Project: jackson-core
Versions: 3.x (for earlier see VERSION-2.x)

Contains core streaming reader (`JsonParser`) and writer (`JsonGenerator`) abstractions,
factory for constructing readers/writers (JsonFactory), as well as a minimal set
of interfaces needed for streaming level to make callbacks and call-throughs,
via `ObjectCodec` and `TreeNode`.

Also includes implementation of this API for JSON.
Forms the base for other data formats as well, despite naming that suggests
JSON-specificity: naming is due to history, as Jackson started out as pure
JSON library.

------------------------------------------------------------------------
=== Releases ===
------------------------------------------------------------------------

3.2.4 (18-Oct-2026)

#1683: `ReaderBasedJsonParser` should reject JSON-escaped lone
  surrogates in property names (mirror of #1541 fix in `UTF8StreamJsonParser`)
 (fix by @elang2)
#1728: Quote supplementary code points in unexpected-character messages
  instead of the 16-bit truncation
 (reported by @bodograumann)
 (fix by @kalayciburak)

#1724: Use target exception's original message and type when wrapping
  `InvocationTargetException` with path information
 (reported by Lee Dongnyoung)
 (fix by @CCCLL)
#1730: Make `FilteringGeneratorDelegate` handle `writeEmbeddedObject()`,
  typed `writeArray()` and raw/binary values consistently
 (fix by @pjfanning)
#1742: Non-blocking parser returns `NOT_AVAILABLE` but does not resume when
  a feed ends inside an escaped surrogate pair in a property name
 (reported by @DRMacIver)
 (fix by @pjfanning)
#1744: Backslash-escaped supplementary characters (with
  `ALLOW_BACKSLASH_ESCAPING_ANY_CHARACTER`) truncated to 16 bits; now rejected
 (fix by @pjfanning)
#1746: Non-blocking parser rejects leading-decimal-point numbers after `,` or `:`
  with `ALLOW_LEADING_DECIMAL_POINT_FOR_NUMBERS`
 (fix by @pjfanning)
#1748: Unquoted non-ASCII property names fail in UTF-8 byte parsers with
  `ALLOW_UNQUOTED_PROPERTY_NAMES`
 (fix by @pjfanning)
#1750: `ALLOW_UNESCAPED_CONTROL_CHARS` ignored for single-quoted string values
  in UTF-8 byte parsers (and allowed control chars dropped by `readString(Writer)`)
 (fix by @pjfanning)
#1756: Non-blocking parser does not decode multi-byte UTF-8 character after
  backslash escape
 (contributed by @ItsDeadlyProgrammer)
#1765: Non-blocking parser does not validate hex number length when input
  runs out mid-number (with `ALLOW_HEXADECIMAL_NUMBERS`) [CVE-2026-110729]
 (fix by @pjfanning)

3.2.3 (21-Sep-2026)

#1667: `JsonParser.willInternPropertyNames()` returns `true` even when
  `CANONICALIZE_PROPERTY_NAMES` is disabled
 (contributed by @Dongnyoung)
#1668: `WriterBasedJsonGenerator` AIOOBE when a zero-length custom escape
  lands at the output buffer boundary
 (reported by @hdimitrieski)
 (fix by @kalayciburak)
#1673: `readString(Writer)` AIOOBE when an escape or multi-byte character
  lands at the output buffer boundary
 (fix by @pjfanning)
#1692: Fix loss of buffered content when `createGenerator(OutputStream, JsonEncoding)`
  is used with non-UTF-8 encoding and generator is configured to neither close
  nor flush the target; also close streams opened for `File`/`Path` targets when
  generator construction fails
 (fix by @pjfanning)
#1693: Close streams Jackson opened for `File`/`Path` sources when construction
  of parser fails
 (fix by @pjfanning)
#1694: Release `IOContext` (and `BufferRecycler` lease it holds) when construction of
  parser or generator fails
 (fix by @pjfanning)
#1695: Release encoding buffer and close underlying stream in `UTF8Writer.close()`
  even if writing of pending content fails
 (fix by @pjfanning)
#1698: `UTF8DataInputJsonParser` does not honor `maxErrorTokenLength`
  when reporting an unrecognized token [CVE-2026-89425]
 (fix by @pjfanning)
#1703: Validate name length in `UTF8DataInputJsonParser` before quad buffer growth
 (reported, fix by DongNyoung L)
#1711: `File`/`Path` generator targets may be leaked, double-closed or truncated
  when construction fails
 (reported, fix by DongNyoung L)
#1713: `UTF32Reader` corrupts or drops the low surrogate when a supplementary
  character splits across a `read()` boundary
 (reported by @youdie006)
 (fix by @pjfanning)
#1718: `File`/`Path` parser sources leak if decorated stream `close()` fails
  on failed construction
 (reported by @cowtowncoder)
 (fix by @kalayciburak)

3.2.2 (14-Aug-2026)

#1630: `UTF8StreamJsonParser.nextName()` ignores
  `JsonReadFeature.ALLOW_LEADING_DECIMAL_POINT_FOR_NUMBERS`
 (reported by @jng260)
 (fix by @cowtowncoder, w/ Claude code)
#1642: Fix maxDocumentLength bypass in async parser single-feedInput() case
  [GHSA-2c4j-63jj-9fqr]
 (fix by Revanth M)
#1643: Enforce maxNameLength incrementally in ReaderBasedJsonParser [CVE-2026-68498]
 (fix by @tinyb0y)
#1649: Optimize `NumberInput.looksLikeValidNumber` [CVE-2026-89407]
 (fix by @cowtowncoder, w/ Claude code)
#1657: UTF8JsonGenerator: writeNumber fast path that avoids extra String allocation
 (implemented by @pjfanning)

3.2.1 (10-Jul-2026)

No changes since 3.2.0

3.2.0 (08-Jun-2026)

#679: Number parsing should fail for trailing dot (period)
 (fix by @cowtowncoder, w/ Claude code)
#707: Add `JsonReadFeature.ALLOW_HEXADECIMAL_NUMBERS` for JSON5-style hexadecimal
  integer literals
 (implementation by @seonwooj0810)
#1211: Add `JsonParser.willInternPropertyNames()` to check whether
  property name interning is enabled
 (contributed by Max P)
#1544: Validate `read()` parameters in `MergedStream` and `UTF32Reader`
 (implemented by @pjfanning)
#1545: Increase Android baseline from 26 to 34 in Jackson 3.2
#1564: Add `SimpleStreamReadContext.rollbackValueRead()` method
#1575: Implement document length tracking for `DataInput`-backed
  JSON parsers via subclass
 (implemented by @pjfanning)
#1576: Use Java 17 intrinstics for long multiplication
 (contributed by @xtonik)
#1593: Add `JsonGenerator.writeComment(String)`, `JsonGenerator.canWriteComments()`
 (implemented by @cowtowncoder, w/ Claude code)
#1598: Possible TOCTOU timing bug in `BufferRecycler`
 (implemented by @pjfanning)

3.1.8 (17-Oct-2026)

#1683: `ReaderBasedJsonParser` should reject JSON-escaped lone
  surrogates in property names (mirror of #1541 fix in `UTF8StreamJsonParser`)
 (fix by @elang2)
#1728: Quote supplementary code points in unexpected-character messages
  instead of the 16-bit truncation
 (reported by @bodograumann)
 (fix by @kalayciburak)

#1724: Use target exception's original message and type when wrapping
  `InvocationTargetException` with path information
 (reported by Lee Dongnyoung)
 (fix by @CCCLL)
#1730: Make `FilteringGeneratorDelegate` handle `writeEmbeddedObject()`,
  typed `writeArray()` and raw/binary values consistently
 (fix by @pjfanning)
#1742: Non-blocking parser returns `NOT_AVAILABLE` but does not resume when
  a feed ends inside an escaped surrogate pair in a property name
 (reported by @DRMacIver)
 (fix by @pjfanning)
#1744: Backslash-escaped supplementary characters (with
  `ALLOW_BACKSLASH_ESCAPING_ANY_CHARACTER`) truncated to 16 bits; now rejected
 (fix by @pjfanning)
#1746: Non-blocking parser rejects leading-decimal-point numbers after `,` or `:`
  with `ALLOW_LEADING_DECIMAL_POINT_FOR_NUMBERS`
 (fix by @pjfanning)
#1748: Unquoted non-ASCII property names fail in UTF-8 byte parsers with
  `ALLOW_UNQUOTED_PROPERTY_NAMES`
 (fix by @pjfanning)
#1750: `ALLOW_UNESCAPED_CONTROL_CHARS` ignored for single-quoted string values
  in UTF-8 byte parsers (and allowed control chars dropped by `readString(Writer)`)
 (fix by @pjfanning)
#1756: Non-blocking parser does not decode multi-byte UTF-8 character after
  backslash escape
 (contributed by @ItsDeadlyProgrammer)

3.1.7 (21-Sep-2026)

#1649: Optimize `NumberInput.looksLikeValidNumber` [CVE-2026-89407]
 (fix by @cowtowncoder, w/ Claude code)
#1668: `WriterBasedJsonGenerator` AIOOBE when a zero-length custom escape
  lands at the output buffer boundary
 (reported by @hdimitrieski)
 (fix by @kalayciburak)
#1673: `readString(Writer)` AIOOBE when an escape or multi-byte character
  lands at the output buffer boundary
 (fix by @pjfanning)
#1692: Fix loss of buffered content when `createGenerator(OutputStream, JsonEncoding)`
  is used with non-UTF-8 encoding and generator is configured to neither close
  nor flush the target; also close streams opened for `File`/`Path` targets when
  generator construction fails
 (fix by @pjfanning)
#1693: Close streams Jackson opened for `File`/`Path` sources when construction
  of parser fails
 (fix by @pjfanning)
#1694: Release `IOContext` (and `BufferRecycler` lease it holds) when construction of
  parser or generator fails
 (fix by @pjfanning)
#1695: Release encoding buffer and close underlying stream in `UTF8Writer.close()`
  even if writing of pending content fails
 (fix by @pjfanning)
#1698: `UTF8DataInputJsonParser` does not honor `maxErrorTokenLength`
  when reporting an unrecognized token [CVE-2026-89425]
 (fix by @pjfanning)
#1703: Validate name length in `UTF8DataInputJsonParser` before quad buffer growth
 (reported, fix by DongNyoung L)
#1711: `File`/`Path` generator targets may be leaked, double-closed or truncated
  when construction fails
 (reported, fix by DongNyoung L)
#1713: `UTF32Reader` corrupts or drops the low surrogate when a supplementary
  character splits across a `read()` boundary
 (reported by @youdie006)
 (fix by @pjfanning)
#1718: `File`/`Path` parser sources leak if decorated stream `close()` fails
  on failed construction
 (reported by @cowtowncoder)
 (fix by @kalayciburak)

3.1.6 (14-Aug-2026)

#1630: `UTF8StreamJsonParser.nextName()` ignores
  `JsonReadFeature.ALLOW_LEADING_DECIMAL_POINT_FOR_NUMBERS`
 (reported by @jng260)
 (fix by @cowtowncoder, w/ Claude code)
#1642: Fix maxDocumentLength bypass in async parser single-feedInput() case
  [GHSA-2c4j-63jj-9fqr]
 (fix by Revanth M)
#1643: Enforce maxNameLength incrementally in ReaderBasedJsonParser [CVE-2026-68498]
 (fix by @tinyb0y)
#1651: Fix object context handling for buffered `INCLUDE_NON_NULL` tokens
 (contributed by @Dongnyoung)

3.1.5 (07-Jul-2026)

#1616: `JsonParserSequence` read methods no longer use Parsers beyond the first
 (reported by @stefnoten-aca)
 (fix by @cowtowncoder, w/ Claude code)

3.1.4 (29-May-2026)

#1611: Apply number-length validator on streaming integer path of async parser
 (fix by @tonghuaroot)

3.1.3 (01-May-2026)

No changes since 3.1.2

3.1.2 (11-Apr-2026)

#1561: Javadoc for 3.1.0 doesn't work (build with JDK 21)
 (reported by Rob S)
 (fix by @cowtowncoder)
#1597: Rework 3rd party licenses in jar
 (fix by @pjfanning)

3.1.1 (27-Mar-2026)

#1562: Move `module-info.class` to jar root level (`/module-info.class`)
  from under `META-INF/versions/17`
#1570: Fail parsing from `DataInput` if
 `StreamReadConstraints.getMaxDocumentLength()` set
 (fix by @cowtowncoder, w/ Claude code)

3.1.0 (23-Feb-2026)

#784: Optional leading plus sign not included in textual value of any
  integral nor all floating-point numbers
 (fix by @cowtowncoder, w/ Claude code)
#1288: Add new method `JsonParser.readString(Writer)` (and implementation)
  for truly non-buffering reads
 (contributed by @sri-adarsh-kumar)
#1506: Non-blocking parser parses numbers eagerly; does not report error
  with missing space
 (fix by @cowtowncoder, w/ Claude code)
#1514: Additional configuration to closer match Jackson 2 behavior
 (contributed by Nicholas R)
#1527: `TokenStreamFactory.createNonBlockingByteBufferParser()` return type wrong
 (reported by Henri B)
 (fixed by @pjfanning)
#1534: Change `TreeCodec` to take type parameter `T extends TreeNode`
#1538: Increase default `StreamReadConstraints.maxStringLength` to 100M (from 20M)
#1541: Unexpected Illegal surrogate character when parsing field names
 (reported by Afzal N)
#1548: `StreamReadConstraints.maxDocumentLength` not checked when
  creating parser with fixed buffer
#1553: Max Depth validation not working for `DataInput`-backed `JsonParser`s
  in 3.0 [CVE-2026-29062]
 (reported by Prabhav S, Rohan N)
#1555: Enforce `StreamReadConstraints.maxNumberLength` for
  non-blocking (async) parser
 (fix by @pjfanning)
- Updated `JsonGenerator.writeNumber(String)` javadocs with more specific info
  on handling by generators that cannot support the method.

3.0.4 (21-Jan-2026)

#1516: `UTF8StreamJsonParser` sometimes may cause `ArrayIndexOutOfBoundsException`
 (reported by @haihai514)
 (fix by @cowtowncoder, w/ Claude code)

3.0.3 (28-Nov-2025)

#1418: `TokenFilter#includeEmptyArray()` causes an error in some cases where
  an object element is filtered

3.0.2 (07-Nov-2025)

#363: UTF-8 decoding should fail on Surrogate characters (0xD800 - 0xDFFF)
 (fix by @cowtowncoder, w/ Claude code)
#708: `FilteringParserDelegate` cannot deserialize empty list
 (fix by @cowtowncoder, w/ Claude code)
#1180: `JsonLocation` off for unrecognized tokens
 (fix by @cowtowncoder, w/ Claude code)
#1491: Mismatched property name for byte-backed `JsonParser.nextNameMatch(PropertyNameMatcher)`
 (fix by @cowtowncoder, w/ Claude code)
#1498: Jackson 3 breaks `FastDoubleParser` - problem with shading
 (fix by @cowtowncoder, w/ Claude code)
#1500: Add checks for surrogate pairing for UTF-8 generation
 (fix by @cowtowncoder, w/ Claude code)

3.0.1 (21-Oct-2025)

No changes since 3.0.0

3.0.0 (03-Oct-2025)

#378: Change default for `TokenStreamFactory.Feature.INTERN_PROPERTY_NAMES` to `false`
#402: Remove dataformat-auto-detection functionality
#411: Rename `JsonStreamContext` as `TokenStreamContext`
#413: Remove `ObjectCodec`: replace with `ObjectWriteContext` / `ObjectReadContext`
#432: Add new `TreeNode` subtypes: `ArrayTreeNode`, `ObjectTreeNode`
#433: Add Builder pattern for creating configured Stream factories
#456: Add `JsonParser.readAsValue(ResolvedType)`
#492: Ensure primitive type names in error message enclosed in backticks
#551: Remove `JsonGenerator.setPrettyPrinter()` from 3.0
#661: Replace checked `JsonProcessingException` with unchecked `JacksonException`
#663: Rename `JsonEOFException` as `UnexpectedEndOfInputException`
#668: Add `JacksonException.Reference` (demote from `JsonMappingException`/`DatabindException`)
#670: Replace references to "field" with "property" in `JsonGenerator`, `JsonParser`, method names;
  `JsonToken` values (`JsonToken.FIELD_NAME` -> `JsonToken.PROPERTY_NAME`)
#671: Replace `getCurrentLocation()`/`getTokenLocation()` with
  `currentLocation()`/`currentTokenLocation()`
#676: Remove `JsonGenerator.canWriteBinaryNatively()`, `canWriteFormattedNumbers()`
  (replaced by `StreamWriteCapability` equivalents)
#680: Allow use of `java.nio.file.Path` as parser source, generator target
 (contributed by Sven D)
#689: Remove existing "request payload" functionality
#785: Make `JsonGenerator.writeXxx()` methods chainable
#793: Rename "com.fasterxml.jackson" -> "tools.jackson"
#1090: Remove `BufferRecyclers.SYSTEM_PROPERTY_TRACK_REUSABLE_BUFFERS`
#1125: Remove `TokenStreamFactory.Feature.USE_THREAD_LOCAL_FOR_BUFFER_RECYCLING`
(REVERTED in 3.0.0-rc7: #1200: Change `JsonWriteFeature.ESCAPE_FORWARD_SLASHES`
  default to `true` for 3.0)
#1231: Enable Fast Floating-Point reading by default in 3.0
#1233: Lower default `maxNestingDepth` of `StreamReadConstraints` /
  `StreamWriteConstraints` to 500 in 3.0
#1269: Change `JsonFactory.builder()` configuration of `RecyclerPool` to avoid
  allocation default implementation (in 3.0)
#1364: JSTEP-6: rename `JsonLocation` as `TokenStreamLocation`
#1373: Change `TreeNode.propertyNames()` return type from `Iterator<JsonNode>`
  to `Collection<JsonNode>` (3.0)
#1378: Rename `JsonParser.getText()` as `.getString()` [JSTEP-6]
#1380: Change 3.0 to use `module-info.java` directly (and not via Moditect)
#1401: Rename `TreeNode.isContainerNode()` as `isContainer()`
#1411: Add `JsonFactoryBuilder.configureForJackson2()`,
  `JsonFactoryBuilder builderWithJackson2Defaults()`
 (fixed by @pjfanning)
#1434: Change `JsonParser.getNumberType()` to return `null` instead of
  throwing exception in 3.0
#1463: Remove `URL` taking factory methods of `JsonFactory` (3.0)
#1480: Add `JsonGenerator.getPrettyPrinter()`
- Rename `JsonGenerator.Feature.AUTO_CLOSE_JSON_CONTENT` as `AUTO_CLOSE_CONTENT`
- Add `TreeCodec.nullNode()`, `TreeNode.isNull()` methods
- Change the way `JsonLocation.NA` is included in exception messages
- Minimum Java baseline: Java 17
- Branch rename "master" -> "3.x" [JSTEP-12]
