Skip to content

Jackson Release 3.1.5

Jump to bottom
Tatu Saloranta edited this page Jul 8, 2026 · 17 revisions

Patch version of 3.1, released on July 7, 2026.

Following fixes are included in this patch release.

Changes, core

Streaming

  • #1616: JsonParserSequence read methods no longer use Parsers beyond the first

Databind

  • #6040: Inconsistency in current token on invalid type coercion for List<String>
  • #6048: Apply content converters for String collection values (StringCollectionDeserializer)
  • #6055: Honor @JsonView for external-type-id (EXTERNAL_PROPERTY) properties [GHSA-mhm7-754m-9p8w]
  • #6058: Do not allow DNS resolution when deserializing InetAddress
  • #6060: @JsonView by-passed for @JsonUnwrapped Field/Setter properties [CVE-2026-59889]

Changes, dataformats

CBOR

  • #700: META-INF/services/tools.jackson.databind.ObjectMapper references wrong class name (...databind.CBORMapper / ...databind.SmileMapper)

Protobuf

  • #134 : oneof fields and some repeated fields incorrectly decoded for proto3 schemas

Smile

  • #700: META-INF/services/tools.jackson.databind.ObjectMapper references wrong class name (...databind.CBORMapper / ...databind.SmileMapper)

TOML

  • #696: TomlMapper writes NaN/Infinity as bare tokens, producing TOML it cannot read back

Clone this wiki locally