Regarding CVE-2026-54515 (does it apply to @JsonIgnore usage as well?)

[arungitan]

@cowtowncoder @pjfanning I know the verbiage of CVE-2026-54515 (fixed by #5962) explicitly mentions only @JsonIgnoreProperties but it also specifically says "per-property usage".
The confusion: My understanding is the "per-property use of @JsonIgnoreProperties would have the same functional behavior as using @JsonIgnore on that property. Hence wanted to clarify/confirm whether the internal handling of @JsonIgnore is a different codepath and is therefore completely unaffected by this CVE or whether we should consider usage of @JsonIgnore as well when assessing our code?

[cowtowncoder]

@arungitan Code paths are quite different, as @JsonIgnoreProperties relates to "whole" property, whereas @JsonIgnore on specific accessor (altho in turn may remove "whole" property i.e. affect all accessors).

This means CVE as-is does NOT relate to @JsonIgnore: there could be other issues, but not ones related to affected/fixed code paths.