Project: jackson-databind Versions: 3.x (for earlier see VERSION-2.x) ------------------------------------------------------------------------ === Releases === ------------------------------------------------------------------------ 3.4.0 (not yet released) #6264: `@JsonIgnoreProperties` / `@JsonIncludeProperties` not honored on `@JsonAnySetter` properties (reported, fixed by @aysha-afrah26) #6303: `IllegalArgumentException` thrown by a setter is reported as a type mismatch ("Problem deserializing property ... expected type ... actual type") (reported, fixed by @caiocv18) #6413: Consolidate "effective input names" for `@JsonUnwrapped` properties (include polymorphic type id) instead of special-casing in `UnwrappedPropertyHandler` (fix by @wozhenbang2004) 3.3.1 (not yet released) #6309: NPE serializing an Enum whose `toString()` returns `null` (3.x regression from 2.x) (reported by @Marti2203) (fix by @cowtowncoder, w/ Claude code) 3.3.0 (07-Nov-2026) #1127: `@JsonTypeInfo` with `EXTERNAL_PROPERTY` does not handle arrays of polymorphic types: now fails eagerly with clear `InvalidDefinitionException` (on both serialization and deserialization) instead of confusing low-level error (reported by Alex C) (fix by @cowtowncoder, w/ Claude code) #1803: `TreeTraversingParser` should allow passing of parent context (fix by @cowtowncoder, w/ Claude code) #3182: Add `StringCanonicalizingConverter` for opt-in canonicalization ("de-duplication") of low-cardinality `String` values (requested by Fabian L) (contributed by DongNyoung L) #3947: Multiple suitable annotated Creator factory methods to be used as the Key deserializer when using record als key in Map (reported by @toonborgers) (fix by @DragonFSKY) #4385: Allow changing serializer used for a single property of a Class (allow `ValueSerializerModifier` to replace property serializer via `BeanPropertyWriter.assignSerializer()`) (requested by @Guy2You) (fix by @exijn) #4762: `@JsonValue` serialization ignores annotations on the annotated accessor (particularly `@JsonInclude`, `@JsonFormat`) (reported by @sikorskii) (fix by @seonwooj0810) #5380: `@JsonValue` ignores property inclusion config override of the value type (empty values no longer suppressed if value type override does not exclude them) (reported by @LSwiatek) (fix by @cowtowncoder, w/ Claude code) #6069: Change throws declaration on convertValue to JacksonException to match what is actually thrown (reported by @pctF) (fix by @pjfanning) #6091: Report the active token when polymorphic deserialization replays buffered content (reported by @Laar) (fix by @jakezwang, w/ OpenAI Codex) #6113: Fix `DOMSerializer` to support polymorphic serialization (fix by @dong0713) #6114: Fix QName object deserialization to reject non-String namespaceURI/prefix (fix by @dong0713) #6120: Use per-node-type Type Ids for DOM values, reconstruct via DOM factory instead of always parsing a `Document` (fix by @cowtowncoder, w/ Claude code) #6128: Fail explicitly on POJO that has both `@JsonFormat(shape=ARRAY)` and `@JsonFilter` (fix by @DragonFSKY) #6130: Allow limiting maximum length of JDK regex `Pattern` at deser time (contributed by @pjfanning) #6136: `@JsonFilter` with `serializeAllExcept()` does not filter `@JsonAnyGetter` entries (fix by Aysha A-Z) #6142: Invalidate read-only lookup snapshot in `SerializerCache` when a typed serializer entry is replaced (and not just when added) (fix by @Dongnyoung) #6151: Add `DateTimeFeature.ALWAYS_WRITE_SUBSECOND_DIGITS` (contributed by @seonwooj0810) #6168: Cache raw parameter types in `AnnotatedConstructor` (fix by @Dongnyoung) #6170: Allow skipping null values for properties handled by `@JsonAnySetter` (fix by @Dongnyoung) #6175: Parse object-form `QName` after `As.PROPERTY` type id (reported by @jjh75607) (fix by @kalayciburak) #6178: `JsonFormat.Feature.ACCEPT_CASE_INSENSITIVE_VALUES` does not work for `java.time.Month` (reported by @laech) (fix by @Dongnyoung) #6187: Make `InvokerHolder` access in `AnnotatedConstructor` lazy (requested by @cowtowncoder) (fix by @kalayciburak) #6198: Make `InvokerHolder` access in `AnnotatedMethod` lazy (requested by @cowtowncoder) (fix by @kalayciburak) #6188: `ThrowableDeserializer` does not resolve standard `Throwable` property names against `PropertyNamingStrategy` (fix by @cowtowncoder, w/ Claude code) #6190: Explicit `@JsonView` on a standard `Throwable` property is ignored by `ThrowableDeserializer` (fix by @adityabagla7) #6193: Use `JsonParser.nextNameMatchAndToken()` in the vanilla `BeanDeserializer` loops (contributed by Steven S) #6195: Close managed `JsonParser` if `ObjectReader.readValues()` initialization fails (fix by @pjfanning) #6196: Close `JsonGenerator` if initialization fails before any content is written (fix by @pjfanning) #6197: `ClassCastException` for `AutoCloseable` (but not `Closeable`) values in `ObjectMapper.writeValue(JsonGenerator, Object)` with `SerializationFeature.CLOSE_CLOSEABLE` (fix by @pjfanning) #6216: Add `TreeTraversingParser` constructors that take explicit `StreamReadConstraints` (for tree-backed format backends) #6219: Vanilla `BeanDeserializer` fast path never used with 3.x defaults (`MapperFeature.DEFAULT_VIEW_INCLUSION` disabled) (reported by @cowtowncoder) (fix by @kalayciburak) #6220: `@JsonDeserialize(as/keyAs/contentAs)` lost when property's type deserializer (Default Typing, `@JsonTypeInfo`) resolves a type id: type deserializer was built for the declared type, before the refinement (fix by @pjfanning) #6229: `DETECT_PARAMETER_NAMES` disabled also prevents `@ConstructorProperties` based Creator detection (fix by @mauriciocsz) #6231: Add copy constructor for `JacksonAnnotationIntrospector` (for sub-classes to create re-configured copies) (fix by @cowtowncoder, w/ Claude code) #6233: Serialize `Month` as Enum name with `@JsonFormat(shape = STRING)` (fix by @pjfanning) #6239: Explicit `JsonFormat.Shape.NUMBER_INT`/`NUMBER_FLOAT` not honored for nanosecond handling of `java.time` values (serialization, deserialization) (fix by @cowtowncoder, w/ Claude code) #6243: Filter ignored Creator properties at build time instead of per-loop read-time checks (fix by @dlwhdgus0810) #6255: `@JsonIgnoreProperties`/`@JsonIncludeProperties` not honored for `ObjectNode`/`JsonNode`-valued `@JsonAnyGetter` entries (fix by Aysha A-Z) #6257: `MapDeserializer`: `@JsonIgnoreProperties`/`@JsonIncludeProperties` checked after key deserialization, so ignored non-convertible key names still failed (fix by @cowtowncoder, w/ Claude code) #6275: Regression in 3.2: per-type `@JsonInclude(NON_DEFAULT)` no longer writes a `null` over a non-null default, so the `null` can't round-trip (reported by @essiembre) (fix by @mvanhorn) #6295: `@JsonInclude(NON_DEFAULT)` omits a changed array property when the default array contains `null` (reported, fixed by @Marti2203) #6296: Duplicate properties merged under the wrong key in non-vanilla `UntypedObjectDeserializer` (reported, fixed by @Marti2203) #6305: `InetSocketAddress` deserialization ignores text after the closing bracket of an IPv6 address (reported, fixed by @Marti2203) #6306: NPE serializing `@JsonIdentityReference(alwaysAsId = true)` to an object whose id is `null` (reported, fixed by @Marti2203) #6300: NPE when a `DeserializationProblemHandler` returns `null` for primitive values (including primitive array elements) (reported, fixed by @Marti2203) #6315: Map key deserializers should apply same type checks as bean deserializers (reported by @ab310013) (fix by @pjfanning) #6317: Global `NON_DEFAULT` with `USE_REAL_INCLUDE_NON_DEFAULT` now writes explicit `null` over a non-null default (like per-type); previously nulls were suppressed (fix by @cowtowncoder, w/ Claude code) #6319: Global `NON_DEFAULT` with `USE_REAL_INCLUDE_NON_DEFAULT` skips "empty" check when default bean cannot be created (fix by @cowtowncoder, w/ Claude code) #6320: `Locale` Map keys serialized using `Locale.toString()` instead of BCP-47 language tag (like `Locale` values) (fix by @pjfanning) #6324: `ArrayIndexOutOfBoundsException` in `BeanPropertyMap.withoutProperties()` with property-level `@JsonIdentityInfo` + `@JsonIgnoreProperties` when the value type has `@JsonAlias` (reported by @Marti2203) (fix by @hutiefang76) #6325: `NullPointerException` when a `@JsonCreator` returns `null` and the input has an Object Id forward reference (reported by @Marti2203) (fix by @hutiefang76) #6352: `BeanPropertyMap.withProperty()` modifies shared map when Object Id property name matches existing property (property-level `@JsonIdentityInfo`) (fix by @cowtowncoder, w/ Claude code) #6357: `BeanDeserializer` and `BuilderBasedDeserializer` silently stop on unexpected token within Object (fix by @OKAN-SOFTWARE, @cowtowncoder w/ Claude code) #6363: `@JsonFormat(shape = ARRAY)` Builder loses property values when not using vanilla processing (e.g. with active View): `deserializeSetAndReturn()` result ignored (fix by @wozhenbang2004) #6364: Report property name as found in input (alias or different case with `ACCEPT_CASE_INSENSITIVE_PROPERTIES`), not canonical name, in deserialization error paths (fix by @cowtowncoder, w/ Claude code) #6365: `JsonMapper.builder().filterProvider(...).build()` throws `NullPointerException` when a `SimpleFilterProvider` has a `null` filter (`addFilter()` with `null` filter now removes the binding) (reported by @Marti2203) (fix by @wozhenbang2004) #6366: `NullPointerException` deserializing raw `Map.Entry` with a `Shape.POJO` config override (raw `Map.Entry` now handled as `Map.Entry` in all shapes) (reported by @Marti2203) (fix by @wozhenbang2004) #6371: Polymorphic key and value types not retained for POJO-shaped `Map.Entry` deserialization (fix by @wozhenbang2004) #6372: Immutable Builder loses `@JsonUnwrapped` property values: result of "with"-method ignored by `UnwrappedPropertyHandler` (fix by @wozhenbang2004) #6374: `@JsonFormat(shape = ARRAY)` Builder: structured first extra array element not skipped correctly, leaves parser misaligned (fix by @wozhenbang2004) #6375: Wrap non-Jackson exceptions thrown by `DeserializationProblemHandler.handleUnknownProperty()` to include bean and property path (fix by @wozhenbang2004) #6376: End of input right after a property name (possible with `TokenBuffer`) reported as `DatabindException` wrapping `NullPointerException`, not `MismatchedInputException` (fix by @cowtowncoder, w/ Claude code) #6385: Record update with `readerForUpdating()` fails for non-public Record: accessor not made accessible (fix by @wozhenbang2004, @cowtowncoder w/ Claude code) #6394: `@JsonFormat(shape = ARRAY)` deserialization hangs when input ends before `END_ARRAY` while skipping extra values (fix by @Sahas2711, @cowtowncoder w/ Claude code) #6398: `@JsonFormat(shape = ARRAY)` builder deserialization throws when a `DeserializationProblemHandler` recovers with `null` (fix by @wozhenbang2004) #6399: `NullSerializer` should not be annotated with `@JacksonStdImpl` #6401: Raw `IllegalArgumentException` escapes polymorphic type-id resolution (reported by @AmirWilayah) (fix by @cowtowncoder, w/ Claude code) #6410: Object Ids should NOT be affected by JSON Views or `@JsonFilter` (fix by @cowtowncoder, w/ Claude code) 3.2.5 (not yet released) #6210: `@JsonAlias` ignored on Enum values if `@JsonValue` is present (reported by @bugada) (fix by @pjfanning, w/ Claude code) #6295: `@JsonInclude(NON_DEFAULT)` omits a changed array property when the default array contains `null` (reported, fixed by @Marti2203) #6296: Duplicate properties merged under the wrong key in non-vanilla `UntypedObjectDeserializer` (reported, fixed by @Marti2203) #6305: `InetSocketAddress` deserialization ignores text after the closing bracket of an IPv6 address (reported, fixed by @Marti2203) #6306: NPE serializing `@JsonIdentityReference(alwaysAsId = true)` to an object whose id is `null` (reported, fixed by @Marti2203) #6300: NPE when a `DeserializationProblemHandler` returns `null` for primitive values (including primitive array elements) (reported, fixed by @Marti2203) #6315: Map key deserializers should apply same type checks as bean deserializers (reported by @ab310013) (fix by @pjfanning) #6329: Add JDK-bundled `RowSet` gadget siblings of `JdbcRowSetImpl` to deserialization deny-list (`CachedRowSetImpl`, `WebRowSetImpl`, `FilteredRowSetImpl`, `JoinRowSetImpl`) #6332: Regression from 3.0 to 3.1: `@JsonUnwrapped` drops/rejects the type id property of a polymorphic unwrapped value (reported, fixed by @2is10) #6338: `readerForUpdating()` ignores `@JsonSetter(nulls = Nulls.SKIP)` for creator properties: existing value is overwritten with `null` (reported, fixed by @Marti2203) #6339: Enum aliases from an appended `AnnotationIntrospector` are discarded: `JacksonAnnotationIntrospector.findEnumAliases()` overwrites every slot (reported, fixed by @Marti2203) #6342: `@JsonFormat(shape = NUMBER)` on primitive `boolean` getter written as `true`/`false` with Blackbird / Afterburner (regression via #6111) (reported by @palprat) (fix by @cowtowncoder, w/ Claude code) #6350: `allowSubTypesWithExplicitDeserializer()` denies `java.sql.Date`, `java.sql.Timestamp`, `OptionalInt`, `OptionalLong`, `OptionalDouble` and `JsonNode` (reported, fixed by @Marti2203) 3.2.4 (18-Oct-2026) #6145: `@JsonIgnoreProperties` bypassed for Creator properties with builders and external type ids (fix by Aysha A-Z) #6206: Report cycle through `@JsonValue` accessor as `DatabindException` (instead of `StackOverflowError`) (fix by @pjfanning, w/ Claude code) #6225: `ArrayStoreException` when a Builder-based typed array resolves a forward Object Id reference within the same array (fix by @jakezwang) #6227: `BeanDescription` is not thread-safe when called concurrently on the same instance (`findProperties()`, `findDefaultViews()`) (reported by @sergeylappo) (fix by @pjfanning, w/ Claude code) #6232: Validate `StreamReadConstraints` number length when coercing `StringNode` to number (fix by Aysha A-Z) #6236: Retain `JsonFormat.Shape` in `withFormat()` of `Month`, `MonthDay`, `Year` and `YearMonth` serializers (fix by @cowtowncoder, w/ Claude code) #6240: `@JsonValue` ignored on getter also annotated with `@JsonKey` (fix by @kimsanhaa) #6246: Creator properties not renamed for `@JsonUnwrapped` with prefix/suffix with `MapperFeature.ACCEPT_CASE_INSENSITIVE_PROPERTIES` (fix by @cowtowncoder, w/ Claude code) #6249: Avoid NPE when parser reports `VALUE_STRING` with `null` text (fix by @pjfanning, w/ Claude code) #6252: `@JsonIgnoreProperties` not honored for `EnumMap` properties (fix by Aysha A-Z) #6261: Support `@JsonView` on properties-based Creator parameters of Enum, Map and EnumMap types (fix by @pjfanning, w/ Claude code) #6273: Deserializing empty `Locale` Map keys (and other non-BCP-47 single-segment values) fails since 3.2.0 (reported by @schabe77) (fix by @pjfanning, w/ Claude code) #6287: Type parameters of generic type ids bypass `PolymorphicTypeValidator` [CVE-2026-110879] NOTE: type parameters (and element types of array type ids) are now validated like direct type ids; base type approval (`allowIfBaseType()`) only covers ones that are subtypes of the base type; `allowIfSubTypeIsArray()` no longer accepts abstract or interface element types without allow-listing (except `Number`); approval of an array type covers its element type only if given as exactly that class (`allowIfSubType(Bar[].class)`, new `PolymorphicTypeValidator.isArrayTypeAllowedExplicitly()`), a name-based rule does not; base type approval of a declared array type covers subtypes of its element type unless that is `Object`, `Serializable` or `Cloneable` (reported by @AdamKorcz, @martinfrancois) (fix by @cowtowncoder, @martinfrancois) 3.2.3 (21-Sep-2026) #6157: `@JsonIncludeProperties` not honored for `Throwable` types with `@JsonAnySetter` (fix by Aysha A-Z) #6174: Honor `@JsonView` in `ThrowableDeserializer.deserializeFromObject()` (fix by Aysha A-Z) #6179: Apply `StreamReadConstraints` number length limit when coercing String to `double` (fix by Aysha A-Z) #6182: `StdDateFormat.` degrades JIT compilation of `UTF8JsonGenerator._writeStringSegment` (fix by Francesco N) #6185: Bracket unresolved IPv6 host name in `InetSocketAddress` serialization (fix by @pjfanning, w/ Claude code) #6203: Prevent unbounded growth of type id cache in `TypeDeserializer` [CVE-2026-91776] (reported by @dabirt) (fix by @pjfanning) #6204: Avoid quadratic forward-reference resolution in Collection/Map deserializers [CVE-2026-91777] (reported by @dabirt) (fix by @pjfanning) #6205: Avoid quadratic forward-reference resolution in `ObjectArrayDeserializer` (fix by @pjfanning, w/ Claude code) #6214: `DecimalNode` to `BigInteger` conversion no longer guarded by `StreamReadConstraints.validateBigIntegerScale()` (regression from 2.x) (fix by @pjfanning, w/ Claude code) #6223: Avoid quadratic Object Id rebinding for Builder- and delegate-based values (fix by @cowtowncoder, w/ Claude code) 3.2.2 (14-Aug-2026) #6096: Honor `@JsonView` in `BeanAsArrayDeserializer` update path (fixed by Aysha A-Z) #6099: Resolve classes without initialization in `TypeFactory.findClass()` (fixed by Aysha A-Z) #6101: `@JsonInclude(NON_EMPTY, content=CUSTOM)` does not omit a Map property after all entries are filtered (reported by @dlwldnjs1009) (fix by @seonwooj0810) #6109: Mark built-in JDK 8 handlers (`Optional`, `Stream`) with `@JacksonStdImpl` so optimization modules (Blackbird) can retain optimized handlers (fix by Lee Jiwon) #6115: Honor `@JsonIgnoreProperties` before any-setter on more deser paths (fix by Aysha A-Z) #6116: Reject non-ASCII digits in `InetAddress` literal validation (fixed by Aysha A-Z) #6127: Add `StreamReadConstraints` number len constraint to `javax.xml.datatype.XMLGregorianCalendar` and `javax.xml.datatype.Duration` [CVE-2026-68497] (reported by @waydeshi) (fix by @pjfanning) #6129: Limit the supported URL schemes for `java.nio.file.Path` deserialization [CVE-2026-19032] (reported by @waydeshi) (fix by @pjfanning) #6137: `DefaultCacheProvider.Builder` does not preserve default cache sizes for unspecified values (reported, fixed by DongNyoung L) #6156: Add `java.lang.Comparable` in set of "unsafe" polymorphic base types [CVE-2026-83557] (reported by @prvazsahnazarov) 3.2.1 (10-Jul-2026) #6022: Follow-up to #5369: apply content @JsonInclude in `StringCollectionSerializer.serializeWithType` (contributed by Lee Jiwon) #6028: Verification of unwrapped fields should mention type containing unwrapped POJO (reported by Oliver D) (fix by @cowtowncoder, w/ Claude code) #6031: Getter annotated with `@JsonIgnore` prevents `@JsonAlias` from working on `@JsonCreator` parameter (regression in 3.2.0) (reported by @ynojima) (fix by @cowtowncoder, w/ Claude code) #6043: `FAIL_ON_UNKNOWN_PROPERTIES` has no effect with `JsonFormat.Shape.ARRAY` when using creator-based instantiation (such as `record`) (reported by Théo S) (fix by @seonwooj0810) #6055: Honor `@JsonView` for external-type-id (`EXTERNAL_PROPERTY`) properties [GHSA-mhm7-754m-9p8w] (reported by @Sharlong-Wen) #6058: Do not allow DNS resolution when deserializing `InetAddress` [CVE-2026-77310] (reported by @thientd) (fix by @pjfanning) #6059: `ObjectMapper.valueToTree()` with `byte[]` does not produce `BinaryNode` (reported by @sebastien-leveque) (fix by @cowtowncoder, w/ Claude code) #6060: `@JsonView` by-passed for `@JsonUnwrapped` Field/Setter properties [CVE-2026-59889] #6065: `SerializationFeature.APPLY_JSON_INCLUDE_FOR_CONTAINERS` does not fully remove empty collection during serialization (reported by @doeiqts) (fix by @seonwooj0810) #6077: `FAIL_ON_UNEXPECTED_VIEW_PROPERTIES` not being respected with constructor-backed properties (nor with Builders, `@JsonUnwrapped`, external type ids or `Shape.ARRAY`) (reported by João G) (fix by João G and @cowtowncoder, w/ Claude code) 3.2.0 (08-Jun-2026) #639: `@JacksonInject` with `@JsonIdentityInfo` causes deserialization failure (unresolved forward reference) (reported by Gili T) (fix by @cowtowncoder, w/ Claude code) #644: Allow skipping writing of type id if type to serialize is `defaultImpl` (implemented by @cowtowncoder, w/ Claude code) #1075: `@JsonUnwrapped` fields with matching `@JsonIgnore`d getter in outer class are ignored (reported by Sylvain G) (fix by @cowtowncoder, w/ Claude code) #1281: `@JsonIgnoreProperties` should work for "any getter" (for serialization) (reported by Benson M) #1298: Writing ObjectId reference for `@JsonUnwrapped` property fails with obscure error message (reported by Jeff Q) (fix by @cowtowncoder, w/ Claude code) #1329: External type property (`@JsonTypeInfo(include = As.EXTERNAL_PROPERTY`)) deserialized even if `visible = false` (fix by @cowtowncoder, w/ Claude code) (reported by Raman G) #1410: Overlap between `@JsonTypeInfo.As.PROPERTY` indicated type id and field with same name results in `UnrecognizedPropertyException` (reported by Kevin H) (fix by @cowtowncoder, w/ Claude code) #1496: Support use of Object IDs with Builders (reported by @gary-sedgwick) (fix by @cowtowncoder, w/ Claude code) #1515: `@JsonSerialize(Typing.DYNAMIC)` in some cases does not override `MapperFeature.USE_STATIC_TYPING` (reported by @garkin) (fix by @cowtowncoder, w/ Claude code) #1528: `@JsonTypeInfo` visible property set to `null` in defaultImpl class (reported by Davide M) #1546: Resolving forward references with `@JsonManagedReference`/ `@JsonBackReference` into `Set` may corrupt `hashCode`-based lookups (reported by Niels D) (fix by @cowtowncoder, w/ Claude code) #1622: Failure to deserialize child object when using `@JsonIgnoreProperties` to break cycle (reported by @b-behan) (fix by @JacksonJang) #1706: `@JsonCreator` not working properly with `@JsonIdentityInfo` when deserializing a collection of interfaces (immutables.io compatibility) (reported by Balys V) (fix by @cowtowncoder, w/ Claude code) #1755: Get NPE on deserializing values with recursive `@JsonIgnoreProperties` (reported by @Romain-P) (fix by @cowtowncoder, w/ Claude code) #1757: Regression in `JsonInclude.Include.NON_DEFAULT` set as global default serialization inclusion (add new `MapperFeature.USE_REAL_INCLUDE_NON_DEFAULT`) (reported by @yhack) (fix by @cowtowncoder, w/ Claude code) #1921: Reader for updating do not use `@JsonCreator` constructor (reported by Patrik M) (fix by @cowtowncoder, w/ Claude code) #2039: `@JsonUnwrapped` and `JsonTypeInfo.As.EXTERNAL_PROPERTY` in the same bean doesn't work (reported by @tlevavasseur-innovantic) (fix by @cowtowncoder, w/ Claude code) #2100: Using `ObjectReader.withValueToUpdate()` with JsonPOJOBuilder no longer working (reported by Leonid T) (fix by @cowtowncoder, w/ Claude code) #2572: Can't deserialize inner class if default setter is `Nulls.AS_EMPTY` (reported by @XakepSDK) (fix by @cowtowncoder, w/ Claude code) #2736: Unable to deserialize `@JsonUnwrapped` `Optional<>` field (reported by Vitaly B) (fix by @cowtowncoder, w/ Claude code) #2747: `@JsonTypeInfo(include = EXTERNAL_PROPERTY)` exposes bogus array via `JsonStreamContext` during deserialization (reported by David A) (fix by @cowtowncoder, w/ Claude code) #2780: Deserialization with Default Typing and `@JsonIdentityInfo` in untyped collections fails (reported by @ alex-t0) (fix by @cowtowncoder, w/ Claude code) #2883: Annotation `@JsonUnwrapped` can serialize duplicate properties (reported by Michał R) (fix by @cowtowncoder, w/ Claude code) #2955: Handling UnresolvedForwardReference by pre-processing illegal values (reported by Andrey U) (fix by @cowtowncoder, w/ Claude code) #3030: Correctly deserialize forward `@JsonIdentityInfo` references when using `@JsonCreator` (reported by Benedikt P) (fix by @cowtowncoder, w/ Claude code) #3064: `@JsonPropertyOrder(alphabetic=true)` is ignored in case indices are defined for `@JsonProperty` -- add `MapperFeature.SORT_PROPERTIES_BY_INDEX` (reported by Christian D) (contributed by Lee Jiwon) #3083: `@JsonIncludeProperties` could be used like `@JsonPropertyOrder` (suggested by Marcel O) (fix by @cowtowncoder, w/ Claude code) #3166: Ability to sort `Set`s before serialization (add `SerializationFeature.ORDER_SET_ELEMENTS`) (requested by @mjustin) (implemented by @Lee Jiwon) #3169: `@JsonIncludeProperties` does not work together with `@JsonIdentityInfo` (reported by Christof T) #3178: `@JsonUnwrapped` deserialization results in empty nested object when using prefix (reported by @chimmi) (fix by @cowtowncoder, w/ Claude code) #3185: `@JsonIdentityInfo` with `@JsonCreator` incorrectly sets a field (reported by Auke S) #3194: Deserialization of 2-dimensional arrays of final types fails when using `DefaultTyping.NON_FINAL` (reported by Klaas D) (fix by @cowtowncoder, w/ Claude code) #3205: ConfigOverrides for merging are not applied for items inside containers (reported by Daniel G) (fix by @cowtowncoder, w/ Claude code) #3209: Polymorphism with aliases fails to utilize alias fields (reported by @Dragas) (fix by @cowtowncoder, w/ Claude code) #3216: Delegating `@JsonCreator` does not prevent unnecessary introspection of properties, leading to bogus failure (reported by @awildturtok) (fix by @cowtowncoder, w/ Claude code) #3229: Existing instance of a local/anonymous Class cannot be updated (reported by @avshenuk) (fix by @cowtowncoder, w/ Claude code) #3316: Deserialization of a date with `@JsonFormat` specified with locale that is not a language tag (reported by @MarkDavoren) (fix by @cowtowncoder, w/ Claude code) #3355: Deserialization fails depending on the order of deserialized objects with "Cannot construct instance (although at least one Creator exists)" (reported by @dinopraso) (fix by @JacksonJang) #3547: When using type id with `As.EXTERNAL_PROPERTY` together with `@JsonValue` inside type the serialiser omits external type id field from result when `@JsonValue` value is null (reported by Aurimas N) (fix by @cowtowncoder, w/ Claude code) #3573: Inconsistent handling of nil `UUID` in property inclusion (reported by Andrzej L) #3591: Ignored fields not consistently exposed via `BeanDescription.getIgnoredPropertyNames()` (requested by Oliver D) (fix by @cowtowncoder, w/ Claude code) #3604: Allow use of `JsonNode` field for `@JsonAnyGetter` (fix by @cowtowncoder, w/ Claude code) #4014: No way to combine `@JsonTypeInfo(include = As.PROPERTY)` and `@JsonIdentityInfo(generator = PropertyGenerator.class)` (reported, fix by Knut W) #4758: `ConfigOverride` using `Nulls.AS_EMPTY` does not work with `@JsonManagedReference` (reported by Robert R) (fix by @cowtowncoder, w/ Claude code) #4983: `JsonTypeInfo.Id.MINIMAL_CLASS` generates invalid type on sub-package (reported, fix by Benoit C-L) #5281: Reading into existing instance uses creator property setup instead of mutator (setter, field) (reported by @odrotbohm) (fix by @cowtowncoder, w/ Claude code) #5330: `@JsonProperty`on enum values with `@JsonFormat(shape = JsonFormat.Shape.NUMBER)` is ignored (reported by Christoffer H) (fixed by Lee H) #5353: Preserve order of `@JsonAnySetter` creator property arguments (suggested by Eran L) (fix by @cowtowncoder, w/ Claude code) #5615: JsonMapper seems to be not thread-safe when using the polymorphic `JsonTypeInfo.As.PROPERTY` definition (and `@JsonIgnoreProperties`) (reported by @xC0DEBA5E) (fix by @cowtowncoder, w/ Claude code) #5727: `VisibilityChecker` overrides `equals()` without overriding `hashCode()` (reported by @shanjiang98) (fix by @cowtowncoder, w/ Claude code) #5734: `DeserializationFeature.FAIL_ON_NULL_FOR_PRIMITIVES` treats absent field same as explicit `null` (reported by Martin U) #5745: Ability to change active JsonView on submodels (with `@JsonApplyView`) (contributed by Frederic A) #5821: Fix dead code and side-effect bug in `BeanPropertyWriter.toString()` (fix by @pjfanning) #5851: Regression of `JsonTypeInfo.Id.MINIMAL_CLASS` in the 3.x branch (reported by @wrongwrong) (fix by @cowtowncoder, w/ Claude code) #5860: Add new extension point for `ObjectMapper`, `ObjectWriter`: handler `GeneratorInitializer` called immediately after `JsonGenerator` created, before used (fix by @cowtowncoder, w/ Claude code) #5861: Allow injecting `MissingNode` for "absent" `JsonNode` via Creator (with `JsonNodeFeature.MAP_ABSENT_TO_MISSING`) (fix by @cowtowncoder, w/ Claude code) #5872: ObjectId resolution with Builder fails for interface types (`UnresolvedForwardReference`) (fix by @cowtowncoder, w/ Claude code) #5897: Excessive `TokenBuffer` allocations when deserializing records (fix by Viktor S, w/ Claude code) #5909: Forward Object Id references inside Collection properties leak Builder instance (follow-up to #1496) (fix by Daniel P) #5937: Add `SerializationContext.withActiveView()` (implemented by @cowtowncoder) #5946: Forward Object Id references inside typed Array (T[] where T is NOT `java.lang.Object`) not handled correctly (fix by @cowtowncoder, w/ Claude code) #5952: `@JsonIgnore` does not prevent passing of property to `@JsonAnySetter` (reported by Omkhar A) (fix by @cowtowncoder, w/ Claude code) #5958: `@JsonView` ignored with `@JsonTypeInfo(include = As.EXTERNAL_PROPERTY)` (fix by Omkhar A) #5960: Deprecate un-maintained `tools.jackson.databind.jsontype.impl.SubTypeValidator` #5975: Parameters with an `ImplicitPropertyName` that matches the name of a property marked as `READ_ONLY` are ignored during deserialization (reported by @wrongwrong) (fix by @cowtowncoder, w/ Claude code) #5977: Apply per-property DYNAMIC typing override to `ObjectArraySerializer` (fix by Lee Jiwon) #5980: Property-based Creator clobbers enclosing value's `JsonParser.currentValue()` (reported by Desmond K) (fix by @cowtowncoder, w/ Claude code) #6010: `WRITE_ENUMS_TO_LOWERCASE` must use `Locale.ROOT` for case folding (fix by Lee Jiwon) #6017: Make `@JsonUnwrapped` compatible with `@JsonSerialize(converter = )` (reported by Manuel H) (fix by @cowtowncoder, w/ Claude code) - Remove project-specific Android SDK compatibility level, use shared; no change level itself (stillAndroid SDK 34) 3.1.9 (not yet released) #6210: `@JsonAlias` ignored on Enum values if `@JsonValue` is present (reported by @bugada) (fix by @pjfanning, w/ Claude code) #6295: `@JsonInclude(NON_DEFAULT)` omits a changed array property when the default array contains `null` (reported, fixed by @Marti2203) #6296: Duplicate properties merged under the wrong key in non-vanilla `UntypedObjectDeserializer` (reported, fixed by @Marti2203) #6305: `InetSocketAddress` deserialization ignores text after the closing bracket of an IPv6 address (reported, fixed by @Marti2203) #6306: NPE serializing `@JsonIdentityReference(alwaysAsId = true)` to an object whose id is `null` (reported, fixed by @Marti2203) #6300: NPE when a `DeserializationProblemHandler` returns `null` for primitive values (including primitive array elements) (reported, fixed by @Marti2203) #6309: NPE serializing an Enum whose `toString()` returns `null` (3.x regression from 2.x) (reported by @Marti2203) (fix by @cowtowncoder, w/ Claude code) #6315: Map key deserializers should apply same type checks as bean deserializers (reported by @ab310013) (fix by @pjfanning) #6329: Add JDK-bundled `RowSet` gadget siblings of `JdbcRowSetImpl` to deserialization deny-list (`CachedRowSetImpl`, `WebRowSetImpl`, `FilteredRowSetImpl`, `JoinRowSetImpl`) #6332: Regression from 3.0 to 3.1: `@JsonUnwrapped` drops/rejects the type id property of a polymorphic unwrapped value (reported, fixed by @2is10) #6338: `readerForUpdating()` ignores `@JsonSetter(nulls = Nulls.SKIP)` for creator properties: existing value is overwritten with `null` (reported, fixed by @Marti2203) #6339: Enum aliases from an appended `AnnotationIntrospector` are discarded: `JacksonAnnotationIntrospector.findEnumAliases()` overwrites every slot (reported, fixed by @Marti2203) #6342: `@JsonFormat(shape = NUMBER)` on primitive `boolean` getter written as `true`/`false` with Blackbird / Afterburner (regression via #6111) (reported by @palprat) (fix by @cowtowncoder, w/ Claude code) #6350: `allowSubTypesWithExplicitDeserializer()` denies `java.sql.Date`, `java.sql.Timestamp`, `OptionalInt`, `OptionalLong`, `OptionalDouble` and `JsonNode` (reported, fixed by @Marti2203) 3.1.8 (17-Oct-2026) #6206: Report cycle through `@JsonValue` accessor as `DatabindException` (instead of `StackOverflowError`) (fix by @pjfanning, w/ Claude code) #6227: `BeanDescription` is not thread-safe when called concurrently on the same instance (`findProperties()`, `findDefaultViews()`) (reported by @sergeylappo) (fix by @pjfanning, w/ Claude code) #6232: Validate `StreamReadConstraints` number length when coercing `StringNode` to number (fix by Aysha A-Z) #6236: Retain `JsonFormat.Shape` in `withFormat()` of `Month`, `MonthDay`, `Year` and `YearMonth` serializers (fix by @cowtowncoder, w/ Claude code) #6240: `@JsonValue` ignored on getter also annotated with `@JsonKey` (fix by @kimsanhaa) #6246: Creator properties not renamed for `@JsonUnwrapped` with prefix/suffix with `MapperFeature.ACCEPT_CASE_INSENSITIVE_PROPERTIES` (fix by @cowtowncoder, w/ Claude code) #6249: Avoid NPE when parser reports `VALUE_STRING` with `null` text (fix by @pjfanning, w/ Claude code) #6252: `@JsonIgnoreProperties` not honored for `EnumMap` properties (fix by Aysha A-Z) #6261: Support `@JsonView` on properties-based Creator parameters of Enum, Map and EnumMap types (fix by @pjfanning, w/ Claude code) #6287: Type parameters of generic type ids bypass `PolymorphicTypeValidator` [CVE-2026-110879] NOTE: type parameters (and element types of array type ids) are now validated like direct type ids; base type approval (`allowIfBaseType()`) only covers ones that are subtypes of the base type; `allowIfSubTypeIsArray()` no longer accepts abstract or interface element types without allow-listing (except `Number`); approval of an array type covers its element type only if given as exactly that class (`allowIfSubType(Bar[].class)`, new `PolymorphicTypeValidator.isArrayTypeAllowedExplicitly()`), a name-based rule does not; base type approval of a declared array type covers subtypes of its element type unless that is `Object`, `Serializable` or `Cloneable` (reported by @AdamKorcz, @martinfrancois) (fix by @cowtowncoder, @martinfrancois) 3.1.7 (21-Sep-2026) #6157: `@JsonIncludeProperties` not honored for `Throwable` types with `@JsonAnySetter` (fix by Aysha A-Z) #6174: Honor `@JsonView` in `ThrowableDeserializer.deserializeFromObject()` (fix by Aysha A-Z) #6179: Apply `StreamReadConstraints` number length limit when coercing String to `double` (fix by Aysha A-Z) #6182: `StdDateFormat.` degrades JIT compilation of `UTF8JsonGenerator._writeStringSegment` (fix by Francesco N) #6185: Bracket unresolved IPv6 host name in `InetSocketAddress` serialization (fix by @pjfanning, w/ Claude code) #6203: Prevent unbounded growth of type id cache in `TypeDeserializer` [CVE-2026-91776] (reported by @dabirt) (fix by @pjfanning) #6204: Avoid quadratic forward-reference resolution in Collection/Map deserializers [CVE-2026-91777] (reported by @dabirt) (fix by @pjfanning) #6205: Avoid quadratic forward-reference resolution in `ObjectArrayDeserializer` (fix by @pjfanning, w/ Claude code) #6214: `DecimalNode` to `BigInteger` conversion no longer guarded by `StreamReadConstraints.validateBigIntegerScale()` (regression from 2.x) (fix by @pjfanning, w/ Claude code) 3.1.6 (14-Aug-2026) #6096: Honor `@JsonView` in `BeanAsArrayDeserializer` update path (fixed by Aysha A-Z) #6099: Resolve classes without initialization in `TypeFactory.findClass()` (fixed by Aysha A-Z) #6101: `@JsonInclude(NON_EMPTY, content=CUSTOM)` does not omit a Map property after all entries are filtered (reported by @dlwldnjs1009) (fix by @seonwooj0810) #6109: Mark built-in JDK 8 handlers (`Optional`, `Stream`) with `@JacksonStdImpl` so optimization modules (Blackbird) can retain optimized handlers (fix by Lee Jiwon) #6115: Honor `@JsonIgnoreProperties` before any-setter on more deser paths (fix by Aysha A-Z) #6116: Reject non-ASCII digits in `InetAddress` literal validation (fixed by Aysha A-Z) #6127: Add `StreamReadConstraints` number len constraint to `javax.xml.datatype.XMLGregorianCalendar` and `javax.xml.datatype.Duration` [CVE-2026-68497] (reported by @waydeshi) (fix by @pjfanning) #6129: Limit the supported URL schemes for `java.nio.file.Path` deserialization [CVE-2026-19032] (reported by @waydeshi) (fix by @pjfanning) #6133: Limit number sizes allowed in `java.time.Instant` deserializer (fix by @pjfanning) #6137: `DefaultCacheProvider.Builder` does not preserve default cache sizes for unspecified values (reported, fixed by DongNyoung L) #6156: Add `java.lang.Comparable` in set of "unsafe" polymorphic base types [CVE-2026-83557] (reported by @prvazsahnazarov) #6165: Apply number length limits to `BigDecimal`/`BigInteger`/`Double`/`Float` Map keys (fix by Aysha A-Z) 3.1.5 (07-Jul-2026) #6040: Inconsistency in current token on invalid type coercion for `List` (reported by João G) (fix by @cowtowncoder, w/ Claude code) #6048: Apply content converters for String collection values (`StringCollectionDeserializer`) (fixed by Lee Jiwon) #6055: Honor `@JsonView` for external-type-id (`EXTERNAL_PROPERTY`) properties [GHSA-mhm7-754m-9p8w] (reported by @Sharlong-Wen) #6058: Do not allow DNS resolution when deserializing `InetAddress` [CVE-2026-77310] (reported by @thientd) (fix by @pjfanning) #6060: `@JsonView` by-passed for `@JsonUnwrapped` Field/Setter properties [CVE-2026-59889] 3.1.4 (29-May-2026) #5950: Improve `UUIDDeserializer` error handling (reported, fix suggested by Omkhar A) #5951: Improve `InetSocketAddress` deserialization [CVE-2026-54514] (reported by Omkhar A) #5956: Fix problem with float-to-byte range check (reported, fix suggested by Omkhar A) #5957: Improve `java.time.Month` deserialization validation (fix by Omkhar A) #5962: Case-insensitive deserialization may use wrong `@JsonIgnoreProperties` [CVE-2026-54515] (fixed by Omkhar A) #5967: Renamed `@JsonIgnore`d setters can deserialize via private fields [CVE-2026-54516] (fixed by Omkhar A) #5969: `@JsonView` by-passed for some "setterless" creator properties [CVE-2026-54517] (fixed by Omkhar A) #5971: `@JsonView` by-passed for unwrapped creator parameters [CVE-2026-54518] (fixed by Omkhar A) #5974: `@JsonIgnore` on Record property ignored with `PropertyNamingStrategy` [CVE-2026-59888] (fixed by Omkhar A) #5981: `BasicPolymorphicTypeValidator` setting `allowIfSubTypeIsArray()` should validate element type [CVE-2026-54513] (reported by Omkhar A) (fix by @cowtowncoder, w/ Claude code) #5988: `PolymorphicTypeValidator` needs to validate generic type parameters too [CVE-2026-54512] (reported by Omkhar A) (fix by @cowtowncoder, w/ Claude code) #5993: `UPPER_SNAKE_CASE` / `LOWER_CASE` `NamingStrategyImpls` fold case using JVM default locale (Turkish-I bug) (fix by @CharmingKyu) #6001: Regression with `@JsonUnwrapped` from 3.0 to 3.1: custom unwrapping deserializer receives empty Object (reported by Severin K) (fix by @cowtowncoder, w/ Claude code) #6011: Add `MapperFeature.FIX_FIELD_NAME_UPPER_CASE_PREFIX` in `MapperBuilder.configureForJackson2()` (suggested by Dmitry S) 3.1.3 (01-May-2026) #5898: `DoubleDeserializer` rejects "+INF"/"+Infinity" despite accepting "INF"/"Infinity" and "-INF"/"-Infinity" (reported by Kenta Y) (fix by @cowtowncoder) #5911: Deserialization failed with `@JsonUnwrapped` and `@JsonAlias` on a property of the unwrapped type (reported by Lucas C) (fix by @cowtowncoder, w/ Claude code) #5918: Creator properties always come first in 3.x (reported by Marco B) (fix by @cowtowncoder) #5923: Deserialization behavior change with Records, `@JsonCreator` and `@JsonValue` (reported, fixed by Joshua A) #5925: Pass dynamic serializer for `Iterable` content filtering (fixed by Lee Jiwon) #5931: Fix `AtomicLongDeserializer` value truncation on coerced values (fixed by Lee Jiwon) #5941: `MapperBuilder.addModule()` does not recursively register transitive module dependencies (3.x regression from 2.x) (reported by Michael O) 3.1.2 (11-Apr-2026) #5857: `TypeFactory._fromParamType` StackOverflowError with mutually recursive generic bounds (regression in 3.1.0, introduced by fix for [databind#5285]) (reported by @sylvaindd) (fix by @pjfanning w/ @Copilot) #5865: `@JsonIgnoreProperties` does not work alongside `DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES` (reported by Lavender S) (fix by @cowtowncoder, w/ Claude code) #5867: Fix `Map.Entry` deserialization for property-level `Shape.NATURAL` override (fixed by Lee Jiwon) #5870: `EnumMap` and `EnumSet` properties ignore `@JsonDeserialize(contentConverter)` (fixed by Lee Jiwon) #5884: Exception when using `@JsonUnwrapped` alongside with `@JsonAlias` on another property (reported by Aleksandr G) (fix by @cowtowncoder, w/ Claude code) #5891: `EnumMapDeserializer._deserializeUsingProperties()` corrupts parser state after skipping unknown enum keys (fixed by Lee Jiwon) 3.1.1 (27-Mar-2026) #5710: `ObjectWriter` transforms polymorphic types into a tree incompletely (reported by Brandon S) (fix by @cowtowncoder, w/ Claude code) #5716: `@JsonUnwrapped` properties moved to end in 3.1.0 (reported by Viktor S) (fix by @cowtowncoder, w/ Claude code) #5728: `@JsonUnwrapped`doesn't work for delegating ValueDeserializer (even one delegating to `BeanDeserializerBase`) (reported by Alessandro N) #5785: Wrong path in `InvalidFormatException` for nested fields and `BuilderBasedDeserializer` (reported and fixed by David A) #5786: Regression in `TokenBuffer#forceUseOfBigDecimal` (reported by Sébastien D) (fix by @cowtowncoder, w/ Claude code) #5813: `JsonMapper` not thread-safe when using custom serializers (reported by Stephan L) (fix by @pjfanning) #5814: Enum deserialization does not respect `JsonFormat.Feature.ACCEPT_CASE_INSENSITIVE_VALUES` override (reported by David N) (fix by @cowtowncoder, w/ Claude code) #5819: `JsonNodeFeature.STRIP_TRAILING_BIGDECIMAL_ZEROES` not working with `ObjectMapper.valueToTree()` (reported by @pankajxeine) (fix by @cowtowncoder, w/ Claude code) #5840: Jackson 2.21 throws Conflicting property-based creators if both default (0-arg) and multi-arg constructor annotated (reported by Alexey T) (fix by @pjfanning) 3.1.0 (23-Feb-2026) #221: Support alternate radixes when writing numeric values as strings (requested by Christopher C) (implementation by Davyd F) #429: Cannot use property annotations on `StackTraceElement` to configure deserialization (reported by Gary G) #650: `@JsonUnwrapped` prevents checks for `DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES` (reported by Konstantin L) (fix by @JacksonJang) #1196: Add opt-in error collection for deserialization (requested by @odrotbohm) (contributed by @sri-adarsh-kumar) #1391: Default typing adds typing info to collections even with `@JsonTypeInfo(use = Id.NONE)` override (reported by Jeff M) (fix by @cowtowncoder, w/ Claude code) #1419: `JsonFormat.Shape.POJO` does not work for `Map.Entry` via property annotation (fix by @cowtowncoder, w/ Claude code) #1497: Allow skipping `@JsonUnwrapped` values if no properties matched, `DeserializationFeature.USE_NULL_FOR_EMPTY_UNWRAPPED` enabled (requested by Victor N) (fix by @JacksonJang) #1516: Problem with multi-argument Creator with `@JsonBackReference` property (reported by @sarahlikesglitter) (fix by @JacksonJang) #1649: `@JsonInclude(content=)` not working for `Map`-valued properties via POJO class annotation (fix by @cowtowncoder, w/ Claude code) #1654: @JsonDeserialize(contentUsing=...) is ignored if content type is determined by @JsonTypeInfo (reported by @pdegoeje) (fix by @cowtowncoder, @JacksonJang) #1811: `@JsonAnySetter` and `@JsonUnwrapped` deserialize property twice (reported by @jearton) #1980: Add method `remove(JsonPointer)` in `ContainerNode` (fix by @cowtowncoder, w/ Claude code) #2124: Allow coercion of '[ ]' into empty/null String with `ACCEPT_EMPTY_ARRAY_AS_NULL_OBJECT` (reported by Ulf A) (fix by @cowtowncoder, w/ Claude code) #2343: Add `JsonNode.asArray()` and `JsonNode.asObject()` (requested by Victor N) #2438: Prevent use of setter/field in case Creator property already exists, duplicate value seen #2617: `@JsonDeserialize.converter` from an interface doesn't work (reported by Erik H) #2624: Allow overriding builder's "withPrefix" with new `@JsonDeserialize.builderPrefix` property (requested by Kenneth J) #2686: `@JsonBackReference` does not work with a builder (reported by @janrieke) (fix by @JacksonJang) #3079: Support `ObjectMapper.updateValue()` for Record classes (requested by Dávid C) #3084: `Nulls.AS_EMPTY` doesn't work for collections containing values without default constructor (like Records) (reported by Krzysztof K) (fix by @cowtowncoder, w/ Claude code) #3163: Huge performance problem deserializing `java.nio.file.Path` with existing Windows Samba/CIFS mounts (reported by @Gaibhne) #3188: Skip unknown `Enum` keys in `Map` deserialization (requested by @matthias-mueller) (fixed by Lee Jiwon) #3284: Backward compatibility for timezone formats of UTC Date serialization (requested by @arungitan) (implemented by Lee Jiwon) #3304: Backreference not set after deserialization for Abstract types with `@JsonBackReference` only in sub-type (reported by @Njimefo) #3349: `DeserializationProblemHandler.handleUnexpectedToken()` no longer invoked for array-like types (reported by @andpal) #3786: Deserialization of generic container (of Record type) using `EXTERNAL_PROPERTY` fails for "natural" types (`boolean`/`long`/`String`/`double`) because type information is missing (fix by @cowtowncoder, w/ Claude code) #3964: Deserialization issue: MismatchedInputException, Bean not yet resolved (reported by @detomarco) #4118: Deserialization of a certain kinds of parametrized properties fail to resolve `?` into expected bounds, resulting in `LinkedHashMap` (reported by @Mariusz) (fix by @cowtowncoder, w/ Claude code) #4157: Add `MapperFeature.INFER_RECORD_GETTERS_FROM_COMPONENTS_ONLY` to ignore getter method auto-detection for Records (suggested by Garret W) (fix by @cowtowncoder, w/ Claude code) #4277: Deserialization `@JsonFormat(shape = JsonFormat.Shape.ARRAY)` POJO with `JsonTypeInfo.As.EXTERNAL_PROPERTY` does not work (reported by James M) (implemented by @cowtowncoder, w/ Claude code) #4629: `@JsonIncludeProperties` and `@JsonIgnoreProperties` ignored when deserializing Records (reported by Sim Y-T) (fix contributed by @JacksonJang) #4690: InvalidDefinitionException "No fallback setter/field defined for creator property" when deserializing JSON with dup property to single-property Record (reported by @sseelmann) (fix contributed by @JacksonJang) #4708: `JsonTypeInfo.Id.DEDUCTION` should block signatures for non-instantiable types (abstract classes, interfaces) (implemented by @cowtowncoder, w/ Claude code) #4729: Object ID handling tries (unnecessarily) to set id value on a Record (reported by John H) (implemented by @cowtowncoder, w/ Claude code) #5115: `@JsonUnwrapped` Record deserialization can't handle name collision (reported by Viktor S) (fix contributed by @JacksonJang) #5184: `@JsonIgnore` on record method applied to record matching field at deserialization (reported by @emouty) #5188: Prevent use of unsupported `@JsonManagedReference`/`@JsonBackReference` for Record-valued properties (reported by @JBodkin-Amphora) (implemented by @cowtowncoder, w/ Claude code) #5223: Java Records missing type information with `DefaultTyping.NON_FINAL` (add `DefaultTyping.NON_FINAL_AND_RECORDS`) (requested by @cndqjacndqja) (implemented by @chanwonlee) #5285: Generics using wildcard not correctly resolved (reported by @wimdeblauwe) (implemented by @cowtowncoder, w/ Claude code) #5312: `JsonInclude.Include.NON_DEFAULT` regression for objects with `@JsonValue` (reported by @LSwiatek) (implemented by @cowtowncoder, w/ Claude code) #5350: Add `DeserializationFeature.USE_NULL_FOR_MISSING_REFERENCE_VALUES` for selecting `null` vs "empty/absent" value when deserializing missing `Optional` value #5361: Fix Maven SBOM publishing (worked in 3.0.0-rc4 but not in rc5 or later) (date-time)#359: `InstantDeserializer` deserializes the nanosecond portion of fractional negative timestamps incorrectly #5369: Support `@JsonInclude.content` for `Collection`s (with `SerializationFeature.APPLY_JSON_INCLUDE_FOR_CONTAINERS`) (implementation by Joo-Hyuk K) #5405: `@JsonFormat(shape = Shape.POJO)` does not work for `java.util.Map` serialization via property annotation (fix contributed by @JacksonJang) #5413: Add/support forward reference resolution for array values (contributed by Hélios G) #5442: Make `JsonMapper/ObjectMapper` fully proxyable by CGLIB (fix contributed by Fouad A) #5456: Additional configuration (`JsonNodeFeature.STRIP_TRAILING_BIGDECIMAL_ZEROES`: true) to MapperBuilder#configureForJackson2 to closer match Jackson 2 behavior (contributed by @nrayburn-tech) #5469 : Add callback in `DeserializationProblemHandler` for "null for primitive" problem case (reported by @jnizet) (fixed by Joo-Hyuk K) #5475: Support `@JsonDeserializeAs` annotation (implemented by @cowtowncoder, w/ Claude code) #5485: Unchecked conversion warning in `JsonMapper` wrt `TreeCodec.readTree()` override (reported by Francesco C) #5515: Support `@JsonInclude.content` for Arrays (implemented by @JacksonJang) #5519: Add 2 new `JavaTimeFeature`s: (`TRUNCATE_TO_MSECS_ON_WRITE`, `TRUNCATE_TO_MSECS_ON_READ`) for truncating `java.time` values before serialization, after deserialization (implemented by @cowtowncoder, w/ Claude code) #5522: `@JsonFormat(with = JsonFormat.Feature.ACCEPT_SINGLE_VALUE_AS_ARRAY)` doesn't work on custom Collection subclass (contributed by Jaeheon K) #5528: `TreeBuildingGenerator#writeNumber(String)` writes Number as String (reported by @gaeljw) #5541: Add missing `@JsonIdentityInfo` handling for implicit arrays with `DeserializationFeature.ACCEPT_SINGLE_VALUE_AS_ARRAY` (contributed by Moritz R) #5542: `ObjectReader.readValue()` does not fail when `DeserializationFeature.FAIL_ON_UNRESOLVED_OBJECT_IDS` enabled (implemented by @cowtowncoder, w/ Claude code) #5558: Change defaulting of `JsonNode.asXxx(defaultValue)`/`JsonNode.asXxxOpt()` for `NullNode` (contributed by Filip H) #5570: Add `MapperFeature.WRAPPERS_DEFAULT_TO_NULL` to allow configuring `JsonInclude.Include.NON_DEFAULT` default for primitive wrapper types to be `null`, not wrapped default of primitive #5575: Allow configuring a default serialization and deserialization view (3.x) (requested by Réda H-A) (implemented by @cowtowncoder, w/ Claude code) #5579: Add `JsonNode.map()` method #5581: Add functional conversion methods `JsonNode.nullAs()`, `JsonNode.missingAs()` #5583 Improve `asXxx()` method impls of `MissingNode`, `POJONode(null)`, to work like `NullNode` (implemented by @cowtowncoder, w/ Claude code) #5586: Change `IndexOutOfBoundsException` that `ArrayNode.set()`/`replace()` throw to `JsonNodeException` #5595: Add `FunctionalScalarDeserializer` for functional-style deserialization (contributed by @jhan0121) #5599: Reduce mutability of `JsonFormatVisitor` types in 3.1 #5616: `ObjectWriter` serializes `Optional`s with subtypes incompletely (reported by Brandon S) (implemented by @cowtowncoder, w/ Claude code) #5621: Fix typo: MissingInjectableValueExcepion → MissingInjectableValueException (implemented by Lee Jiwon) #5630: Add `DelegatingSerializer` (contributed by Matthew L) #5631: Rename `StdDelegatingSerializer` to `StdConvertingSerializer` (3.0->3.1) #5642: Wrap `DateTimeException` and `ArithmeticException` in new `DateTimeParseException` during java.time deserialization (implemented by @pjfanning) #5646: `ObjectArrayDeserializer` may throw `ArrayStoreException` for some special cases (fixed by @cowtowncoder, w/ Claude code) #5649: Wrap `LocalDate.ofEpochDay()` and `Instant.ofEpochSecond()` to throw `DateTimeParseException` on invalid values (implemented by @pjfanning) #5674: Fix NPE when deserializing `Throwable` with `null` "stackTrace" (fix by @pjfanning) #5683: When deserializing using `ObjectMapper::treeToValue`, NPE occurs when `JsonParser::readValueAs` is called (reported by @wrongwrong) #5685: Fix issue where `_findSerializer()` was called with incorrect argument in `StdDelegatingSerializer::isEmpty()` (fixed by @wrongwrong) #5686: Fix NPE where code can look for an objectId when no `_objectIdReader` is set (fix by @pjfanning) #5691: Validate `ByteBufferBackedInputStream.read()` parameters per `InputStream` contract (fix by @pjfanning) #5706: `TokenBuffer` serialization fails when buffer contains integer encoded as String (reported by Kyrylo M) 3.0.4 (21-Jan-2026) #1288 (regression in 3.0.0) Type id not exposed for `JsonTypeInfo.As.EXTERNAL_PROPERTY` even when `visible` set to `true` #2580: Regression with External type id / Build deserialization in 3.0 #4742 (regression in 3.0.0) Deserialization with Builder, External type id, `@JsonCreator` failing #5481: JsonMapper.Builder.modules(...) ignores changes after build() due to internal saveState (reported by @libetl) (fix by @cowtowncoder, w/ Claude code) 3.0.3 (28-Nov-2025) #5393: `@JsonAnyGetter` property gets included in generated schema (reported by @victor-noel-pfx) (fix by Joo-Hyuk K) #5398: `@JsonProperty.value` + `@JsonIgnore` on setter does not work anymore since 2.18.4 (reported by @victor-noel-pfx) (fix by @cowtowncoder, w/ Claude code) #5401: Regression with `@JsonCreator` that returns `null` for empty strings (fix contributed by Joost K) #5408: Jackson 3 `JsonNode#required(java.lang.String)` throws `JsonNodeException` different from JavDoc (reported by @jochenberger) (fix by Joo-Hyuk K) #5414: `NullPointerException` in `AnnotatedMember.annotations()` when no annotations are present (reported by Benjamin H) #5416: Annotations on an interface that's part of a JDK proxy are not honored with Jackson 3 (reported by Andy W) (fix contributed by Fouad A) 3.0.2 (07-Nov-2025) #5203: Fix `null` handling of `EnumSetDeserializer` #5372: Wrong setter is used when deserializing from `InputStream` (or `byte[]`) (NOTE: actual fix via jackson-core#1491) (reported by @quaff) 3.0.1 (21-Oct-2025) #5335: JsonMapper to deserialize `Optional.empty()` instead of `null` in case of missing property (2.x compatibility) (^^^ REVERT #3601) (reported by @wendigo) #5340: `DeserializationFeature.ACCEPT_FLOAT_AS_INT` not respected for byte/short when deserializing from JsonNode (reported by @Artur) #5344: "Unexpected end-of-input" for `JsonParser.readValueAs()` (in 3.0) (reported by Phil C) #5354: jackson-databind 3.0.0 renders `callbacks` property from Spring CGLIB Proxy (reported, fix contributed by Rob W) 3.0.0 (03-Oct-2025) #5319: `TreeTraversingParser` does not respect `DeserializationFeature.ACCEPT_FLOAT_AS_INT` (reported by @Artur) #5323: `UUID` serialization is broken in v3.0.0-rc9 (reported by Dónal M) 3.0.0-rc10 (19-Sep-2025) #5272: Replace `ObjectMapper.getRegisteredModuleIds()` (2.x) with `ObjectMapper.registeredModules()` (3.0) #5302: Add one more parameter for `AnnotationIntrospector.findPreferredCreator()` method #5309: Confusing exception for `DoubleNode` to `Integer` conversion in Jackson 3 (reported by @caalador) (fixed by Joo-Hyuk K) #5314: Add `MapperFeature.DETECT_PARAMETER_NAMES` to allow disabling `parameter-names` functionality (fixed by Joo-Hyuk K) #5318: Allow auto-detection of Properties-based Constructor even if class has no-parameters (default) Constructor 3.0.0-rc9 (05-Sep-2025) #4310: `ParameterNamesModule` causes `@ConstructorProperties` to be ignored, constructor called with null value (reported by Lars B) #5244: Support accessing annotations via `AnnotatedMember.annotations()` (requested by David N) #5263: Remove deprecated `URL`-taking `readValue()` methods in `ObjectMapper`, `ObjectReader` from 3.0 #5270: Remove `ObjectMapper.setSerializationInclusion()` from 3.0 (deprecate in 2.20) #5287: Change JsonNode.stringValue() of NullNode to return null, not fail (3.0) 3.0.0-rc8 (13-Aug-2025) No changes since 3.0.0-rc7 3.0.0-rc7 (08-Aug-2025) #5231: Deserialization through setter with `vararg` parameter fails `ClassCastException` (reported by @tsegall) (contributed by Joo-Hyuk K) 3.0.0-rc6 (18-Jul-2025) #5225: `NullPointerException` in `ObjectMapper.valueToTree(UUID)` (reported by @ kiryong-lee) 3.0.0-rc5 (22-May-2025) #4907: Reduce/eliminate introspection on `java.*` classes (requested by Guillaume S) #5158: Add "optional" variants -- shortValueOpt(), floatValueOpt(), asShortOpt(), asFloatOpt() (contributed by Yu Han) #5169: Add missing methods in `Serializers` for Enum and TreeNode types (3.0) 3.0.0-rc4 (10-May-2025) #1484: Changed default of `MapperFeature.DEFAULT_VIEW_INCLUSION` to `false` in 3.0 #2083: Replace Reflection usage with `MethodHandle` (3.0) (contributed by Steven S) #5078: Create proper `MonthDeserializer` and `MonthSerializer` (don't rely on `EnumDeserializer`/`EnumSerializer`) (fixed by Joo-Hyuk K) #5093: Change the way `BeanDescription` passed during serializer construction to use `Supplier` #5094: Change the way `BeanDescription` passed during deserializer construction to use `Supplier` #5110: Add missing `ObjectMapper#createNonBlockingByteBufferParser()` method (requested by Sébastien D) #5111: Improve support for deserializing from `TokenBuffer` (f.ex for content buffered for non-blocking parsing) (requested by Sébastien D) #5112: Add a `MapperBuilder#findAndAddModules(ClassLoader)` variant (requested by Sébastien D) #5138: add `asShort()`, `asFloat()` conversion methods (contributed by Yu Han) #5153: Improve error handling for numeric values in `POJONode` (contributed by Yu Han) 3.0.0-rc3 (13-Apr-2025) #4603: Keep full stacktrace when re-throwing exception with `DatabindException` during deserialization (fixed by Joo-Hyuk K) #5032: Move `jackson-datatype-jsr310` module into `jackson-databind` and rename `JavaTimeFeature` from `jackson-datatype-jsr310` module as `DateTimeFeature` (implemented by @pjfanning) #5065: Change default for `DateTimeFeature.ONE_BASED_MONTHS` to `true` in 3.0 #5066: Move date/time `SerializationFeature`s into `DateTimeFeature` (3.0) #5067: Move date/time `DeserializationFeature`s into `DateTimeFeature` (3.0) #5079: Move Enum-related DeserializationFeatures into EnumFeature (3.0) (contributed by Joo-Hyuk K) #5080: Move Enum-related SerializationFeatures into EnumFeature (3.0) (contributed by Joo-Hyuk K) - Branch rename "master" -> "3.x" [JSTEP-12] 3.0.0-rc2 (28-Mar-2025) #2882: Tighten accessor naming rules to not allow leading lower-case or non-letter character for getters/setters #5003: Extend, improve set of `JsonNode.asXxx()` methods for number types #5025: Add support for automatic detection of subtypes (like `@JsonSubTypes`) from Java 17 sealed types (contributed by Andy B) #5034: Extend, improve set of `JsonNode.asXxx()` methods for non-number types (Boolean, String) 3.0.0-rc1 (07-Mar-2025) #493: Change `DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES` default to `false` (contributed by Joo-Hyuk K) #1058: Add a way to pass std and format-specific parser/generator flags during parser/generation construction #1600: Serializing locale with underscore, not standard hyphen (requested by Alexander K) #1762: `StdDateFormat`: serialize time offset using colon #1772: Remove `MapperFeature. USE_STD_BEAN_NAMING` #1773: Remove `MapperFeature.AUTO_DETECT_xxx` features #1774: Merge Java8 datatype (`Optional`, `Stream`) support (`jackson-datatype-jdk8`) #1775: Merge Java8 parameter name support (`jackson-module-parameter-names`) #1781: Return `ObjectNode` from `ObjectNode` set-methods in order to allow better chaining (reported by timo-schmid@github) #1789: Add `createGenerator` methods in `ObjectMapper`, `ObjectWriter` #1790: Add `createParser` methods in `ObjectMapper`, `ObjectReader` #1829: `JsonNode.deepCopy() `ClassCastException`s (reported by @D3v01dZA) #1883: Add "abstract type mapping" for deserialization from `Map` into `EnumMap` (and `Set` to `EnumSet`) #1888: Merge `ResolvableSerializer` into `JsonSerializer`, `ResolvableDeserializer` into `JsonDeserializer` #1889: Merge `ContextualSerializer` into `JsonSerializer`, `ContextualDeserializer` into `JsonDeserializer` #1916: Change `MapperFeature.USE_GETTERS_AS_SETTERS)` default to `false` #1917: Remove `canSerialize` and `canDeserialize` methods from `ObjectMapper` #1954: Add Builder pattern for creating configured `ObjectMapper` instances #1955: Change the way `Module`s configure, interact with `ObjectMapper` #1973: Remove support for "default [Map] key serializer" configuration from `SerializerProvider` #1994: Limit size of `SerializerCache`, auto-flush on exceeding #1995: Limit size of `DeserializerCache`, auto-flush on exceeding #2013: Allow use of `java.nio.file.Path` for `readValue()`, `writeValue()` (requested by @XakepSDK; contributed by Sven D) #2040: Remove `JsonSerializer.isEmpty()` from 3.0 #2176: Add `JsonMapper.shared()` static method #2177: Change parent type of `JsonProcessingException` to be `RuntimeException` #2382: Support `AutoCloseable` with `SerializationFeature.CLOSE_CLOSEABLE` (requested by @Logic-32) #2405: Make `java.sql.Date` serializer default to same output as `java.util.Date` #2411: Allow `valueToTree()` via `SerializationContext`, add to `ObjectWriter` (requested by @XakepSDK) #2539: Add `Deserializers.hasDeserializerFor()` (and something for `DeserializerFactory`) to allow detection of explicitly supported types #2593: StackTraceElement w/ >= Java 9 doesn't deserialize properly (requested by Michael D) #2713: Change wording of `UnrecognizedPropertyException` to refer to "property" not "field" #2828: Add `DatabindException` as intermediate subtype of `JsonMappingException` #3028: Change `UUIDSerializer` to use `StreamWriteCapability` check instead of `JsonGenerator.canWriteBinaryNatively()` #3037: Rename `Module` as `JacksonModule` in 3.0 (to avoid overlap with `java.lang.Module`) #3043: Rename `SerializerProvider` as `SerializationContext` #3044: Rename `JsonDeserializer`/`JsonSerializer` as `ValueDeserializer`/`ValueSerializer` #3046: Rename `JsonSerializable` as `JacksonSerializable` #3047: Rename `Bean[De]SerializerModifier` as `Value[De]SerializerModifier` #3070: Change default for `SerializationFeature.FAIL_ON_EMPTY_BEANS` to `false` #3406: Change default of `DeserializationFeature.FAIL_ON_TRAILING_TOKENS` to `true` (suggested by @yawkat) #3522: Support serializing `ByteArrayOutputStream` as "simple" Binary value #3536: Create new exception type `JsonNodeException` for use by `JsonNode`-related problems #3542: Rename "com.fasterxml.jackson" -> "tools.jackson" #3561: Add `DeserializationContext` as an argument for `SettableBeanProperty.set(...)` (REVERTED in 3.0.1) #3601: Change `Optional` deserialization from "absent" value into `null`, from "empty" #4160: Deprecate `DefaultTyping.EVERYTHING` in `2.x` and remove in `3.0` #4381: Prevent construction of `null`-valued `JsonNode`s (like `TextNode`) #4552: Change `MapperFeature.ALLOW_FINAL_FIELDS_AS_MUTATORS` default to `false` #4566: Enable `DeserializationFeature.READ_ENUMS_USING_TO_STRING` by default (contributed by Joo-Hyuk K) #4567: Enable `SerializationFeature.WRITE_ENUMS_USING_TO_STRING` by default (contributed by Joo-Hyuk K) #4572: Change `MapperFeature.SORT_PROPERTIES_ALPHABETICALLY` default to true (contributed by Joo-Hyuk K) #4589: Remove `MapperFeature.SORT_CREATOR_PROPERTIES_BY_DECLARATION_ORDER` from 3.0; make logic default #4659: Remove use of global static `TypeFactory` singleton from 3.0 #4664: Change `EnumNamingStrategy.convertEnumToExternalName()` to take `MapperConfig` argument- (contributed by Joo-Hyuk K) #4818: Rename `AnnotationIntrospector.findDefaultCreator()` as `findPreferredCreator()` #4820: Change JDK baseline for Jackson 3.0 from Java 8 to Java 17 #4835: Remove dynamic work-arounds wrt accessing `Record` definition #4840: Increase minimum Android SDK required to 34 for Jackson 3.0 #4845: Change default of `DateTimeFeature.WRITE_DURATIONS_AS_TIMESTAMPSATES_AS_TIMESTAMPS` to `false` in 3.0 #4846: Change default of `DateTimeFeature.WRITE_DURATIONS_AS_TIMESTAMPS` to `false` in 3.0 #4858: Change default of `DeserializationFeature.FAIL_ON_NULL_FOR_PRIMITIVES` to `true` for 3.0 #4875: Remove `JsonNode.fields()` from 3.0 #4879: Rename `TextNode` as `StringNode`; `JsonNode.xxxTextYyy()` (mostly) as `JsonNode.xxxStringYyy()` [JSTEP-3] #4891: Change 3.0 to use `module-info.java` directly for build (instead of via Moditect) #4956: Rename `JsonNode.isContainerNode()` as `isContainerNode()` #4958: Extend, improve set of number value accessors for `JsonNode` (`JsonNode.intValue()` etc) [JSTEP-3] #4991: Extend, improve set of non-number scalar value accessors for `JsonNode` (`JsonNode.booleanValue()` etc) [JSTEP-3] #4992: Rename `JsonNodeFactory.textNode()` as `JsonNodeFactory.stringNode()` [JSTEP-3] #5004: Add `JsonMapper.builderWithJackson2Defaults()` (fixed by @pjfanning) - Remove `MappingJsonFactory` - Add context parameter for `TypeSerializer` contextualization (`forProperty()`) - Default for `JsonNodeFeature.STRIP_TRAILING_BIGDECIMAL_ZEROES` changed to `false` for 3.0