Jackson 3.2

Apply the Java 25 baseline first. These rules cover Jackson 3.2.3 tools.jackson.* databinding, polymorphism, coercion, duplicate keys, and stream constraints.

Request mapper and contracts

• Build a dedicated immutable request JsonMapper from trusted startup configuration; do not mutate shared defaults or register request-selected modules, mix-ins, subtypes, or handlers.
• Enable DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES; Jackson 3 defaults it to false, so extra attacker fields are otherwise silently ignored.
• Audit @JsonIgnoreProperties(ignoreUnknown=true), @JsonAnySetter, and DeserializationProblemHandler implementations, which can bypass unknown-property rejection.
• Keep Jackson 3's FAIL_ON_NULL_FOR_PRIMITIVES=true and FAIL_ON_TRAILING_TOKENS=true, and enable missing/null creator-property failures where the contract requires them.
• Disable MapperFeature.ALLOW_COERCION_OF_SCALARS to reject string and other mismatched scalar coercions. Separately disable DeserializationFeature.ACCEPT_FLOAT_AS_INT (enabled by default), or set CoercionAction.Fail for CoercionInputShape.Float on LogicalType.Integer, because disabling scalar coercion alone still binds 1.9 to an int as 1. Audit per-class, per-type, and default CoercionConfig entries, which take precedence over both flags.
• Deserialize into narrow request records/classes and separately validate ranges, lengths, formats, cross-field rules, tenant ownership, and allowed state transitions. Give each write path its own type rather than relying on @JsonView to limit which