Jackson 2.21

Apply the Java 8 baseline first. These rules cover Jackson 2.21.7, the long-term-support branch of the com.fasterxml.jackson 2.x line, whose defaults stay permissive for backward compatibility and whose new creator and injection features carry their own binding hazards.

Line scope and release alignment

• Resolve Jackson artifacts through com.fasterxml.jackson:jackson-bom and take each new 2.21 patch while this long-term-support branch stays open, because FasterXML backports fixes to each open 2.x branch separately and only the newest patch of this branch carries them.
• Choose 2.21 deliberately as the supported LTS branch rather than drifting onto it, and re-check the branch status before assuming backports still arrive.
• Read the jackson-core and jackson-databind security advisories and each patch's release notes before an upgrade, because FasterXML publishes some advisories only in those repositories, and they can lag or stay out of the databases that dependency scanners read.
• Keep jackson-core, jackson-annotations, and jackson-databind aligned through that BOM, which pairs each core and databind patch with the 2.21 annotations release, so constraint enforcement and annotation attributes match what the databind layer expects.
• Do not carry Jackson 3 advice into this code: tools.jackson packages, immutable mappers, and the stricter 3.x failure defaults are not available here.

Mapper construction

• Construct the request mapper once through JsonMapper.builder() at startup and treat the result as read-only configuration for the life of the process.