[Snyk] Security upgrade com.fasterxml.jackson.core:jackson-databind from 2.14.2 to 2.18.11 - #69

This upgrade from version 2.14.2 to 2.18.11 spans several minor versions and introduces significant new features and behavioral changes that require verification.

Potential Breaking Changes:

• Processing Limits (from 2.15): The most critical change is the introduction of StreamReadConstraints to mitigate DoS vulnerabilities. New default limits are placed on properties like maximum string length (~20MB), nesting depth (1000), and numeric token length. Applications that process large or deeply nested JSON documents may encounter StreamConstraintsException where they previously worked.
• Error Message Redaction (from 2.16): The default for StreamReadFeature.INCLUDE_SOURCE_IN_LOCATION has been changed to false for security reasons. Error messages will now contain "REDACTED" instead of the source snippet, which may impact custom error parsing logic.
• Internal Introspection Rewrite (in 2.18): A major internal rewrite of the POJO property introspection logic was performed. While this fixes many bugs, such a fundamental change could introduce subtle behavioral differences in complex serialization or deserialization scenarios.
• Kotlin Version Support: Support for Kotlin versions below 1.8 has been dropped across these releases.

Recommendation:

• Verify Processing Limits: Review if your application handles JSON documents that might exceed the new default constraints. If so, you will need to configure a custom StreamReadConstraints policy on your JsonFactory or ObjectMapper.
• Review Error Handling: Check any code that relies on parsing source information from Jackson's exception messages.
• Thorough Regression Testing: Due to the internal rewrite in version 2.18, it is crucial to perform thorough regression testing on your application's data binding logic, especially for complex models.

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}