Jackson Release 2.13.3

Jump to bottom

Tatu Saloranta edited this page May 14, 2022 · 11 revisions

Patch version of 2.13, released on May 14, 2022.

Following fixes are included in this patch release.

Changes, core

Streaming

#744: Limit size of exception message in BigDecimalParser

None yet

Databind

#2816: Optimize UntypedObjectDeserializer wrt recursion [CVE-2020-36518]
#3412: Version 2.13.2 uses Method.getParameterCount() which is not supported on Android before API 26
#3419: Improve performance of UnresolvedForwardReference for forward reference resolution
#3446: java.lang.StringBuffer cannot be deserialized
#3450: DeserializationProblemHandler is not working with wrapper type when returning null

Changes, data formats

Ion

#317: IonValueDeserializer does not handle getNullValue correctly for a missing property

Changes, Other modules

Blackbird

#169: Blackbird fails with LinkageError when the same class is used across two separate classloaders