Jackson Release 2.9.7

Patch version of 2.9, not yet released as of June 2018.

Following fixes will be included.

Changes, core

Streaming

Databind

• #2060: UnwrappingBeanPropertyWriter incorrectly assumes the found serializer is of type UnwrappingBeanSerializer
• #2079: NPE when visiting StaticListSerializerBase
• #2082: FactoryBasedEnumDeserializer should be cachable
• #2088: @JsonUnwrapped fields are skipped when using PropertyBasedCreator if they appear after the last creator property
• #2096: TreeTraversingParser does not take base64 variant into account
• #2097: Block more classes from polymorphic deserialization (CVE-2018-14718 - CVE-2018-14721)
• #2109: Canonical string for reference type is built incorrectly

Changes, data formats

YAML

• #81: Jackson 2.9.5, 2.9.6 incompatible with snakeyaml 1.20, 1.21

Changes, datatypes

Hibernate

• #111: Class cast exception on hibernate5 module (with Hibernate 5.1+)

Joda

• #99: Binary compatibility broken in 2.9.x in DateTimeSerializer

Changes, other modules

Afterburner

• #54: Afterburner SuperSonicBeanDeserializer does not handle JSON Object valued Object Ids (like json)