Jackson Release 2.21.9

Patch version of 2.21, under development as of October 2026.

Following fixes will be included in this patch release.

Changes, core

Streaming

None yet

Databind

• #6315: Map key deserializers should apply same type checks as bean deserializers
• #6329: Add JDK-bundled RowSet gadget siblings to deserialization deny-list

Changes, dataformats

CBOR

• #888: nextFieldName(SerializableString) matches against JSON-escaped name bytes (asQuotedUTF8())

Protobuf

• #881: Known field after a skipped unknown field gets wrong wire type / state / location, differently per nextToken() / nextName*()

Smile

• #888: nextFieldName(SerializableString) matches against JSON-escaped name bytes (asQuotedUTF8())