From d57709257a27aea9c2fe1fa76315c72fae2042f1 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 2 Mar 2026 00:15:38 +0000
Subject: [PATCH 1/2] Bump com.fasterxml.jackson.core:jackson-core from 2.15.4
 to 2.18.6

Bumps [com.fasterxml.jackson.core:jackson-core](https://github.com/FasterXML/jackson-core) from 2.15.4 to 2.18.6.
- [Commits](https://github.com/FasterXML/jackson-core/compare/jackson-core-2.15.4...jackson-core-2.18.6)

---
updated-dependencies:
- dependency-name: com.fasterxml.jackson.core:jackson-core
  dependency-version: 2.18.6
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 825f7a947..57d70d883 100644
--- a/pom.xml
+++ b/pom.xml
@@ -202,7 +202,7 @@
         <!-- this property makes sure NetBeans 6.8+ picks up some formatting rules from checkstyle -->
         <netbeans.checkstyle.format>true</netbeans.checkstyle.format>
 
-        <jackson.version>2.15.4</jackson.version>
+        <jackson.version>2.18.6</jackson.version>
         <slf4j.version>2.0.17</slf4j.version>
         <swagger.version>1.6.11</swagger.version>
         <rhino.version>1.7.15.1</rhino.version>

From 8b31f8a0ed97ca2f2e4a3bea857305e0e214ea95 Mon Sep 17 00:00:00 2001
From: maximthomas <maxim.thomas@gmail.com>
Date: Mon, 2 Mar 2026 10:16:58 +0300
Subject: [PATCH 2/2] Replace deprecated JavaType.forcedNarrowBy with
 TypeFactory.constructGeneralizedType

---
 .../core/config/ClassNameFallbackPropertyTypeDeserializer.java | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/commons/selfservice/core/src/main/java/org/forgerock/selfservice/core/config/ClassNameFallbackPropertyTypeDeserializer.java b/commons/selfservice/core/src/main/java/org/forgerock/selfservice/core/config/ClassNameFallbackPropertyTypeDeserializer.java
index b7bbfd65f..d2832fa77 100644
--- a/commons/selfservice/core/src/main/java/org/forgerock/selfservice/core/config/ClassNameFallbackPropertyTypeDeserializer.java
+++ b/commons/selfservice/core/src/main/java/org/forgerock/selfservice/core/config/ClassNameFallbackPropertyTypeDeserializer.java
@@ -12,6 +12,7 @@
  * information: "Portions copyright [year] [name of copyright owner]".
  *
  * Copyright 2015 ForgeRock AS.
+ * Portions copyright 2020-2026 3A Systems LLC.
  */
 package org.forgerock.selfservice.core.config;
 
@@ -79,7 +80,7 @@ protected Object  _deserializeTypedUsingDefaultImpl(JsonParser jsonParser,
                     // ensure the type we found is assignable to the base type requested by deserialization;
                     // typically this is the interface or base class
                     if (_baseType != null && _baseType.getClass() == type.getClass()) {
-                        type = _baseType.forcedNarrowBy(type.getRawClass());
+                        type = context.getTypeFactory().constructSpecializedType(_baseType, type.getRawClass());
                     }
                     // find an appropriate deserializer for this type and deserialize
                     JsonDeserializer<Object> deser = context.findContextualValueDeserializer(type, _property);