Jackson Release 2.21.2

Patch version of 2.21, under development as of February 2026.

Following fixes will be included in this patch release.

Changes, core

Streaming

• #1541: Unexpected Illegal surrogate character when parsing field names
• #1570: Fail parsing from DataInput if StreamReadConstraints.getMaxDocumentLength() set [GHSA-2m67-wjpj-xhg9]

Databind

• #5729: ISO-8601 change prevents parsing negative timestamps (dates before 1970)

Changes, data formats

CSV

• #615: Feature CsvReadFeature.EMPTY_UNQUOTED_STRING_AS_NULL ignored

Changes, JVM Languages

Kotlin

• #1135: Compatibility with Kotlin 1.9 is provided (see kotlin#1129)