Skip to content

Jackson Release 2.18.13

Jump to bottom
Tatu Saloranta edited this page Nov 11, 2026 · 6 revisions

Possible patch version of 2.18, open for development as of October 2026.

Following fixes would be included in this patch release.

Changes, core

Streaming

  • #1792: Validate maxStringLength for string values in getString(Writer)
  • #1794: maxStringLength not enforced by getBinaryValue() when decoding Base64 directly from input

Databind

  • #6315: Map key deserializers should apply same type checks as bean deserializers
  • #6329: Add JDK-bundled RowSet gadget siblings to deserialization deny-list
  • #6422: Make MapperFeature.BLOCK_UNSAFE_POLYMORPHIC_BASE_TYPES apply to Default Typing

Clone this wiki locally