Use the SDK's Reactor and Jackson 2 annotations in the Spring Boot modules

Boot 4.1.0's BOM still supplied reactor-core 3.8.6, and importing Jackson 3's BOM
first made jackson-annotations 2.21. Import the Reactor BOM and Jackson 2's BOM
first, as the parent does. The starter also pins logback to Boot's 1.5.x, as the
autoconfigure module does, so logback-classic and logback-core match.

Author: Mark Pollack

acp-spring-boot-autoconfigure/pom.xml

@@ -53,12 +53,12 @@
                 <type>pom</type>
                 <scope>import</scope>
             </dependency>
-            <!-- The SDK's Jackson, not Boot 4.1.0's 2.21.4 / 3.1.4 (CVE-2026-89407, -89425, -68497,
+            <!-- The SDK's Reactor and Jackson (Jackson 2's BOM first, so jackson-annotations is 2.x's, as in the parent), not Boot 4.1.0's 2.21.4 / 3.1.4 (CVE-2026-89407, -89425, -68497,
                  -91776, -91777): the parent's Jackson BOM imports do not win over Boot's here. -->
             <dependency>
-                <groupId>tools.jackson</groupId>
-                <artifactId>jackson-bom</artifactId>
-                <version>${jackson3.version}</version>
+                <groupId>io.projectreactor</groupId>
+                <artifactId>reactor-bom</artifactId>
+                <version>${reactor.version}</version>
                 <type>pom</type>
                 <scope>import</scope>
             </dependency>
@@ -69,6 +69,13 @@
                 <type>pom</type>
                 <scope>import</scope>
             </dependency>
+            <dependency>
+                <groupId>tools.jackson</groupId>
+                <artifactId>jackson-bom</artifactId>
+                <version>${jackson3.version}</version>
+                <type>pom</type>
+                <scope>import</scope>
+            </dependency>
             <dependency>
                 <groupId>org.springframework.boot</groupId>
                 <artifactId>spring-boot-dependencies</artifactId>

acp-spring-boot-starter/pom.xml

@@ -18,6 +18,8 @@
 
     <properties>
         <spring-boot.version>4.1.0</spring-boot.version>
+        <!-- Boot 4.1's logback-core is 1.5.x; the parent's logback-classic 1.6 does not run on it. -->
+        <logback.version>1.5.34</logback.version>
         <!-- No code: nothing to cover. -->
         <jacoco.skip>true</jacoco.skip>
     </properties>
@@ -41,12 +43,12 @@
                 <type>pom</type>
                 <scope>import</scope>
             </dependency>
-            <!-- The SDK's Jackson, not Boot 4.1.0's 2.21.4 / 3.1.4 (CVE-2026-89407, -89425, -68497,
+            <!-- The SDK's Reactor and Jackson (Jackson 2's BOM first, so jackson-annotations is 2.x's, as in the parent), not Boot 4.1.0's 2.21.4 / 3.1.4 (CVE-2026-89407, -89425, -68497,
                  -91776, -91777): the parent's Jackson BOM imports do not win over Boot's here. -->
             <dependency>
-                <groupId>tools.jackson</groupId>
-                <artifactId>jackson-bom</artifactId>
-                <version>${jackson3.version}</version>
+                <groupId>io.projectreactor</groupId>
+                <artifactId>reactor-bom</artifactId>
+                <version>${reactor.version}</version>
                 <type>pom</type>
                 <scope>import</scope>
             </dependency>
@@ -57,6 +59,13 @@
                 <type>pom</type>
                 <scope>import</scope>
             </dependency>
+            <dependency>
+                <groupId>tools.jackson</groupId>
+                <artifactId>jackson-bom</artifactId>
+                <version>${jackson3.version}</version>
+                <type>pom</type>
+                <scope>import</scope>
+            </dependency>
             <dependency>
                 <groupId>org.springframework.boot</groupId>
                 <artifactId>spring-boot-dependencies</artifactId>