Jackson 2.18

Apply the Java 8 baseline first. These rules cover Jackson 2.18.11, the oldest still-open long-term-support branch of the com.fasterxml.jackson 2.x line. It has the permissive 2.x defaults and lacks several later hardening switches, so controls that a newer branch can express as configuration must be written into application code here.

Line scope and release alignment

• Resolve every Jackson artifact through com.fasterxml.jackson:jackson-bom and take each new 2.18 patch while the branch stays open, because FasterXML backports fixes to each open 2.x branch separately and only the newest patch of this branch carries them.
• Treat 2.18 as a legacy compatibility baseline and plan the move to a newer open branch while backports to this one still arrive.
• Keep jackson-core, jackson-annotations, and jackson-databind on the same patch through that BOM, since a stale core jar removes constraint checks the databind layer assumes are present.
• Verify support expectations for this branch directly against the project's release status page before relying on it for a new deployment.
• Read the jackson-core and jackson-databind security advisories and each patch's release notes before an upgrade, because FasterXML publishes some advisories only in those repositories, and they can lag or stay out of the databases that dependency scanners read.

Missing controls on this branch

• Do not plan around DeserializationFeature.FAIL_ON_SUBTYPE_CLASS_NOT_REGISTERED; it does not exist here, so class-based type ids have no built-in registration requirement at all.
• Do not plan around