Jackson Release 3.1.9

Patch version of 3.1, under development as of October 2026.

Following fixes will be included in this patch release.

Changes, core

Streaming

• #1782: Overlong 2- and 3-byte UTF-8 sequences in String values and comments are decoded instead of rejected
• #1784: UTF-8 parsers may return wrong cached property name for names containing 0xFF bytes
• #1787: CharTypes#charToHex handles non-ASCII incorrectly
• #1795: UTF8DataInputJsonParser accepts any control character as white space between tokens

Databind

• #6077: FAIL_ON_UNEXPECTED_VIEW_PROPERTIES not being respected with constructor-backed properties
• #6295: @JsonInclude(NON_DEFAULT) omits a changed array property when the default array contains null
• #6296: Duplicate properties merged under the wrong key in non-vanilla UntypedObjectDeserializer
• #6300: NPE when a DeserializationProblemHandler returns null for byte[] (single value unwrapped) and char[] elements
• #6305: InetSocketAddress deserialization ignores text after the closing bracket of an IPv6 address
• #6306: NPE serializing @JsonIdentityReference(alwaysAsId = true) to an object whose id is null