Jackson Release 2.18.7

Patch version of 2.18, under development as of February 2026.

Following fixes will be included in this patch release.

Changes, core

Streaming

• #1570: Fail parsing from DataInput if StreamReadConstraints.getMaxDocumentLength() set [GHSA-2m67-wjpj-xhg9]
• #1600: Rework 3rd party licenses in jar

Changes, data formats

CSV

• #615: Feature CsvReadFeature.EMPTY_UNQUOTED_STRING_AS_NULL ignored