[RUN-4933] Bump rundeck-core to 6.2.0-20260908 (CVE-2026-19032)

[fdevans]

What

Bumps rundeck-core from 6.1.0-20260803 to 6.2.0-20260908.

Why

CVE-2026-19032: 6.1.0-20260803 pulls in a vulnerable transitive
Jackson version. 6.2.0-20260908 includes the fix.

Note

6.2.0-20260908 was published today. If the CI build here fails to
resolve it, that's expected propagation lag on the Sonatype snapshots
feed, not a real problem with this change - rerun the build once it's
synced.

[Copilot]

🔵 Needs a closer look

Upstream change details and the exact transitive Jackson fix for the specific 6.2.0-20260908 build could not be confirmed from release notes, so a human should validate the resolved dependency tree and compatibility before merging.

Pull request overview

This PR updates the plugin’s compile/test dependency on org.rundeck:rundeck-core to a newer 6.x build intended to remediate CVE-2026-19032 by pulling in a non-vulnerable transitive Jackson version. The plugin directly compiles against Rundeck core plugin APIs (com.dtolabs.rundeck.*), so even a “single-line” bump can have functional/compatibility impact.

Changes:

• Bump rundeck-core from 6.1.0-20260803 to 6.2.0-20260908 via the version catalog.

Dependency-bump review notes (per org guidance):

• What changed upstream: I was not able to find public release notes/changelog entries specifically for 6.2.0-20260908 to confirm the full set of changes or the exact Jackson version change from documentation sources.
• Repo surface used: This repo compiles against Rundeck core plugin APIs (e.g., com.dtolabs.rundeck.core.plugins.Plugin, NodeEnhancerPlugin, IModifiableNodeEntry) in both main code and tests, so changes in core/plugin API or transitive dependency behavior could affect builds and runtime behavior.
• End-user impact risk: Moderate—changes in Rundeck core can affect plugin API compatibility and runtime behavior, even if the plugin’s own code is unchanged.
• Update type: Minor update within major 6 (6.1 → 6.2), but with a date-suffixed build; treat as higher risk than a typical patch bump, especially given the security motivation.
• Verdict: Needs a manual verification step before merge (at minimum: confirm the resolved Jackson version and run the plugin test suite against this core).

File summaries

File	Description
gradle/libs.versions.toml	Updates the rundeckCore version used by Gradle’s version catalog to pull in the security-fixed core build.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[ronaveva]

LGTM