GeezerVison

This upgrade from version 2.14.2 to 2.18.12 spans multiple minor releases and introduces significant behavioral changes, primarily for security and robustness. While no major API removals are noted, the changes require verification.

Key Breaking Changes:

• Processing Limits (DoS Protection) in 2.15+: To prevent Denial of Service attacks from malicious payloads, Jackson now enforces default limits on incoming JSON. Exceeding these limits will throw a StreamConstraintsException.
  • Max Nesting Depth: Default is 1000 levels.
  • Max Number Length: Default is 1000 characters.
  • Max String Length: Default is 5,000,000 characters.
• Stricter Number Parsing in 2.17+: Strings with leading zeros (e.g., "07") are no longer automatically coerced into numbers for constructs like Enum indexes.
• Security Default Change in 2.16+: The default for StreamReadFeature.INCLUDE_SOURCE_IN_LOCATION has been changed to false to avoid leaking source information in error messages.
• Avro Module Dependency in 2.18+: If you use the jackson-dataformat-avro module, its core dependency was upgraded to Avro 1.11.3. Schemas generated with this version may not be readable by older clients.

Recommendation:
Verify if your application processes very large or deeply nested JSON documents. If so, you may need to create a custom JsonFactory with adjusted StreamReadConstraints to avoid runtime exceptions. Review code that relies on string-to-number coercion, especially for enums.

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}