4.8.7
(fix): Fix undiscriminated union deserialization when one member has all-optional fields.
Previously, an all-optional object variant (e.g. PayMethodCloud) could greedily
consume a payload intended for a more specific variant with required fields (e.g.
Check requiring achHolder), because Jackson’s @JsonIgnoreProperties(ignoreUnknown=true)
silently accepts any JSON object when all fields are optional. The deserializer now
emits guarded members (those with at least one required field) before unguarded
(all-optional) members, ensuring the more specific match wins.
4.8.6
(chore): Patch Java SDK generator container CVEs flagged in the AWS ECR / grype
scan. Patch npm’s bundled brace-expansion@5.0.4 -> 5.0.5 (GHSA-f886-m6hf-6m8v)
via tarball replacement so the published image no longer ships the vulnerable
bundled JS dependency that grype flags on dev/java-sdk-generator.
