Merge branch '3.0' into 3.x

Author: cowtowncoder

release-notes/VERSION

@@ -27,6 +27,9 @@ No changes since 3.0.0
 
 #106: (yaml) Upgrade to `snakeyaml-engine` (from classic `snakeyaml`)
  (contributed by Andrey S)
+#215: (yaml) .without(YAMLGenerator.Feature.WRITE_DOC_START_MARKER)
+  seems to be ignored
+ (reported by @jdimeo)
 #320: Rename "com.fasterxml.jackson" -> "tools.jackson"
 #374: (csv) Should verify that escape character set if enabling
   `CsvGenerator.Feature.ESCAPE_QUOTE_CHAR_WITH_ESCAPE_CHAR`

release-notes/VERSION-2.x

@@ -18,6 +18,10 @@ Active Maintainers:
 
 No changes since 2.20
 
+2.20.1 (30-Oct-2025)
+
+No changes since 2.20.0
+
 2.20.0 (28-Aug-2025)
 
 #497: (csv, toml, yaml): `UTF8Reader` throws "Need to move partially decoded character;
@@ -28,6 +32,8 @@ No changes since 2.20
  for non-numeric tokens
 - Generate SBOMs [JSTEP-14]
 
+2.19.4 (29-Oct-2025)
+2.19.3 (29-Oct-2025)
 2.19.2 (18-Jul-2025)
 2.19.1 (13-Jun-2025)
 
@@ -47,6 +53,7 @@ No changes since 2.19.0
 #554: (csv) Enforce, document thread-safety of `CsvSchema`
  (requested by Gili T)
 
+2.18.5 (27-Oct-2025)
 2.18.4 (06-May-2025)
 2.18.3 (28-Feb-2025)
 2.18.2 (27-Nov-2024)
@@ -155,6 +162,8 @@ No changes since 2.15.1
  (contributed by Axel N)
 #390: (yaml) Upgrade to Snakeyaml 2.0 (resolves CVE-2022-1471)
  (contributed by @pjfanning)
+#398 (tom) TOML: check nesting depth (CVE-2023-3894)
+ (contributed by @pjfanning)
 #411: (toml) Fuzzer-found issue #57237 (buffer boundary condition)
  (contributed by @yawkat)
 #415: (yaml) Use `LoaderOptions.allowDuplicateKeys` to enforce duplicate key detection

yaml/src/test/java/tools/jackson/dataformat/yaml/tofix/ObjectIdNone296Test.java

@@ -0,0 +1,66 @@
+package tools.jackson.dataformat.yaml.tofix;
+
+import org.junit.jupiter.api.Test;
+
+import com.fasterxml.jackson.annotation.JsonCreator;
+import com.fasterxml.jackson.annotation.JsonIdentityInfo;
+import com.fasterxml.jackson.annotation.ObjectIdGenerators;
+import tools.jackson.databind.ObjectMapper;
+import tools.jackson.dataformat.yaml.ModuleTestBase;
+import tools.jackson.dataformat.yaml.testutil.failure.JacksonTestFailureExpected;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertSame;
+
+// [dataformats-text#296]: YAML Anchor and alias fails with ObjectIdGenerators.None
+public class ObjectIdNone296Test extends ModuleTestBase
+{
+    private final ObjectMapper MAPPER = newObjectMapper();
+
+    @JacksonTestFailureExpected
+    @Test
+    public void testObjectIdUsingNativeAnchorsWithNoneGenerator() throws Exception
+    {
+        // YAML content with anchor (&foo1) and alias (*foo1)
+        final String YAML_CONTENT =
+                "foo: &foo1\n" +
+                "  value: bar\n" +
+                "boo: *foo1\n";
+
+        // This should work: YAML anchors/aliases should be recognized natively
+        // when using ObjectIdGenerators.None, but currently fails with:
+        // "Cannot construct instance of StringHolder... no String-argument
+        // constructor/factory method to deserialize from String value ('foo1')"
+        ScratchModel result = MAPPER.readValue(YAML_CONTENT, ScratchModel.class);
+
+        assertNotNull(result);
+        assertNotNull(result.foo);
+        assertEquals("bar", result.foo.value);
+        assertNotNull(result.boo);
+        assertEquals("bar", result.boo.value);
+        // The key assertion: both fields should point to the same object instance
+        assertSame(result.foo, result.boo);
+    }
+
+    static class ScratchModel {
+        public StringHolder foo;
+        public StringHolder boo;
+    }
+
+    // Using ObjectIdGenerators.None should allow YAML's native anchor/alias to work
+    @JsonIdentityInfo(generator = ObjectIdGenerators.None.class)
+    static class StringHolder {
+        public String value;
+
+        protected StringHolder() { }
+        
+        @JsonCreator(mode = JsonCreator.Mode.DELEGATING)
+        public StringHolder(String v) { value = v; }
+
+        @Override
+        public String toString() {
+            return "StringHolder{" + value +" }";
+        }
+    }
+}