Jackson Release 2.21.9

Patch version of 2.21, under development as of October 2026.

Following fixes will be included in this patch release.

• #1792: Validate maxStringLength for string values in getString(Writer)
• #1794: maxStringLength not enforced by getBinaryValue() when decoding Base64 directly from input
• #1800: Don't read past end of byte[] slice for UTF-16 input in ByteSourceJsonBootstrapper
• #1813: getDoubleValue() returns 0.0 after getNumberType(), getFloatValue() for floating-point value
• #1815: Stale BigDecimal from previous token returned by getBigIntegerValue() after getNumberType()

• #6315: Map key deserializers should apply same type checks as bean deserializers
• #6329: Add JDK-bundled RowSet gadget siblings to deserialization deny-list
• #6422: Make MapperFeature.BLOCK_UNSAFE_POLYMORPHIC_BASE_TYPES apply to Default Typing

• #896: Reject negative byte size of skipped Avro Array/Map block
• #901: Read string values and Map keys in chunks in Apache Avro decoder

• #888: nextFieldName(SerializableString) matches against JSON-escaped name bytes (asQuotedUTF8())

• #881: Known field after a skipped unknown field gets wrong wire type / state / location, differently per nextToken() / nextName*()

• #888: nextFieldName(SerializableString) matches against JSON-escaped name bytes (asQuotedUTF8())
• #895: Enforce maxNestingDepth in non-blocking Smile parser