Jackson 2.22

Apply the Java 8 baseline first. These rules cover Jackson 2.22.3 databinding under the com.fasterxml.jackson group, which keeps the permissive 2.x defaults and the deprecated pre-2.10 default-typing entry points that Jackson 3 removed.

Line scope and release alignment

• Manage Jackson dependencies through com.fasterxml.jackson:jackson-bom and take each new 2.22 patch as it ships, because FasterXML ships fixes to each open 2.x branch separately and only the newest patch of this branch carries them.
• Let that BOM choose the jackson-core and jackson-databind patch and the matching 2.22 jackson-annotations release, and do not override managed versions independently.
• Treat 2.22 as the non-LTS "latest release" branch that closes once 2.23 ships, and schedule the move to the next open line rather than waiting for an advisory to force it.
• Do not apply Jackson 3 guidance to this code: the tools.jackson packages, immutable mappers, and stricter 3.x defaults do not exist on the 2.22 line.
• Re-read the FasterXML advisories for both jackson-core and jackson-databind before each upgrade, because 2.x fixes are backported per branch and the safe patch differs between 2.18, 2.21, and 2.22.

Mapper construction

• Build request mappers once at startup with JsonMapper.builder() and hand out the built instance; do not call enable, disable, setConfig, or registerModule on a mapper that is already serving traffic.
• Never call the deprecated enableDefaultTyping overloads: they resolve the mapper's configured validator, which defaults to