[Snyk] Upgrade com.github.joschi.jackson:jackson-datatype-threetenbp from 2.6.4 to 2.18.2

[snyk-io]

Snyk has created this PR to upgrade com.github.joschi.jackson:jackson-datatype-threetenbp from 2.6.4 to 2.18.2.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 16 versions ahead of your current version.

• The recommended version was released a year ago.

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

• 🧐 View latest project report
• 📜 Customise PR templates
• 🛠 Adjust upgrade PR settings
• 🔕 Ignore this dependency or unsubscribe from future upgrade PRs

[snyk-io]

This upgrade of jackson-datatype-threetenbp involves a significant jump in the underlying core Jackson libraries, from version 2.6.4 to 2.18.2. While the threetenbp module itself has few direct breaking changes, the update to its Jackson dependencies introduces notable changes that require verification.

Key Changes:

• Java Version Requirement: The minimum required Java version has been raised. Jackson 2.12 and later require Java 8, whereas version 2.6 was compatible with Java 6 and 7. Applications running on Java 7 or older must be upgraded.
• Input Coercion Behavior: Jackson 2.12 introduced a new CoercionConfig system for handling deserialization of non-standard values (e.g., an empty string "" into a POJO). The default behavior is now stricter. Applications that previously relied on lenient deserialization from empty or blank strings may now throw exceptions. This behavior is now configurable but requires explicit setup.
• @JsonInclude(Include.NON_EMPTY) Behavior: The behavior of NON_EMPTY was changed in version 2.6 and subsequently rolled back in 2.7. Since the starting version is 2.6.4, applications may be relying on the 2.6-specific behavior, which will change upon this upgrade.

Recommendation:
This is a MEDIUM risk upgrade. No immediate code breakage is expected from removed APIs, but the changes to the runtime environment and deserialization behavior require action.

• Verify Java Version: Ensure your project is running on Java 8 or newer.
• Test Deserialization: Pay close attention to tests that cover deserialization of objects from potentially empty or non-standard JSON values. You may need to configure CoercionConfig on your ObjectMapper to retain previous behavior.

Source: Jackson 2.7 Release Notes, Jackson 2.12 Release Notes

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.