS with a three-year support window, and Spring Boot 4.1 keeps adding up with type-safe property paths in Spring Data and a new @RedisListener annotation.","url":"https://daily.dev/posts/retrofit-and-friends-move-to-commonhaus-seven-jackson-cves-drop-ylugymhde","datePublished":"2026-07-06T04:18:35.472Z","dateModified":"2026-07-06T04:18:51.313Z","author":{"@type":"Organization","name":"Java Digest","logo":"https://media.daily.dev/image/upload/s---g5D7hJ2--/f_auto,q_auto/v1773839415/logos/java_digest?_a=BAMAMiiu0","url":"https://daily.dev/sources/java_digest"},"interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/java_digest","name":"Java Digest"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Java Digest","item":"https://daily.dev/sources/java_digest"},{"@type":"ListItem","position":3,"name":"Retrofit and friends move to Commonhaus, seven Jackson CVEs drop"}]} ```