build(deps): Bump jackson to 2.21.3#19528
Merged
Merged
Conversation
Jackson 2.21 (issue apache#1381) changed the default resolution of @JacksonInject when combined with @JsonProperty on the same parameter: the injected value now wins over the JSON value, where 2.20 treated the inject as a fallback used only when JSON did not supply one. DruidNode's serviceName, port, and tlsPort parameters carry both annotations, with JSON expected to win when supplied — this is how DruidNode JSON config files have always worked. Add the explicit useInput = OptBoolean.TRUE to restore that contract. A repo-wide audit confirmed DruidNode's three parameters are the only sites in Druid where @JacksonInject and @JsonProperty annotate the same parameter; everywhere else the annotations are on distinct parameters and are unaffected. Also adds the previously-missing license entry for org.jspecify:jspecify 1.0.0 in extensions-core/kubernetes-extensions, which the check-licenses dependency report flagged.
Member
FrankChen021
left a comment
FrankChen021
left a comment
There was a problem hiding this comment.
| Severity | Findings |
|---|---|
| P0 | 0 |
| P1 | 1 |
| P2 | 0 |
| P3 | 0 |
| Total | 1 |
| Severity | Findings |
|---|---|
| P0 | 0 |
| P1 | 1 |
| P2 | 0 |
| P3 | 0 |
| Total | 1 |
Reviewed 3 of 3 changed files.
This is an automated review by Codex GPT-5.5
findInjectableValue was returning JacksonInject.Value.forId(id), which strips useInput and optional from the original annotation. Production deserialization happens to remain correct under jackson 2.21 because AnnotationIntrospectorPair.findInjectableValue falls back to the secondary (default Jackson) introspector and merges the recovered useInput onto the primary's Value via withUseInput. That fallback is undocumented as part of the introspector contract and would silently regress if the pair semantics change, or if this introspector were ever installed standalone for a special-purpose mapper. Construct the Value via JacksonInject.Value.from(annotation) .withId(id) so the introspector returns a complete Value on its own and no longer relies on the pair to fix it up. The annotation lookup is hoisted to the top of findInjectableValue so the non-null contract between it and findGuiceInjectId is explicit — findGuiceInjectId now documents the precondition and trusts the caller to verify, eliminating the duplicate getAnnotation call. Defensive cleanup motivated by FasterXML/jackson-databind#1381; no observable behavior change.
Member
FrankChen021
left a comment
FrankChen021
left a comment
There was a problem hiding this comment.
I reviewed the follow-up. The author update preserves the JacksonInject flags directly, so the previous concern is handled and I found no new issues.
Reviewed 4 of 4 changed files.
This is an automated review by Codex GPT-5.5
FrankChen021
approved these changes
May 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This PR bumps
jackson(2.20.2to2.21.3) and adds a missing license entry fororg.jspecify:jspecifyinextensions-core/kubernetes-extensions.Bumped Jackson to 2.21.3
Jackson 2.21 changed the default resolution behaviour when
@JacksonInjectand@JsonPropertyannotate the same parameter: the injected value now wins over the JSON value, where 2.20 treated the inject as a fallback used only when JSON did not supply one. This affectsDruidNode'sserviceName,port, andtlsPortparameters, which carry both annotations with the expectation that JSON config values win when present; everywhere else the annotations are on distinct parameters and are unaffected. See Most Wanted Feature: Injection-only@JacksonInjectin the release blog post.Restored JSON-input precedence on
DruidNodeAdded the explicit
useInput = OptBoolean.TRUEto the three@JacksonInjectannotations onDruidNode's constructor parameters so that JSON wins over inject.Release note
Dependency Bumps:
If external code has both
@JacksonInjectand@JsonPropertyon the same parameter and relies on the JSON value winning when supplied, add the explicituseInput = OptBoolean.TRUEto the annotation (or stay on Jackson 2.20.x). All such sites in Druid itself have been updated.This PR has: