Jackson 3.1

Apply the Java 17 baseline first. These rules cover Jackson 3.1.7, the first long-term-support branch of the tools.jackson line. Jackson 3 fixed several 2.x defaults but relaxed others, so treat 3.1 as a different configuration problem rather than a safer version of a 2.x mapper.

Line scope and release alignment

• Resolve Jackson 3 components through tools.jackson:jackson-bom, including core and databind under tools.jackson.core and the required com.fasterxml.jackson.core:jackson-annotations:2.21, take each new 3.1 patch while this long-term-support branch stays open, and require JDK 17 or later at build and runtime.
• Do not accept any 3.0 release: the DataInput parser ignored maxNestingDepth and the async parser ignored maxNumberLength on that branch, and both were only corrected in 3.1.0.
• Prefer 3.1 over 3.2 only when its LTS window meets deployment requirements, and re-read the branch status page before assuming backports still arrive.
• Read the jackson-core and jackson-databind security advisories and each patch's release notes before an upgrade, because FasterXML publishes some advisories only in those repositories, and they can lag or stay out of the databases that dependency scanners read.
• Do not carry 2.x code or advice across unchanged: the packages, the mapper lifecycle, and several failure defaults all differ from com.fasterxml.jackson.

Mapper construction

• Build each mapper with JsonMapper.builder() and keep the built instance immutable; Jackson 3 has no post-construction reconfiguration to fall back on.
• Never let request