Autodetect classes in ObjectMapper

.github/workflows/dep_build_v2.yml

@@ -11,12 +11,11 @@ permissions:
 jobs:
   build:
     # Do we want wide matrix build? For now, limited
-    runs-on: ${{ matrix.os }}
+    runs-on: 'ubuntu-latest'
     strategy:
       fail-fast: false
       matrix:
         java_version: ['8', '17', '21']
-        os: ['ubuntu-22.04']
     env:
       JAVA_OPTS: "-XX:+TieredCompilation -XX:TieredStopAtLevel=1"
     steps:

.github/workflows/dep_build_v3.yml

@@ -11,18 +11,17 @@ permissions:
 jobs:
   build:
     # Do we want wide matrix build? For now, limited
-    runs-on: ${{ matrix.os }}
+    runs-on: 'ubuntu-latest'
     strategy:
       fail-fast: false
       matrix:
         java_version: ['17', '21']
-        os: ['ubuntu-22.04']
     env:
       JAVA_OPTS: "-XX:+TieredCompilation -XX:TieredStopAtLevel=1"
     steps:
     - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       with:
-        ref: master
+        ref: 3.x
     - name: Set up JDK
       uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0
       with:

.github/workflows/main.yml

@@ -1,18 +1,11 @@
 name: Build and Deploy Snapshot
 on:
   push:
-    branches:
-    - master
-    - "3.0"
-    - "2.19"
+    branches: ['2.*']
     paths-ignore:
     - "README.md"
     - "release-notes/*"
   pull_request:
-    branches:
-    - master
-    - "3.0"
-    - "2.19"
     paths-ignore:
     - "README.md"
     - "release-notes/*"
@@ -26,11 +19,11 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        java_version: ['8', '11', '17', '21', '23']
-        os: ['ubuntu-22.04']
+        java_version: ['8', '11', '17', '21', '24']
+        os: ['ubuntu-24.04']
         include:
           - java_version: '8'
-            os: 'ubuntu-22.04'
+            os: 'ubuntu-24.04'
             release_build: 'R'
           - java_version: '8'
             os: 'windows-latest'
@@ -45,7 +38,7 @@ jobs:
         distribution: 'temurin'
         java-version: ${{ matrix.java_version }}
         cache: 'maven'
-        server-id: sonatype-nexus-snapshots
+        server-id: central-snapshots
         server-username: CI_DEPLOY_USERNAME
         server-password: CI_DEPLOY_PASSWORD
         # See https://github.com/actions/setup-java/blob/v2/docs/advanced-usage.md#Publishing-using-Apache-Maven
@@ -63,8 +56,8 @@ jobs:
     - name: Deploy snapshot
       if: ${{ matrix.release_build && github.event_name != 'pull_request' && endsWith(steps.projectVersion.outputs.version, '-SNAPSHOT') }}
       env:
-        CI_DEPLOY_USERNAME: ${{ secrets.CI_DEPLOY_USERNAME }}
-        CI_DEPLOY_PASSWORD: ${{ secrets.CI_DEPLOY_PASSWORD }}
+        CI_DEPLOY_USERNAME: ${{ secrets.CENTRAL_DEPLOY_USERNAME }}
+        CI_DEPLOY_PASSWORD: ${{ secrets.CENTRAL_DEPLOY_PASSWORD }}
         # MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_GPG_PASSPHRASE }}
       run: ./mvnw -B -q -ff -DskipTests -ntp source:jar deploy
     - name: Generate code coverage 
@@ -75,23 +68,23 @@ jobs:
       uses: codecov/codecov-action@0565863a31f2c772f9f0395002a31e3f06189574 # v5.4.0
       with:
         token: ${{ secrets.CODECOV_TOKEN }}
-        file: ./target/site/jacoco/jacoco.xml
+        files: ./target/site/jacoco/jacoco.xml
         flags: unittests
 
   trigger-dep-build-v2:
     name: Trigger v2 dep builds
     needs: [build]
-    # Only for pushes to default branch
-    if: ${{ github.event_name == 'push' && github.ref_name == github.event.repository.default_branch }}
+    # Only for pushes to 2.x (next 2.x being developed) branch
+    if: ${{ github.event_name == 'push' && github.ref_name == '2.x' }}
     uses: ./.github/workflows/trigger_dep_builds_v2.yml
     secrets:
       token: ${{ secrets.REPO_DISPATCH }}
 
   trigger-dep-build-v3:
     name: Trigger v3 dep builds
     needs: [build]
-    # Only for pushes to default branch
-    if: ${{ github.event_name == 'push' && github.ref_name == 'master' }}
+    # Only for pushes to 3.x branch
+    if: ${{ github.event_name == 'push' && github.ref_name == '3.x' }}
     uses: ./.github/workflows/trigger_dep_builds_v3.yml
     secrets:
       token: ${{ secrets.REPO_DISPATCH }}

.github/workflows/trigger_dep_builds_v2.yml

@@ -23,13 +23,14 @@ jobs:
           - 'FasterXML/jackson-dataformat-xml'
           - 'FasterXML/jackson-datatypes-collections'
           - 'FasterXML/jackson-datatypes-misc'
+          - 'FasterXML/jackson-datatype-hibernate'
           - 'FasterXML/jackson-datatype-joda'
           - 'FasterXML/jackson-module-kotlin'
           - 'FasterXML/jackson-module-scala'
-          - 'FasterXML/jackson-jaxrs-providers'
           - 'FasterXML/jackson-jakarta-rs-providers'
-          - 'FasterXML/jackson-integration-tests'
+          - 'FasterXML/jackson-jaxrs-providers'
           - 'FasterXML/jackson-benchmarks'
+          - 'FasterXML/jackson-integration-tests'
 
     steps:
       - name: Repository dispatch
@@ -41,5 +42,5 @@ jobs:
           # Could push information on what was built but not yet
           client-payload: '{"version": "N/A" }'
       - name: Delay between dispatches
-        run: sleep 10s
+        run: sleep 8s
         shell: bash

.github/workflows/trigger_dep_builds_v3.yml

@@ -41,5 +41,5 @@ jobs:
           # Could push information on what was built but not yet
           client-payload: '{"version": "N/A" }'
       - name: Delay between dispatches
-        run: sleep 10s
+        run: sleep 7s
         shell: bash

pom.xml

@@ -9,12 +9,11 @@
   <parent>
     <groupId>com.fasterxml.jackson</groupId>
     <artifactId>jackson-base</artifactId>
-    <version>2.19.0-SNAPSHOT</version>
+    <version>2.19.3-SNAPSHOT</version>
   </parent>
-
   <groupId>com.fasterxml.jackson.core</groupId>
   <artifactId>jackson-databind</artifactId>
-  <version>2.19.0-SNAPSHOT</version>
+  <version>2.19.3-SNAPSHOT</version>
   <name>jackson-databind</name>
   <packaging>jar</packaging>
   <description>General data-binding functionality for Jackson: works on core streaming API</description>
@@ -32,7 +31,7 @@
     <connection>scm:git:[email protected]:FasterXML/jackson-databind.git</connection>
     <developerConnection>scm:git:[email protected]:FasterXML/jackson-databind.git</developerConnection>
     <url>https://github.com/FasterXML/jackson-databind</url>
-    <tag>HEAD</tag>
+    <tag>jackson-databind-2.19.0-rc2</tag>
   </scm>
 
   <properties>
@@ -55,7 +54,11 @@
 
     <version.bytebuddy>1.15.10</version.bytebuddy>
     <version.mockito>4.11.0</version.mockito>
-    <jacocoStrict>true</jacocoStrict>
+
+    <!-- 07-Apr-2025, tatu: For some reason, release fails due to missing
+           jacoco... so disable for now
+      -->
+    <jacocoStrict>false</jacocoStrict>
 
     <!-- Can not use default, since group id != Java package name here -->
     <osgi.export>com.fasterxml.jackson.databind.*;version=${project.version}</osgi.export>
@@ -70,7 +73,7 @@
     <packageVersion.package>com.fasterxml.jackson.databind.cfg</packageVersion.package>
 
     <!-- for Reproducible Builds -->
-    <project.build.outputTimestamp>2024-09-27T01:57:15Z</project.build.outputTimestamp>
+    <project.build.outputTimestamp>2025-07-18T17:49:25Z</project.build.outputTimestamp>
   </properties>
 
   <dependencyManagement>
@@ -125,7 +128,7 @@
     <dependency>
       <groupId>com.google.guava</groupId>
       <artifactId>guava-testlib</artifactId>
-      <version>31.1-jre</version>
+      <version>32.0.1-jre</version>
       <scope>test</scope>
     </dependency>
     <!-- For testing TestNoClassDefFoundDeserializer -->
@@ -163,24 +166,24 @@
     <dependency>
       <groupId>org.junit.platform</groupId>
       <artifactId>junit-platform-suite-engine</artifactId>
-      <version>1.10.2</version>
       <scope>test</scope>
     </dependency>
     <dependency>
       <groupId>io.micronaut.test</groupId>
       <artifactId>micronaut-test-type-pollution</artifactId>
-      <version>4.6.2</version>
+      <version>4.8.1</version>
       <scope>test</scope>
     </dependency>
   </dependencies>
 
   <!-- Alas, need to include snapshot reference since otherwise can not find
        snapshot of parent... -->
   <repositories>
+    <!-- 13-May-2025, tatu: now access snapshots via Central Portal -->
     <repository>
-      <id>sonatype-nexus-snapshots</id>
-      <name>Sonatype Nexus Snapshots</name>
-      <url>https://oss.sonatype.org/content/repositories/snapshots</url>
+      <id>central-snapshots</id>
+      <name>Sonatype Central Portal (snapshots)</name>
+      <url>https://central.sonatype.com/repository/maven-snapshots</url>
       <releases><enabled>false</enabled></releases>
       <snapshots><enabled>true</enabled></snapshots>
     </repository>
@@ -264,8 +267,8 @@
         <configuration>
           <links combine.children="append">
 	    <!-- 13-Feb-2025, tatu: Should change link when 2.19.0 released -->
-            <link>https://javadoc.io/doc/com.fasterxml.jackson.core/jackson-annotations/2.18.2</link>>
-            <link>https://javadoc.io/doc/com.fasterxml.jackson.core/jackson-core/2.18.2</link>>
+            <link>https://javadoc.io/doc/com.fasterxml.jackson.core/jackson-annotations/2.18.4</link>
+            <link>https://javadoc.io/doc/com.fasterxml.jackson.core/jackson-core/2.18.4</link>
           </links>
         </configuration>
       </plugin>

release-notes/CREDITS-2.x

@@ -321,6 +321,9 @@ Michal Letynski (mletynski@github)
 Jeff Schnitzer (stickfigure@github)
   * Suggested #504: Add `DeserializationFeature.USE_LONG_FOR_INTS`
    (2.6.0)
+  * Requested #4533: Add `MapperFeature.REQUIRE_HANDLERS_FOR_JAVA8_TIMES` to disable
+    the "Java 8 date/time XYZ not supported by default" error
+   (2.19.0)
 
 Jerry Yang (islanderman@github)
   * Contributed #820: Add new method for `ObjectReader`, to bind from JSON Pointer position
@@ -1857,6 +1860,12 @@ wrongwrong (@k163377)
    `@JsonDeserialize(keyUsing = ...)` is overwritten by the `KeyDeserializer`
     specified in the `ObjectMapper`.
   (2.18.3)
+ * Contributed fix for #5139: In `CollectionDeserializer`, `JsonSetter.contentNulls`
+   is sometimes ignored
+  (2.19.1)
+ * Contributed fix for #5202: #5202: `JsonSetter.contentNulls` ignored for `Object[]`,
+  `String[]` and `Collection<String>`
+  (2.19.2)
 
 Bernd Ahlers (@bernd)
  * Reported #4742: Deserialization with Builder, External type id, `@JsonCreator` failing
@@ -1889,6 +1898,14 @@ Zhen Lin Low (@zhenlin-pay2)
    when collecting bean properties, breaking AsExternalTypeDeserializer
   (2.18.3)
 
+Fawzi Essam (@iifawzi)
+ * Contributed fix or #4628: `@JsonIgnore` and `@JsonProperty.access=READ_ONLY`
+   on Record property
+  (2.18.4)
+ * Contributed fix for #5049: Duplicate creator property "b" (index 0 vs 1)
+   on simple java record
+  (2.18.4)
+
 Liam Feid (@fxshlein)
  * Contributed #1467: Support `@JsonUnwrapped` with `@JsonCreator`
   (2.19.0)
@@ -1922,3 +1939,11 @@ Joren Inghelbrecht (@jin-harmoney)
 Will Paul (@dropofwill)
  * Contributed #4979: Allow default enums with `@JsonCreator`
   (2.19.0)
+
+Ryan Schmitt (@rschmitt)
+ * Contributed #5099: Fix regression in `ObjectNode.with()`
+  (2.19.0)
+
+Eddú Meléndez Gonzales (@eddumelendez)
+ * Reported #5215: `@JsonAnyGetter` serialization order change from 2.18.4 to 2.19.0
+  (2.19.2)

release-notes/VERSION-2.x

@@ -4,7 +4,21 @@ Project: jackson-databind
 === Releases === 
 ------------------------------------------------------------------------
 
-2.19.0 (not yet released)
+2.19.2 (18-Jul-2025)
+
+#5202: `JsonSetter.contentNulls` ignored for `Object[]`, `String[]`
+  and `Collection<String>`
+ (fix by @wrongwrong)
+#5215: `@JsonAnyGetter` serialization order change from 2.18.4 to 2.19.0
+ (reported by Eddú M)
+ (fix by Joo-Hyuk K)
+
+2.19.1 (13-Jun-2025)
+
+#5139: In `CollectionDeserializer`, `JsonSetter.contentNulls` is sometimes ignored
+ (contributed by @wrongwrong)
+
+2.19.0 (24-Apr-2025)
 
 #1467: Support `@JsonUnwrapped` with `@JsonCreator`
  (implementation by Liam F)
@@ -18,8 +32,14 @@ Project: jackson-databind
    server and client side
  (requested by @qianlong)
  (contributed by Geoffrey G)
+#3343: Allow BeanPropertyWriter Sub-classes to Override `get()` (remove `final`)
+ (requested by @alzimmermsft)
 #4388: Allow using `@JsonPropertyOrder` with "any" (`@JsonAnyGetter`)  properties
  (fix by Joo-Hyuk K)
+#4533: Add `MapperFeature.REQUIRE_HANDLERS_FOR_JAVA8_TIMES` to disable the
+  "Java 8 date/time XYZ not supported by default" error
+ (requested by Jeff S)
+ (fix by Joo-Hyuk K)
 #4650: `PrimitiveArrayDeserializers` should deal with single String value if
   `DeserializationFeature.ACCEPT_SINGLE_VALUE_AS_ARRAY` enabled
  (reported, fix suggested by @eeren-bm)
@@ -83,9 +103,21 @@ Project: jackson-databind
  (contributed by @pjfanning)
 #5052: Minor bug in `FirstCharBasedValidator.forFirstNameRule()`: returns `null`
   in non-default case
+#5063: `SimpleModule` not registered due to `getTypeId()` returning an empty string
+ (reported by @seadbrane)
 #5069: Add copy-constructor for `MappingIterator`
  (contributed by @wrongwrong)
 
+2.18.4 (06-May-2025)
+
+#4628: `@JsonIgnore` and `@JsonProperty.access=READ_ONLY` on Record property
+  ignored for deserialization
+ (reported by Sim Y-T)
+ (fix contributed by Fawzi E)
+#5049: Duplicate creator property "b" (index 0 vs 1) on simple java record
+ (reported by @richard-melvin)
+ (fix contributed by Fawzi E)
+
 2.18.3 (28-Feb-2025)
 
 #4444: The `KeyDeserializer` specified in the class with `@JsonDeserialize(keyUsing = ...)`
@@ -896,6 +928,13 @@ No changes since 2.13.2.1 but fixed Gradle Module Metadata ("module.json")
   via `AsNull`
 - Add `mvnw` wrapper
 
+2.12.7.2 (02-May-2024)
+
+#3275: JDK 16 Illegal reflective access for `Throwable.setCause()` with
+  `PropertyNamingStrategy.UPPER_CAMEL_CASE`
+ (reported by Jason H)
+ (fix suggested by gsinghlulu@github)
+
 2.12.7.1 (12-Oct-2022)
 
 #3582: Add check in `BeanDeserializer._deserializeFromArray()` to prevent
@@ -915,7 +954,7 @@ No changes since 2.13.2.1 but fixed Gradle Module Metadata ("module.json")
 #3305: ObjectMapper serializes `CharSequence` subtypes as POJO instead of
   as String (JDK 15+)
  (reported by stevenupton@github; fix suggested by Sergey C)
-#3328: Possible DoS if using JDK serialization to serialize JsonNode
+#3328: Possible DoS if using JDK serialization to serialize JsonNode [CVE-2021-46877]
 
 2.12.5 (27-Aug-2021)