Should Jackson be considered a monorepo

[astellingwerf]

Do you believe that Jackson should be considered a monorepo? Can I update components of it independently, or would the generally recommended practice be to upgrade core, databind, annotation and all others to the same version number?

[pjfanning]

all versions of jackson-* jars should ideally match

[cowtowncoder]

Correct: all MINOR versions SHOULD match. Might as well match patches, but that is not required.

However: attempt is made to follow partial ordering so that, for example:

• jackson-databind 2.10 requires jackson-core of 2.10 OR HIGHER -- so we establish minimum required version
• jackson-datatype-joda 2.10 requires jackson-databind of 2.10 or higher (but not vice versa)

and specifically we try to guarantee "internal API" compatibility across adjacent versions, in this direction.

Still, that is not of much use for users, in presence of transitive dependencies. So the recommendation really is to:

1. Ideally match all minor versions, but
2. If not possible, try to make sure your jackson-core / jackson-annotations / jackson-databind are consistent AND newer minor versions than anything else (datatype modules tend to move slower so, say, old "jackson-datatype-joda" rarely causes problems)

I hope this helps.