[Snyk] Upgrade com.fasterxml.jackson.core:jackson-annotations from 2.6.5 to 2.22

[drmikebio]

Snyk has created this PR to upgrade com.fasterxml.jackson.core:jackson-annotations from 2.6.5 to 2.22.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 122 versions ahead of your current version.

• The recommended version was released a month ago.

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

• 🧐 View latest project report
• 📜 Customise PR templates
• 🛠 Adjust upgrade PR settings
• 🔕 Ignore this dependency or unsubscribe from future upgrade PRs

[drmikebio]

This is a significant upgrade from version 2.6.5 to 2.22, spanning multiple years of development. While jackson-annotations is designed for stability, the large version jump introduces potential risks, primarily related to Java version compatibility and subtle behavioral changes in annotations over many releases.

Key Changes & Potential Risks:

• Java Version: While jackson-annotations itself has maintained a Java 6 baseline for a long time, this was raised in later versions. Jackson 2.13 raised the baseline for most other Jackson modules to Java 8. Projects using older JDKs may face compatibility issues and should verify their runtime environment.
• Annotation Behavior: Although no specific breaking changes to annotations are documented for most minor versions, the upgrade from 2.6 to 2.7 included a major rewrite of the generic type resolution system, which could affect complex, edge-case serialization scenarios. Additionally, new annotations and features have been added in later versions like 2.12, such as @JsonIncludeProperties.
• Versioning Scheme Change: Starting with version 2.20, jackson-annotations adopted a new versioning scheme, dropping the patch number (e.g., 2.20, 2.21, 2.22). This is an informational change but highlights the long development span covered by this upgrade.

Recommendation:

Given the wide version gap, a medium risk level is assigned. Developers should:

1. Ensure their project's JDK version is compatible with modern Jackson releases (Java 8 or higher is recommended).
2. Perform thorough regression testing, paying close attention to serialization and deserialization logic, especially where complex generic types or custom annotations are used.

Source: Jackson project release notes.

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.