Version 6.8.0 release

CHANGELOG.md

@@ -1,6 +1,22 @@
 # DocuSign Java Client Changelog
 See [DocuSign Support Center](https://support.docusign.com/en/releasenotes/) for Product Release Notes.
 
+## [v6.8.0] - eSignature API v2.1-25.4.01.00 - 2026-08-17
+### Changed
+
+- Added support for version v2.1-25.4.01.00 of the DocuSign ESignature API.
+- Updated the SDK release version.
+- Upgraded jackson-core from 2.17.1 to 2.18.8   and unified all Jackson artifacts under a single version property.
+- Upgraded Jersey from 3.1.6 to 3.1.11.
+- Upgraded BouncyCastle from 1.78.1 to 1.83, java-jwt from 3.4.1 to 3.19.4, org.json from 20240303 to 20251224.
+- Removed unused migbase64 dependency.
+
+### Security
+
+-   Fixed jackson-core async parser DoS vulnerabilities (GHSA-r7wm-3cxj-wff9, GHSA-72hv-8253-57qq, CVE-2026-59888) that allowed unbounded memory allocation via chunked input bypassing maxNumberLength constraints.
+
+
+
 ## [v6.7.0] - eSignature API v2.1-25.4.01.00 - 2026-07-01
 ### Changed
 

README.md

@@ -58,27 +58,26 @@ This client SDK is provided as open source, which enables you to customize its f
     <dependency>
       <groupId>com.docusign</groupId>
       <artifactId>docusign-esign-java</artifactId>
-      <version>6.7.0</version>
+      <version>6.8.0</version>
     </dependency>
     ```
 8. If your project is still open, restart Eclipse.
 
 <a id="dependencies"></a>
 ## SDK Dependencies
 This client has the following external dependencies:
-*   io.swagger.core.v3:swagger-annotations:2.2.8
-*   org.glassfish.jersey.core:jersey-client:3.1.6
-*   org.glassfish.jersey.media:jersey-media-multipart:3.1.6
-*   org.glassfish.jersey.media:jersey-media-json-jackson:3.1.6
-*   org.glassfish.jersey.inject:jersey-hk2:3.1.6
-*   com.fasterxml.jackson.jakarta.rs:jackson-jakarta-rs-base:2.14.2
-*   com.auth0:java-jwt:3.4.1
-*   org.bouncycastle:bcprov-jdk18on:1.78.1
-*   com.fasterxml.jackson.dataformat:jackson-dataformat-csv:2.14.2
-*   com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.14.2
-*   com.brsanthu:migbase64:2.2
-*   com.fasterxml.jackson.core:jackson-core:2.17.1
-*   org.json:json:20240303
+*   io.swagger.core.v3:swagger-annotations:2.2.44
+*   org.glassfish.jersey.core:jersey-client:3.1.11
+*   org.glassfish.jersey.media:jersey-media-multipart:3.1.11
+*   org.glassfish.jersey.media:jersey-media-json-jackson:3.1.11
+*   org.glassfish.jersey.inject:jersey-hk2:3.1.11
+*   com.fasterxml.jackson.core:jackson-core:2.18.8
+*   com.fasterxml.jackson.jakarta.rs:jackson-jakarta-rs-base:2.18.8
+*   com.auth0:java-jwt:3.19.4
+*   org.bouncycastle:bcprov-jdk18on:1.83
+*   com.fasterxml.jackson.dataformat:jackson-dataformat-csv:2.18.8
+*   com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.18.8
+*   org.json:json:20251224
 
 
 <a id="apiReference"></a>

pom.xml

@@ -5,7 +5,7 @@
     <artifactId>docusign-esign-java</artifactId>
     <packaging>jar</packaging>
     <name>docusign-esign-java</name>
-    <version>6.7.0</version>
+    <version>6.8.0</version>
     <url>https://developers.docusign.com</url>
     <description>The official Docusign eSignature JAVA client is based on version 2.1 of the Docusign REST API and provides libraries for JAVA application integration. It is recommended that you use this version of the library for new development.</description>
 
@@ -266,6 +266,7 @@
                     <goal>shade</goal>
                   </goals>
                   <configuration>
+                    <createDependencyReducedPom>false</createDependencyReducedPom>
                     <shadedArtifactAttached>true</shadedArtifactAttached>
                     <shadedClassifierName>shaded</shadedClassifierName>
                     <artifactSet>
@@ -351,6 +352,11 @@
             <version>${jersey-version}</version>
         </dependency>
         <!-- JSON processing: jackson -->
+        <dependency>
+            <groupId>com.fasterxml.jackson.core</groupId>
+            <artifactId>jackson-core</artifactId>
+            <version>${jackson-version}</version>
+        </dependency>
         <dependency>
             <groupId>com.fasterxml.jackson.jakarta.rs</groupId>
             <artifactId>jackson-jakarta-rs-base</artifactId>
@@ -360,12 +366,12 @@
         <dependency>
             <groupId>com.auth0</groupId>
             <artifactId>java-jwt</artifactId>
-            <version>3.4.1</version>
+            <version>3.19.4</version>
         </dependency>
         <dependency>
             <groupId>org.bouncycastle</groupId>
             <artifactId>bcprov-jdk18on</artifactId>
-            <version>1.78.1</version>
+            <version>1.83</version>
         </dependency>
         <dependency>
             <groupId>com.fasterxml.jackson.dataformat</groupId>
@@ -384,45 +390,29 @@
             <version>${junit-version}</version>
             <scope>test</scope>
         </dependency>
-        <dependency>
-            <groupId>com.brsanthu</groupId>
-            <artifactId>migbase64</artifactId>
-            <version>2.2</version>
-            <scope>compile</scope>
-        </dependency>
         <dependency>
             <groupId>jakarta.ws.rs</groupId>
             <artifactId>jakarta.ws.rs-api</artifactId>
             <version>3.1.0</version>
             <scope>compile</scope>
         </dependency>
-        <dependency>
-            <groupId>com.brsanthu</groupId>
-            <artifactId>migbase64</artifactId>
-            <version>2.2</version>
-        </dependency>
         <dependency>
             <groupId>org.junit.jupiter</groupId>
             <artifactId>junit-jupiter-api</artifactId>
-            <version>5.10.2</version>
+            <version>5.14.3</version>
             <scope>test</scope>
         </dependency>
-        <dependency>
-            <groupId>com.fasterxml.jackson.core</groupId>
-            <artifactId>jackson-core</artifactId>
-            <version>2.17.1</version>
-        </dependency>
         <dependency>
             <groupId>org.json</groupId>
             <artifactId>json</artifactId>
-            <version>20240303</version>
+            <version>20251224</version>
         </dependency>
     </dependencies>
     <properties>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
-        <swagger-core-version>2.2.8</swagger-core-version>
-            <jersey-version>3.1.6</jersey-version>
-        <jackson-version>2.14.2</jackson-version>
-        <junit-version>4.13.1</junit-version>
+        <swagger-core-version>2.2.44</swagger-core-version>
+            <jersey-version>3.1.11</jersey-version>
+        <jackson-version>2.18.8</jackson-version>
+        <junit-version>4.13.2</junit-version>
     </properties>
 </project>

src/main/java/com/docusign/esign/client/ApiClient.java

@@ -118,7 +118,7 @@ private ApiClient(String basePath, boolean allowInsecureConnections, boolean per
     String javaVersion = System.getProperty("java.version");
 
     // Set default User-Agent.
-    setUserAgent("Swagger-Codegen/v2.1/6.7.0/Java/" + javaVersion);
+    setUserAgent("Swagger-Codegen/v2.1/6.8.0/Java/" + javaVersion);
 
     // Setup authentications (key: authentication name, value: authentication).
     authentications = new HashMap<String, Authentication>();