Jackson Release 3.1.9

Patch version of 3.1, under development as of October 2026.

Following fixes will be included in this patch release.

• #1782: Overlong 2- and 3-byte UTF-8 sequences in String values and comments are decoded instead of rejected
• #1784: UTF-8 parsers may return wrong cached property name for names containing 0xFF bytes
• #1787: CharTypes#charToHex handles non-ASCII incorrectly
• #1792: Validate maxStringLength for string values in getString(Writer)
• #1794: maxStringLength not enforced by getBinaryValue() when decoding Base64 directly from input
• #1795: UTF8DataInputJsonParser accepts any control character as white space between tokens
• #1800: Don't read past end of byte[] slice for UTF-16 input in ByteSourceJsonBootstrapper
• #1813: getDoubleValue() returns 0.0 after getNumberType(), getFloatValue() for floating-point value
• #1814: getBigIntegerValue() fails after getNumberType(), getDoubleValue()/getFloatValue() for BigInteger
• #1815: Stale BigDecimal from previous token returned by getBigIntegerValue() after getNumberType()

• #6077: FAIL_ON_UNEXPECTED_VIEW_PROPERTIES not being respected with constructor-backed properties
• #6210: @JsonAlias ignored in enum if @JsonValue is present
• #6295: @JsonInclude(NON_DEFAULT) omits a changed array property when the default array contains null
• #6296: Duplicate properties merged under the wrong key in non-vanilla UntypedObjectDeserializer
• #6300: NPE when a DeserializationProblemHandler returns null for byte[] (single value unwrapped) and char[] elements
• #6305: InetSocketAddress deserialization ignores text after the closing bracket of an IPv6 address
• #6306: NPE serializing @JsonIdentityReference(alwaysAsId = true) to an object whose id is null
• #6309: NPE serializing an Enum whose toString() returns null
• #6315: Map key deserializers should apply same type checks as bean deserializers
• #6329: Add JDK-bundled RowSet gadget siblings to deserialization deny-list
• #6332: @JsonUnwrapped drops/rejects the type id property of a polymorphic unwrapped value
• #6338: readerForUpdating() ignores @JsonSetter(nulls = Nulls.SKIP) for creator properties: existing value is overwritten with null
• #6339: Enum aliases from an appended AnnotationIntrospector are discarded: JacksonAnnotationIntrospector.findEnumAliases() overwrites every slot
• #6342: @JacksonStdImpl on BooleanSerializer.AsNumber (3.1.6) makes Blackbird write primitive boolean getters as true/false instead of 1/0
• #6350: allowSubTypesWithExplicitDeserializer() denies java.sql.Date and java.sql.Timestamp: hasExplicitDeserializerFor() returns false for them
• #6422: Make MapperFeature.BLOCK_UNSAFE_POLYMORPHIC_BASE_TYPES apply to Default Typing
• #6426: Varargs delegating @JsonCreator fails with "Cannot cast [Ljava.lang.String; to java.lang.String"
• #6437: OptionalInt/OptionalLong/OptionalDouble deserializers report AccessPattern.ALWAYS_NULL but return an empty Optional
• #6443: JDK deserialization of a JsonNode with a negative length prefix throws NegativeArraySizeException instead of an IOException

• #896: Reject negative byte size of skipped Avro Array/Map block
• #901: Read string values and Map keys in chunks in Apache Avro decoder

• #876: nextNameMatch() mixes up unknown property names differing only by NUL bytes (unpadded symbol-table lookup)
• #882: nextNameMatch() does not pop stringref nesting on END_OBJECT, resolves later stringrefs against wrong namespace
• #870: Reject 0xFF lead byte in last quad of property names
• #888: nextFieldName(SerializableString) matches against JSON-escaped name bytes (asQuotedUTF8())

• #874: nextName() / nextNameMatch() do not skip an unread string value, decode its bytes as the next tag
• #879: nextName() / nextNameMatch() fast paths skip per-token state reset done by nextToken() (stale number, wrong token location)
• #881: Known field after a skipped unknown field gets wrong wire type / state / location, differently per nextToken() / nextName*()

• #869: Reject 0xFF lead byte in last quad of property names
• #873: nextNameMatch() misreads short non-ASCII property names (input not advanced on symbol-table hit, wrong quad count)
• #888: nextFieldName(SerializableString) matches against JSON-escaped name bytes (asQuotedUTF8())
• #895: Enforce maxNestingDepth in non-blocking Smile parser

• #663: TOML parser: int64 max value parsed as truncated long

• #363: Blackbird ignores @JsonSetter(nulls = Nulls.SKIP) for properties of beans with a properties-based creator
• #364: Blackbird: use generated setters for builder-based deserialization
• #366: Blackbird: skip generated setters the accessor can't call
• #367: Blackbird: avoid retrying failed bean setters
• #375: Blackbird: use generated accessors for primitive double properties
• #377: Don't generate getters for inaccessible getters made accessible

• #223: Reading List<List<X>> or List<String[]> never returns when an element isn't an array