Patch version of [2.9](Jackson-Release-2.9.md), released September 19, 2018.

Following fixes are included.

### Changes, core

#### [Streaming](../../jackson-core)

* [#476](../../jackson-core/issues/476): Problem with `BufferRecycler` via async parser (or when sharing parser across threads)
* [#477](../../jackson-core/issues/477): Exception while decoding Base64 value with escaped `=` character

#### [Databind](../../jackson-databind)

* [#2060](../../jackson-databind/issues/2060): `UnwrappingBeanPropertyWriter` incorrectly assumes the found serializer is of type `UnwrappingBeanSerializer`
* [#2064](../../jackson-databind/issues/2064): Cannot set custom format for `SqlDateSerialize
* [#2079](../../jackson-databind/issues/2079): NPE when visiting StaticListSerializerBase
* [#2082](../../jackson-databind/issues/2082): `FactoryBasedEnumDeserializer` should be cachable
* [#2088](../../jackson-databind/issues/2088): `@JsonUnwrapped` fields are skipped when using `PropertyBasedCreator` if they appear after the last creator property
* [#2096](../../jackson-databind/issues/2096): `TreeTraversingParser` does not take base64 variant into account
* [#2097](../../jackson-databind/issues/2097): Block more classes from polymorphic deserialization (CVE-2018-14718 - CVE-2018-14721)
* [#2109](../../jackson-databind/issues/2109): Canonical string for reference type is built incorrectly
* [#2120](../../jackson-databind/issues/2120): `NioPathDeserializer` improvement
* [#2128](../../jackson-databind/issues/2128): Location information included twice for some `JsonMappingException`s

### Changes, data formats

#### [Ion](../../jackson-dataformats-binary)

* [#142](../../jackson-dataformats-binary/issues/142): `IonParser.getNumberType()` returns `null` for `IonType.FLOAT`

#### [YAML](../../jackson-dataformats-text)

* [#81](../../jackson-dataformats-text/issues/81): Jackson 2.9.5, 2.9.6 incompatible with snakeyaml 1.20, 1.21

### Changes, datatypes

#### [Hibernate](../../jackson-datatype-hibernate)

* [#111](../../jackson-datatype-hibernate/issues/111): Class cast exception on hibernate5 module (with Hibernate 5.1+)

#### [Java 8 date/time](../jackson-modules-java8/)

* [#78](../jackson-modules-java8/issues/78): Year deserialization ignores `@JsonFormat` pattern

#### [Joda](../../jackson-datatype-joda)

* [#99](../../jackson-datatype-joda/issues/99): Binary compatibility broken in 2.9.x in `DateTimeSerializer`
* [#101](../../jackson-datatype-joda/issues/101): Instant, YearMonth and MonthDay not use pattern in @JsonFormat

### Changes, other modules

#### [Afterburner](../../jackson-modules-base)

* [#54](../../jackson-modules-base/issues/54): Afterburner` SuperSonicBeanDeserializer` does not handle JSON Object valued Object Ids (like json)