# Jackson Published articles for Jackson. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Introducing the Quarkus Almanac DevFeed: [Introducing the Quarkus Almanac]() Original publisher: [Read original article]() Author: Fouad Almalki (https://twitter.com/engineer\_fouad) Published: 2026-10-29T00:00:00Z Content type: article Language: en Sources: [Quarkus - Supersonic Subatomic Java]() Topics: [Quarkus](), [versioning](), [version-control]() Tags: [api](), [artifacts](), [browser](), [classes](), [comparisons](), [configuration](), [dependencies](), [deprecated](), [extensions](), [history](), [jackson](), [java](), [lts](), [migration-guides](), [properties](), [quarkus](), [release-notes](), [releases](), [upgrades]() ### AI overview The Quarkus Almanac compares any two Quarkus releases, covering configuration properties, managed dependencies, extensions, and public or protected API changes. Comparisons summarize change counts and let users inspect relevant sections. Dependency comparisons use platform BOMs when both releases have them; users can switch to core BOMs, which may manage different versions. Release and history pages track changes across releases for properties, artifacts, and classes. The dataset is built from Quarkus artifacts published on Maven Central, updated every twelve hours by a GitHub workflow, and comparisons run in the browser on a static site. ### Source excerpt Upgrading Quarkus starts with a question: what changed between the release I use and the one I want? The answer is spread over migration guides, release notes, the BOM, the configuration reference, and the code. The Quarkus Almanac puts it in one place. Pick two releases, and it shows what changed between them: config properties, managed dependencies, extensions, and the API of the classes in the Quarkus jars. It covers every Quarkus release, from 0.0.1 to the latest release. The Almanac is inspired by javaalmanac.io, the Java Version Almanac, which collects the history of every Java release and compares the API of any two of them. Compare two releases Pick a release to compare from and a release to compare to. The home page also offers quick comparisons, for example between two LTS releases. A comparison starts with a summary that counts the changes of each kind. The sections below it list the changes, and start collapsed: open the ones you need. Configuration The Configuration section lists the config properties that were added or removed, and those whose default value, type, accepted values, or phase changed, or that were deprecated. The properties are grouped by extension: open an extension to see its changes, or filter by property, extension, or description. Dependencies The Dependencies section compares the versions that the Quarkus BOM manages: major, minor, and patch upgrades, downgrades, and the artifacts that were added or removed. Applications generated by code.quarkus.io import the platform BOM, io.quarkus.platform:quarkus-bom, which sometimes manages other versions than the core BOM, io.quarkus:quarkus-bom. The Almanac compares the platform BOMs when both releases have one; turn off the Platform BOM switch to compare the core BOMs instead. From 3.33.3.3 to 3.33.4, for example, the platform BOM upgrades 68 Jackson artifacts from 2.21.6 to 2.21.7, while the core BOM keeps them at 2.21.6. Extensions The Extensions section lists the extensions that were add ## Atlassian Patches 75 Flaws in Data Center and Server Products DevFeed: [Atlassian Patches 75 Flaws in Data Center and Server Products]() Original publisher: [Read original article]() Author: Eduard Kovacs Published: 2026-10-23T07:54:47Z Content type: news Language: en Sources: [SecurityWeek]() Topics: [atlassian](), [patches]() Tags: [apache](), [atlassian](), [authentication](), [authorization](), [axios](), [bamboo](), [bitbucket](), [bouncy-castle](), [code-execution](), [confluence](), [critical](), [cryptographic](), [denial-of-service](), [disclosure](), [dos](), [jackson](), [jira](), [october-2026](), [patch](), [third-party](), [vulnerabilities](), [vulnerability]() ### AI overview Atlassian's October 2026 bulletin lists 176 vulnerability entries across seven Data Center and Server products, representing 75 unique CVEs by SecurityWeek's count; all are in third-party dependencies. Six unique CVEs are rated critical, though Atlassian assesses its use of each affected component as posing lower, non-critical risk. The excerpt describes high-severity issues in libraries including Tomcat, Netty, Bouncy Castle, Jackson and Spring, with many denial-of-service flaws and others involving cryptography, authentication, authorization, SSRF, information disclosure or code execution. Atlassian reports no known exploitation and recommends installing the latest product versions or the fixed releases listed in the bulletin. The excerpt also notes a discrepancy: CVE-2026-65905 appears in Atlassian's disclosure portal but not in the bulletin. ### Source excerpt Atlassian's October bulletin lists 176 vulnerability entries, including 14 critical-severity issues, all in third-party components. The post Atlassian Patches 75 Flaws in Data Center and Server Products appeared first on SecurityWeek. ## Quarkus 3.27.6.1 released - LTS emergency release DevFeed: [Quarkus 3.27.6.1 released - LTS emergency release]() Original publisher: [Read original article]() Author: Jan Martiška (https://twitter.com/janmartiska) Published: 2026-10-19T00:00:00Z Content type: release Language: en Sources: [Quarkus - Supersonic Subatomic Java]() Topics: [Quarkus](), [project release](), [bugfixes](), [Release notes]() Tags: [2026](), [3](), [changelog](), [cli](), [cve](), [cves](), [github](), [jackson](), [lts](), [lz4](), [pr](), [quarkus](), [release](), [stack-overflow](), [stream](), [update](), [upgrade](), [using]() ### AI overview Quarkus 3.27.6.1 is an emergency release for the 3.27 LTS stream. It fixes three listed CVEs and includes resolutions from Jackson 2.21.7, snappy-java 1.1.10.11, lz4-java 1.11.4, Netty 4.1.139.Final, and Vert.x 4.5.35; the announcement says Netty's corresponding CVEs were not yet published. The release is described as a safe upgrade for users already on 3.27. To update, use the latest Quarkus CLI and run `quarkus update --stream=3.27`; the command can update applications from other Quarkus versions, including 2.x. ### Source excerpt Today, we released Quarkus 3.27.6.1, an emergency release for the 3.27 LTS stream. This release fixes the following CVEs: CVE-2026-93879 CVE-2026-94451 CVE-2026-87744 Everything resolved by Jackson 2.21.7 Everything resolved by snappy-java 1.1.10.11 Everything resolved by lz4-java 1.11.4 Everything resolved by Netty 4.1.139.Final (note that, at the time of publishing this announcement, the corresponding CVEs have not been published yet) Everything resolved by Vert.x 4.5.35 It should be a safe upgrade for anyone already using 3.27. Update To update to Quarkus 3.27, we recommend updating to the latest version of the Quarkus CLI and run: quarkus update --stream=3.27 Note that quarkus update can update your applications from any version of Quarkus (including 2.x) to Quarkus 3.27. Full changelog You can get the full changelog of 3.27.6.1 on GitHub. Come Join Us We value your feedback a lot so please report bugs, ask for improvements... Let's build something great together! If you are a Quarkus user or just curious, don't be shy and join our welcoming community: provide feedback on GitHub; craft some code and push a PR; discuss with us on Zulip and on the mailing list; ask your questions on Stack Overflow. ## Quarkus 4.0.0.Beta1 released DevFeed: [Quarkus 4.0.0.Beta1 released]() Original publisher: [Read original article]() Author: Guillaume Smet (https://twitter.com/gsmet\_) Published: 2026-10-01T00:00:00Z Content type: release Language: en Sources: [Quarkus - Supersonic Subatomic Java]() Topics: [Quarkus](), [CI/CD](), [OpenTelemetry](), [telemetry](), [Apache Kafka](), [WebSocket](), [REST API]() Tags: [beta](), [hibernate-orm](), [http-3](), [io-uring](), [jackson](), [java](), [kafka](), [observability](), [opentelemetry](), [quarkus](), [quic](), [release]() ### AI overview Quarkus 4.0.0.Beta1 is the first beta of the next major Quarkus version, with a final release planned for the end of November. The release highlights Java 21, updated networking components, optional HTTP/3 and QUIC support, observability features, and major upgrades to Jakarta REST, Hibernate ORM, Jackson, and CDI. Extension developers are asked to migrate their extensions, and users are encouraged to test their applications and report issues. ### Source excerpt It is our pleasure to announce the availability of Quarkus 4.0.0.Beta1, the first Beta of the next major version of Quarkus. Quarkus 4 is a major new version and comes with a lot of changes. The final release is planned for the end of November. We need extension developers to migrate their extensions and end users to test their applications with it. Your feedback at this stage is essential to make Quarkus 4 a great release, please report any issues you encounter on GitHub. Highlights Quarkus 4 comes with significant upgrades across the board, and more are coming: Java 21 New base Java version, making virtual threads more central. Netty 4.2 and Vert.x 5.x New foundation for the networking layer. QUIC support QUIC is becoming the new foundation of distributed systems: HTTP/3, MQTT over QUIC, WebTransport (WebSocket over QUIC)... HTTP/3 Opt-in support for HTTP/3 with automatic certificate generation in dev and test modes. Native transports Improve the concurrency of your application with epoll or io_uring support. Also works in native executables. Observation API @Observed or programmatic API to generate metrics and traces. Works with Micrometer and OpenTelemetry. Dev UI Observability dashboard Built-in Observability section in the Dev UI, available out of the box in dev mode with no wiring needed. Jakarta REST 4 JSON Merge Patch, new multipart API. Hibernate ORM 8 Integration of the new major version of Hibernate with Jakarta Persistence 4.0 and Jakarta Data 1.1. Jackson 3 New major version - everything has changed except for the annotations. CDI 5.0 New annotations such as @Reserve and @Eager. New JMS extension Dedicated JMS extension with compatibility with Spring JMS, pooled JMS, and IronJacamar. @ExactlyOnce Improved Kafka transaction support. Upgrading to Quarkus 4 Migration guide We wrote a migration guide. As expected for a new major version, it is more dense than for our usual minors. For extension developers If you are maintaining a Quarkus extension, now is t ## Quarkus 3.27.6 released - LTS maintenance release DevFeed: [Quarkus 3.27.6 released - LTS maintenance release]() Original publisher: [Read original article]() Author: Jan Martiška (https://twitter.com/janmartiska) Published: 2026-09-30T00:00:00Z Content type: release Language: en Sources: [Quarkus - Supersonic Subatomic Java]() Topics: [Quarkus](), [Release notes](), [Test-driven development]() Tags: [2026](), [bugfixes](), [jackson](), [lts](), [mariadb](), [release](), [security]() ### AI overview Quarkus 3.27.6 is a maintenance release for the 3.27 LTS stream with bug fixes, documentation updates, and security fixes. It is planned as the final 3.27 update; users are advised to consider upgrading to 3.33 or 3.40. The release also provides a Quarkus CLI command for updating applications. ### Source excerpt Today, we released Quarkus 3.27.6, our next maintenance release for the 3.27 LTS stream. This release contains bugfixes, documentation updates, and security fixes. It should be a safe upgrade for anyone already using 3.27. Please note that this is planned to be the last update to 3.27. Anybody still on 3.27 is advised to look into upgrading to 3.33 or 3.40 (the next LTS) soon. Security fixes This release fixes the following CVEs: Quarkus and direct dependencies CVE-2026-89407 - FasterXML jackson-core: Denial of Service via quadratic regex backtracking in number validation CVE-2026-89425 - FasterXML jackson-core: Denial of Service via unbounded error-token accumulation in UTF8DataInputJsonParser CVE-2026-91777 - FasterXML jackson-databind: Denial of Service via quadratic-time forward-reference resolution for @JsonIdentityInfo CVE-2026-91776 - FasterXML jackson-databind: Denial of Service via unbounded deserializer cache growth for unrecognized polymorphic type IDs CVE-2026-84939 - Apache FreeMarker: Path traversal via malformed locale identifier CVE-2026-94449 - Quarkus SmallRye Fault Tolerance: Memory leak in @ApplyGuard leads to Denial of Service CVE-2026-82617 - Apache OpenNLP: Denial of Service via super-linear regex backtracking in built-in name finders CVE-2026-68497 - Jackson-databind: Denial of Service via unbounded number parsing for Duration/XMLGregorianCalendar CVE-2026-89059 - RESTEasy: Denial of Service via unbounded memory allocation in IIOImageProvider CVE-2026-93432 - Quarkus Qute: Cross-Site Scripting via missing content-type propagation in {#eval} sub-templates CVE-2026-59949 - LZ4 Java: Denial of Service via native XXHash crash on invalid byte array ranges CVE-2026-61700 - MariaDB Connector/J: allowLocalInfile=false bypass via server-initiated LOCAL INFILE request CVE-2026-55856 - MariaDB Connector/J: Cleartext password disclosure via MITM on the initial handshake CVE-2026-55857 - MariaDB Connector/J: Cleartext transmission of credentials during PA ## Resolving Exception: Cannot Deserialize From Object Value (No Delegate- Or Property-Based Creator) DevFeed: [Resolving Exception: Cannot Deserialize From Object Value (No Delegate- Or Property-Based Creator)]() Original publisher: [Read original article]() Author: Martin Blažević Published: 2026-09-14T04:21:09Z Content type: tutorial Language: en Sources: [Baeldung]() Topics: [Jackson](), [LocalDate](), [Exception](), [JSON]() Tags: [article](), [exception](), [how-to](), [jackson](), [jackson-exception](), [java](), [json](), [library](), [tutorial]() ### AI overview This tutorial explains why Jackson can throw InvalidDefinitionException when it cannot determine how to construct an object during JSON deserialization. It demonstrates the problem with an immutable class and presents solutions including a no-argument constructor, property-based creators using @JsonCreator and @JsonProperty, and annotated factory methods. It also notes the correct annotation package for Jackson 3.x. ### Source excerpt During JSON deserialization, Jackson may throw an InvalidDefinitionException when it can't determine how to create an instance of the target class. In this article, you'll learn how to fix this in Jackson 2.x and 3.x. The post Resolving Exception: Cannot Deserialize From Object Value (No Delegate- Or Property-Based Creator) first appeared on Baeldung. ## What's New in Jackson 3? DevFeed: [What's New in Jackson 3?]() Original publisher: [Read original article]() Author: Mateusz Szablak Published: 2026-09-10T19:10:48Z Content type: tutorial Language: en Sources: [Baeldung]() Topics: [Jackson](), [LocalDate](), [migration]() Tags: [android](), [api](), [jackson](), [jackson-basics](), [jackson-jackson-basics](), [java](), [json](), [migration](), [popular](), [tutorial]() ### AI overview A tutorial on Jackson 3.0's architectural and migration changes from Jackson 2.x, including its Java 17 baseline, new artifact and package names, Android considerations, and removed deprecated APIs. ### Source excerpt Learn what's new in Jackson 3, how it differs from Jackson 2, and what you need to do in order to migrate from Jackson 2.x to the new version. The post What's New in Jackson 3? first appeared on Baeldung. ## How to Fix Jackson JSON Parse Error Can not construct instance of java.time.LocalDate DevFeed: [How to Fix Jackson JSON Parse Error Can not construct instance of java.time.LocalDate]() Original publisher: [Read original article]() Author: Hiks Gerganov Published: 2026-08-22T23:26:23Z Content type: tutorial Language: en Sources: [Baeldung]() Topics: [Jackson](), [LocalDate](), [JSON](), [Exception](), [ISO 8601](), [Code]() Tags: [code](), [errors](), [exception](), [how-to](), [jackson](), [jackson-java-dates-exception-localdate](), [java](), [java-dates](), [json](), [learn](), [localdate](), [post](), [time](), [types]() ### AI overview This tutorial explains why Jackson may fail to deserialize JSON date values into Java's LocalDate or LocalDateTime, even when the JSON uses ISO-8601 formatting. It examines Jackson version support, missing Java Time module configuration, unsupported date formats, and mismatched date-time types, then presents ways to address the problem. ### Source excerpt Learn why sometimes Jackson can't construct an instance of LocalDate or LocalDateTime and how to fix the error it throws. The post How to Fix Jackson JSON Parse Error Can not construct instance of java.time.LocalDate first appeared on Baeldung. ## Keycloak 26.7.2 released DevFeed: [Keycloak 26.7.2 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2026-08-19T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Security](), [OpenID connect (OIDC)](), [Quarkus](), [Jackson](), [OpenTelemetry](), [WebAuthn]() Tags: [2026](), [account-takeover](), [cve](), [idm](), [jackson](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [oidc](), [openid-connect](), [opentelemetry](), [password](), [quarkus](), [release](), [resolved](), [saml](), [security](), [sso]() ### AI overview Keycloak 26.7.2 is released with security fixes, a Quarkus upgrade, and additional bug fixes and enhancements. The release addresses issues including account takeover, permission bypasses, secret disclosure, and WebAuthn behavior. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Security fixes #49570 CVE-2026-45292 OpenTelemetry Java SDK has Unbounded Memory Allocation in W3C Baggage Propagation dependencies #50616 [CVE-2026-14613] Keycloak 26.6.3 Fine-Grained Admin Permissions Bypass via Role Groups Endpoint admin/fine-grained-permissions #50955 [CVE-2026-59888 and CVE-2026-59889] Upgrade jackson-databind to 2.21.5 to fix #50966 [CVE-2026-15945] Group hierarchy search discloses hidden parent groups under FGAP v2 admin/fine-grained-permissions #51145 [CVE-2026-17048] Keycloak Admin REST API Leaks Vault-Resolved Rotated Client Secrets oidc #51832 CVE-2026-15571 Predictable account-linking hash enables account takeover via malicious oidc client #51833 CVE-2026-18963 Unauthenticated account takeover via reset-credentials flow bypass Weaknesses #50844 show-config prints the vault keystore password in cleartext dist/quarkus Enhancements #51344 Upgrade to Quarkus 3.33.3.1 Bugs #50751 Password denylist: false fpp warning on startup with large pre-computed .bloom file authentication #50849 Correct SCIM name.formated scim #50855 Rotated client secret remains valid when the feature is disabled oidc #51054 Invalid redirect URI on logout from pages with sub-tab hash fragments admin/ui #51061 Parameterized UserPropertyMapper exposes target user attributes without permission check core #51087 Passkey icons use wrong color variant when realm disables dark mode authentication/webauthn #51088 Verify email not working in incognito browser tab after Keycloak restart authentication #51131 Warning "Proactive closing of the session was missed - refinements are needed to TransactionSessionHandler related logic" appears core #51154 Upgrade to 26.7.0 fails with preview features as the stateless cluster provider captures a null NodeInfo before postInit infinispan #51164 WebAuthn tests are being skipped in Githu ## Quarkus Insights #254: Domain-Driven Design and Hexagonal Architecture - Part 2 DevFeed: [Quarkus Insights #254: Domain-Driven Design and Hexagonal Architecture - Part 2]() Original publisher: [Read original article]() Author: James Cobb (https://twitter.com/insectengine) Published: 2026-07-14T00:00:00Z Content type: article Language: en Sources: [Quarkus - Supersonic Subatomic Java]() Topics: [Domain-driven design (DDD)](), [software-development](), [Quarkus](), [Java](), [React](), [API](), [Maven](), [Jackson]() Tags: [architecture](), [demo](), [development](), [domain-driven-design](), [jackson](), [maven](), [quarkus](), [react]() ### AI overview This video recap covers Domain-Driven Design and Hexagonal Architecture through a working Quarkus call-for-papers application. It discusses Quarkus 4 updates, subdomains in a monolith, REST adapters, commands, validation, and a React frontend. ### Source excerpt This summary was generated using AI, reviewed by humans - watch the video for the full story. Quarkus Insights #254: Domain-Driven Design and Hexagonal Architecture - Part 2 Jeremy Davis returns for a follow-up to episode 248's introduction to Domain-Driven Design (DDD) and Hexagonal Architecture. The first session generated so many questions that Jeremy didn't get through all of his material, so episode 254 picks up where that one left off -- this time anchored around a fully working call-for-papers application that you can clone and run locally. Quarkus 4 Update Before diving into DDD, the hosts shared a brief status update: the main branch has now switched to version 4, meaning new feature development is targeting the 4.x line. On the 3.x side, 3.40 is expected to be the last minor release. The biggest in-flight changes heading into Quarkus 4 include a Vert.x 5 upgrade and a Jackson 3 upgrade -- significant library bumps that warrant the major version bump. The Demo Application: A Call for Papers Jeremy built a Sessionize-inspired call-for-papers application to ground the discussion. The application lets speakers browse conferences, submit session proposals, and receive acceptance or rejection notifications. Reviewers can then accept, waitlist, or decline proposals through a review screen. The frontend is built with Quinoa and React. The full repo can be cloned and run locally with mvn quarkus:dev (or the Maven wrapper). Package Structure and Subdomains The application is organised around two subdomains inside a monolith: CFP (Call for Papers) -- handles proposal submission and review Communications -- handles outbound notifications to presenters Jeremy is deliberately pragmatic about package structure: don't be dogmatic, but do make subdomains visible at the top level. Walking the Full Request Path Jeremy walked through a proposal submission end-to-end, from the REST adapter to the aggregate and back. The Incoming Adapter: REST Resource The SessionProposalResource i ## Quarkus 3.37 - Extension-based modularity, Hibernate ORM 7.4, Jackson reflection-free serializers, and more DevFeed: [Quarkus 3.37 - Extension-based modularity, Hibernate ORM 7.4, Jackson reflection-free serializers, and more]() Original publisher: [Read original article]() Author: Guillaume Smet (https://twitter.com/gsmet\_) Published: 2026-06-24T00:00:00Z Content type: release Language: en Sources: [Quarkus - Supersonic Subatomic Java]() Topics: [Quarkus](), [Java](), [Hibernate](), [Object-relational mapping](), [Deployment](), [migration](), [PostgreSQL](), [container](), [Jackson](), [reactive](), [SQL]() Tags: [container](), [deployment](), [hibernate](), [jackson](), [migration](), [modularity](), [orm](), [postgresql](), [quarkus](), [reactive](), [release](), [sql]() ### AI overview Quarkus 3.37 is a release featuring extension-based modularity through quarkus-jlink, upgrades to Hibernate ORM, Hibernate Reactive, and Hibernate Search, and default Jackson reflection-free serializers. It also adds streamed response metadata support in the REST Client and a new extension, while noting limitations for the experimental jlink functionality. ### Source excerpt We're pleased to announce the release of Quarkus 3.37. This release brings several notable features: #53140 - Extension-based modularity #54083 - Bump Hibernate ORM to 7.4.0.Final, Reactive to 3.4.0.Final, Search to 8.4.0.Final #54347 - Enable Jackson reflection-free serializers by default #54533 - Introduce ability to get response metadata in streamed response #54631 - Add quarkus-rest-data-hibernate-types extension Update To update to Quarkus 3.37, we recommend updating to the latest version of the Quarkus CLI and run: quarkus update Note that quarkus update can update your applications from any version of Quarkus (including 2.x) to Quarkus 3.37. For more information about the adjustments you need to make to your applications, please refer to the Quarkus 3.37 migration guide. What's new? Extension-based modularity Quarkus 3.37 introduces the new quarkus-jlink extension, which produces a jlink-ed modular application using jlink. By leveraging the Java module system, jlink creates a custom runtime image that includes only the JDK modules your application actually needs, stripping out everything else. This results in significantly smaller deployment artifacts compared to shipping a full JDK, which is particularly beneficial for container-based deployments where image size matters. When this extension is present, default JAR packaging is disabled. This extension is experimental. Container builds, cross-architecture builds, AOT with jlink, and modular testing are not yet supported. Have a look at the jlink guide to get started. As this is still experimental, we welcome your feedback! Hibernate ORM 7.4, Hibernate Reactive 3.4, Hibernate Search 8.4 Quarkus 3.37 upgrades Hibernate ORM from 7.3 to 7.4, Hibernate Reactive from 3.3 to 3.4, and Hibernate Search from 8.3 to 8.4. Hibernate ORM 7.4 includes several behavioral and DDL changes, for instance pagination limits are now processed in SQL, and new NOT NULL constraints are added on timestamp columns. PostgreSQL minimum v ## Enabling reflection-free Jackson serializers by default DevFeed: [Enabling reflection-free Jackson serializers by default]() Original publisher: [Read original article]() Author: Mario Fusco (https://twitter.com/mariofusco) Published: 2026-04-13T00:00:00Z Content type: article Language: en Sources: [Quarkus - Supersonic Subatomic Java]() Topics: [Quarkus](), [Jackson](), [Optimization](), [JSON](), [configuration](), [Java](), [test]() Tags: [efficiency](), [jackson](), [json](), [optimization](), [properties](), [quarkus](), [release](), [test]() ### AI overview Quarkus will enable reflection-free Jackson serializers and deserializers by default in the upcoming Quarkus 3.35 release. The build-time approach is intended to improve JSON processing efficiency by reducing Jackson's reliance on Java reflection, following compatibility fixes and testing. ### Source excerpt Some time ago, we started experimenting on how to improve the efficiency of JSON serialization and deserialization offered by Jackson and extensively used in Quarkus applications. From a performance point of view, Jackson's main bottleneck is its heavy reliance on Java reflection to access or populate data objects at runtime. To address this issue, we developed a build-time metaprogramming approach that generates reflection-free serializers and deserializers for Jackson. In this article we explained how we implemented this feature in Quarkus and the performance improvements it brings. Since then, we have been continuously working to enhance this feature, fix bugs, and improve compatibility with various Jackson features. Configuring reflection-free Jackson serialization Given the experimental nature of this feature, we initially made it opt-in. To enable reflection-free Jackson serializers and deserializers in your Quarkus application, it is necessary to add the following configuration to your application.properties file: quarkus.rest.jackson.optimization.enable-reflection-free-serializers=true In the past months an increasing number of users have tried this feature, taking advantage of the performance benefits it offers, but also helping us to discover bugs, edge cases, and compatibility issues with various Jackson features that we have addressed one by one. Overall, we have received positive feedback from the community, so we have decided to make the obvious next step. Enabling by default in the Quarkus 3.35 release At the moment the entire Quarkus test suite is passing with this feature enabled, and we have addressed all compatibility issues reported by users so far. Therefore, we have decided to enable this feature by default in the next Quarkus 3.35 release. In order to cover the broadest possible range of use cases, we invite you to test your applications with this feature enabled, possibly also measuring its impact on performances. If you encounter any issues ## Apache Flink Agents 0.2.1 Release Announcement DevFeed: [Apache Flink Agents 0.2.1 Release Announcement]() Original publisher: [Read original article]() Published: 2026-03-26T00:00:00Z Content type: release Language: en Sources: [Apache Flink]() Topics: [Apache Flink](), [Release notes](), [releases](), [Model Context Protocol](), [Vulnerabilities](), [Java](), [Jackson](), [JSON]() Tags: [announcement](), [bug](), [bug-fixes](), [dependencies](), [format](), [jackson](), [java](), [json](), [logs](), [mcp](), [mcp-server](), [mcp-servers](), [observability](), [release](), [release-notes](), [upgrade](), [vulnerability]() ### AI overview Apache Flink Agents 0.2.1 is a bug-fix release in the Flink-Agents 0.2 series. It includes bug and vulnerability fixes, minor improvements, MCP connection and Jackson deserialization fixes, improved JSON log formatting, a smaller wheel, and better CI observability. ### Source excerpt The Apache Flink Community is pleased to announce the first bug fix release of the Flink-Agents 0.2 series. This release includes 3 bug fixes, vulnerability fixes, and minor improvements for Flink-Agents 0.2. Below you will find a list of all bug fixes and improvements (excluding improvements to the build infrastructure and build stability). For a complete list of all changes, please see: ISSUE. We highly recommend all users upgrade to Flink-Agents 0. ## Migrating jackson-datatype-money to FasterXML: A Case Study in Open Source Consolidation DevFeed: [Migrating jackson-datatype-money to FasterXML: A Case Study in Open Source Consolidation]() Original publisher: [Read original article]() Author: Sri Adarsh Kumar Published: 2026-03-08T23:00:00Z Content type: article Language: en Sources: [Zalando]() Topics: [Jackson](), [LocalDate](), [Open Source](), [migration](), [Java](), [Library](), [Maintainers](), [Maven]() Tags: [dependency](), [jackson](), [java](), [libraries](), [library](), [maintainers](), [maven](), [migration](), [open-source](), [zalando]() ### AI overview A case study of migrating Zalando's jackson-datatype-money module into the official FasterXML Jackson ecosystem. It explains the fragmented support for JSR 354 monetary types, the consolidation rationale, and architectural changes including separate generic and Moneta-specific modules. ### Source excerpt How we integrated jackson-datatype-money into the official FasterXML Jackson ecosystem. ## Santa's Python Pitfalls: A Java Developer's Guide to Staying Safe This Christmas DevFeed: [Santa's Python Pitfalls: A Java Developer's Guide to Staying Safe This Christmas]() Original publisher: [Read original article]() Author: Steve Poole Published: 2025-12-24T03:03:09Z Content type: article Language: en Sources: [Java Advent Calendar]() Topics: [pip](), [PyPI](), [Python](), [Maven Central](), [Maven]() Tags: [2025](), [artifactory](), [cache](), [dependency](), [developer](), [github](), [jackson](), [java](), [maven](), [maven-central](), [nexus](), [package](), [packages](), [packaging](), [pip](), [python]() ### AI overview The excerpt warns Java developers that Python package installation has different trust and namespace risks: PyPI package names are first-come, making collisions and typosquatting possible, and a resolver may favor a higher-version package from another index, enabling dependency confusion. It recommends checking a package's owner, project activity and reputation, name, and source before installing; pinning explicit versions; and using a private registry such as Artifactory or Nexus to proxy and cache PyPI, blacklist known bad packages, and prioritize internal packages. It also recommends lock-file tooling. The excerpt presents these as mitigations, without detailing specific lock-file tools or further setup steps. ### Source excerpt Just like that it happened. You, a disciplined Java developer, are now installing Python. Like everything in 2025, it just arrived. One day, you were running a tidy mvn install, the next, you're learning about virtual environments and fighting an unfriendly pip install that won't explain what it just pulled from the internet. Good news: [...] The post Santa's Python Pitfalls: A Java Developer's Guide to Staying Safe This Christmas appeared first on JVM Advent. ## Quarkus 3.16 - OpenTelemetry Logging, LGTM Quarkus dashboard and too many things to list here DevFeed: [Quarkus 3.16 - OpenTelemetry Logging, LGTM Quarkus dashboard and too many things to list here]() Original publisher: [Read original article]() Author: Guillaume Smet (https://twitter.com/gsmet\_) Published: 2024-10-30T00:00:00Z Content type: release Language: en Sources: [Quarkus - Supersonic Subatomic Java]() Topics: [Quarkus](), [Logging](), [OpenTelemetry](), [dashboards](), [Jackson](), [Keycloak](), [OpenID connect (OIDC)](), [GraphQL](), [TLS (Transport Layer Security)](), [container]() Tags: [dashboard](), [graphql](), [jackson](), [keycloak](), [logging](), [oidc](), [opentelemetry](), [quarkus](), [reactive](), [tls]() ### AI overview Quarkus 3.16.1 introduces OpenTelemetry logging, an LGTM dashboard, reflection-free Jackson deserializers, REST and OIDC updates, TLS integrations, container logging, and other framework enhancements. The release also drops the Big Reactive Rename compatibility layer and provides an update path from earlier Quarkus versions. ### Source excerpt After the 3.15 LTS release comes Quarkus 3.16 and a lot of new features and enhancements. Quarkus 3.16 is the result of the 2 month worth of work so it's more packed than your usual Quarkus minor. We went directly to 3.16.1 due to the inclusion of a last minute fix. Notable changes are: #43005 - Drop the compatibility layer for the Big Reactive Rename #38239 - OpenTelemetry Logging support #41264 - LGTM Quarkus dashboard #42954 - Generate reflection-free Jackson deserializers #42642 - Quarkus REST - Support record parameter containers #43331 - Introduce per invocation override of REST Client's base URL #41866 - Add quarkus-oidc-client-registration extension #42749 - Add new AuthorizationPolicy annotation to bind named HttpSecurityPolicy to a Jakarta REST endpoints #42879 - Add OIDC Client SPI #43241 - Support @PermissionsAllowed defined on meta-annotation #43283 - Introduce OidcResponseFilter #42935 - Support for two or more authentications for a single request #43609 - Support Keycloak Dev Service when OIDC client is used without OIDC extension #42534 - Integrate GraphQL clients with the TLS registry extension #43303 - Integrate Keycloak Admin Client with TLS registry #43402 - Auto log for Dev Services in containers #43441 - Add HTTP Access Log to Dev UI #42907 - Allow multiple format and themes in the Config Doc generator Note that we haven't forgotten 3.15 LTS, a 3.15.2 LTS is in the works and will be released in November. We are carefully selecting the fixes we will backport to it. Update To update to Quarkus 3.16, we recommend updating to the latest version of the Quarkus CLI and run: quarkus update Note that quarkus update can update your applications from any version of Quarkus (including 2.x) to Quarkus 3.16. For more information about the adjustments you need to make to your applications, please refer to the Quarkus 3.16 migration guide. What's new? Big Reactive Rename compatibility layer dropped Remember the Big Reactive Rename? It happened in 3.9 with the ## Quarkus Newsletter #48 - September DevFeed: [Quarkus Newsletter #48 - September]() Original publisher: [Read original article]() Author: James Cobb (https://twitter.com/insectengine) Published: 2024-09-12T00:00:00Z Content type: article Language: en Sources: [Quarkus - Supersonic Subatomic Java]() Topics: [Quarkus](), [software-development](), [build performance](), [Maven](), [REST API](), [PostgreSQL](), [Jackson](), [LocalDate](), [Microservices]() Tags: [development](), [jackson](), [maven](), [performance](), [postgresql](), [quarkus](), [rest-api](), [services]() ### AI overview Quarkus Newsletter #48 highlights articles and resources on automatic setup with Quarkus Dev Services, Maven build caching, REST APIs backed by PostgreSQL, REST API clients, Jackson serialization performance, and a Quarkus JDiameter extension for telecom microservices. ### Source excerpt "Harnessing Automatic Setup and Integration with Quarkus Dev Services for Efficient Development" by Ivelin Yanev to see the simplicity and power of Quarkus to encourage experimentation, quicker iterations, and ultimately a faster development cycle. Learn how to to make the Quarkus build goal cacheable with minimal modifications to the Maven build configuration, reusing outputs from previous builds to save time in Jérôme Prinet's article "Accelerate your Quarkus Maven builds with Develocity Build Cache". Read "Implementing a Quarkus REST API using PostgreSQL as Database" by Ivan Franchin as a step-by-step guide on how to implement the Movie API, a Quarkus application that uses PostgreSQL as database Explore how to create a dummy REST API in Quarkus and demonstrate various methods to consume it using different clients by reading "How to Consume REST API in Quarkus" by Alexandru Borza. Learn how to get the most out of your serialization performance in "Leveraging Quarkus build-time metaprogramming capabilities to improve Jackson's serialization performance" by Mario Fusco. Learn about the creation of the Quarkus JDiameter extension in Eddie Carpenter's blog post, "Revolutionizing Telecom Microservice - Modernizing JDiameter with Quarkus". You will also see the latest Quarkus Insights episodes, top tweets/discussions and upcoming Quarkus attended events. Check out Newsletter #48: September! Want to get newsletters in your inbox? Sign up for the newsletter using the on page form. ## Quarkus 3.14 - Hibernate ORM 6.6, Let's encrypt, faster reflection-free Jackson serializers... DevFeed: [Quarkus 3.14 - Hibernate ORM 6.6, Let's encrypt, faster reflection-free Jackson serializers...]() Original publisher: [Read original article]() Author: Guillaume Smet (https://twitter.com/gsmet\_) Published: 2024-08-28T00:00:00Z Content type: release Language: en Sources: [Quarkus - Supersonic Subatomic Java]() Topics: [Quarkus](), [Object-relational mapping](), [Hibernate](), [Jackson](), [let's encrypt](), [reactive](), [gRPC](), [Command-line interface](), [migration](), [MongoDB](), [OpenID connect (OIDC)](), [Maven]() Tags: [bugfixes](), [cli](), [grpc](), [hibernate](), [jackson](), [let-s-encrypt](), [maven](), [migration-guide](), [mongodb](), [oidc](), [orm](), [quarkus](), [release](), [update](), [upgrade]() ### AI overview Quarkus 3.14.1 is released with upgrades to Hibernate ORM, Hibernate Search, Hibernate Reactive, MongoDB, and related components. The release also adds Let's Encrypt certificate support, faster reflection-free Jackson serializers, an initial gRPC CLI, signed OIDC UserInfo support, and other developer-focused improvements. ### Source excerpt It is our pleasure to announce the release of Quarkus 3.14.1 (we skipped the release of 3.14.0 so 3.14.1 is actually the first 3.14 release). We have been busy improving Quarkus in August and this version brings a lot of interesting new features: #41359 - Upgrade to Hibernate ORM 6.6 / Search 7.2 / Reactive 2.4 #40329 - Speedup Hibernate ORM's enhancement of large models #42105 - Let's Encrypt Support #41063 - Generate faster reflection-free Jackson serializers #41249 - Initial gRPC CLI #42097 - Update UBI images to 1.20/8.10 #37034 - Decorate stacktraces in dev mode error page #42409 - Vert.x HTTP: execute custom logic when HTTP server is started #42519 - Accept signed OIDC UserInfo #42445 - Upgrade MongoDB client to 5.1.3 #42141 - Reimplement the extension annotation processor #41648 - Make mvnd 1.x work and require Maven 3.9.6 to build Quarkus Also, if you already updated to Quarkus 3.13 and moved to @WithTestResource, please have a look at this section. Update To update to Quarkus 3.14, we recommend updating to the latest version of the Quarkus CLI and run: quarkus update Note that quarkus update can update your applications from any version of Quarkus (including 2.x) to Quarkus 3.14. For more information about the adjustments you need to make to your applications, please refer to the Quarkus 3.14 migration guide. What's new? Toward Quarkus 3.15 LTS We announced it already, the next LTS version of Quarkus will be Quarkus 3.15. It will be branched directly from the 3.14 branch and will be the direct continuation of our 3.14 work. So don't expect new features in 3.15, we will focus on bugfixes. Hibernate ORM 6.6 / Search 7.2 / Reactive 2.4 We upgraded the Hibernate stack to the latest and greatest: Hibernate ORM 6.6 Hibernate Search 7.2 Hibernate Reactive 2.4 Given it's new minor versions coming with new features and some behavioral changes, we highly recommend to have a look at the Quarkus 3.14 migration guide if you are using the Hibernate stack in your Quarkus ## Leveraging Quarkus build-time metaprogramming capabilities to improve Jackson's serialization performance DevFeed: [Leveraging Quarkus build-time metaprogramming capabilities to improve Jackson's serialization performance]() Original publisher: [Read original article]() Author: Mario Fusco (https://twitter.com/mariofusco) Published: 2024-08-19T00:00:00Z Content type: tutorial Language: en Sources: [Quarkus - Supersonic Subatomic Java]() Topics: [Quarkus](), [Jackson](), [LocalDate](), [Java](), [implementation](), [JSON](), [Library](), [Parser]() Tags: [bytecode](), [code](), [frameworks](), [implementation](), [jackson](), [java](), [json](), [library](), [metaprogramming](), [native](), [performance](), [quarkus](), [rest](), [runtime](), [serialization]() ### AI overview This tutorial explains how Quarkus build-time metaprogramming can replace reflection-based Jackson serialization with generated code. It discusses build-time versus runtime processing, performance improvements, native compilation, and lessons from developing a Quarkus extension using tools such as Jandex and Gizmo. ### Source excerpt One of the key architectural decisions taken by Quarkus designers has been moving as much work as possible from the startup time to the build time. This choice implies a clear separation between the deployment (aka. build-time) and runtime parts of each extension, and allows to perform the biggest part of the work once and for all during the build, thus allowing the typical Quarkus application to have a smaller footprint and faster load time. A consequence of this architecture is the possibility of extensively leveraging metaprogramming, identifying and analyzing the Java classes implementing the domain model of a given application and generating other code intended to opportunely and efficiently manipulate those classes. In particular the goal of the improvement discussed in this article is replacing the standard Jackson serialization mechanism, based on reflection, with code generated at build time. Reflection is used (and abused) by many Java frameworks and libraries to support dynamic behavior. If more work is done at build time, this dynamism is no longer needed. Reducing reflection to a bare minimum gives performance improvements. It also makes the application more suitable for compilation to a native binary (the GraalVM closed world assumption). A similar idea has been already implemented also in the area of object to JSON serialization by Qson, a Quarkus extension that generates through Gizmo the bytecode of deserializer (parser) and serializer (writer) classes. However, this is a full replacement of Jackson and comes with some, quite significant, limitations. If you decide to remain on the most common choice and keep using Jackson for the JSON serialization of objects returned by the invocation of a REST endpoint, you will still pay the price of the heavily reflection-based implementation offered out of the box by that library. In this article I will illustrate how I filled this gap and, most importantly, what I learned on how to write a Quarkus extension, ## How to Turn a List of Flat Elements into a Hierarchy in Java, SQL, or jOOQ DevFeed: [How to Turn a List of Flat Elements into a Hierarchy in Java, SQL, or jOOQ]() Original publisher: [Read original article]() Author: lukaseder Published: 2023-03-24T15:45:28Z Content type: tutorial Language: en Sources: [jOOQ]() Topics: [Java](), [SQL](), [Jackson](), [JSON](), [Library]() Tags: [code](), [collections](), [collector](), [collectors](), [hierarchical-sql](), [how-to](), [jackson](), [java](), [jooq-development](), [json](), [nested-collections](), [postgresql](), [recursive-sql](), [sql]() ### AI overview A tutorial on converting flat parent-child data into hierarchical structures using SQL, Java, or jOOQ. It compares a recursive PostgreSQL query with jOOQ 3.19 and a reusable pure-Java Collector, and discusses JSON serialization with Jackson and type inference considerations. ### Source excerpt Occasionally, you want to write a SQL query and fetch a hierarchy of data, whose flat representation may look like this: The result might be: |id |parent_id|label | |---|---------|-------------------| |1 | |C: | |2 |1 |eclipse | |3 |2 |configuration | |4 |2 |dropins | |5 |2 |features | |7 |2 |plugins | |8 |2 ... Continue reading How to Turn a List of Flat Elements into a Hierarchy in Java, SQL, or jOOQ -> ## Gson failure in end-to-end tests DevFeed: [Gson failure in end-to-end tests]() Original publisher: [Read original article]() Published: 2022-01-23T00:00:00Z Content type: article Language: en Sources: [Paweł Chudzik]() Topics: [Gson](), [Java](), [JSON](), [Software Testing](), [Jackson]() Tags: [e2e](), [enum](), [gson](), [jackson](), [java](), [json](), [tests](), [work]() ### AI overview This article explains that Gson can silently ignore JSON deserialization problems, such as an unknown enum value, allowing end-to-end tests to pass even when an API contract is broken. It contrasts this behavior with Jackson and describes migrating tests from Gson to Jackson. ### Source excerpt Using Gson in your e2e tests might result in tests passing even when contract is broken. Gson is quite imprecise when it comes to deserializing objects from json. Is there any difference between an enum and a string? Is there any difference between s string and a number? Using Java you might answer: sure there is. Even when talking about JSON you'll answer: yeah there is a difference. But for GSON? Meh whatever. Read more ## Year in Review: 2021 DevFeed: [Year in Review: 2021]() Original publisher: [Read original article]() Author: hello@taniarascia.com Published: 2022-01-01T00:00:00Z Content type: opinion Language: en Sources: [Tania Rascia]() Topics: [Programming](), [Code](), [Job](), [Jackson](), [Netflix](), [sessions]() Tags: [burnout](), [coding](), [developer](), [jackson](), [life](), [netflix](), [year-in-review]() ### AI overview A personal review of 2021 reflecting on time spent away from home, maintaining balance among development work, side projects, and creative pursuits, and recovering from past burnout. The author also discusses cultural discoveries including Bo Burnham's Inside and The Beatles: Get Back documentary. ### Source excerpt Wow, here we are, the sixth installment in the New Year series of posts. This year feels almost like a lost weekend. Aside from a few small... ## Custom Reactive JSON parsing DevFeed: [Custom Reactive JSON parsing]() Original publisher: [Read original article]() Published: 2021-06-08T00:00:00Z Content type: tutorial Language: en Sources: [Vasya Drobushkov]() Topics: [JSON](), [Parsing](), [Library](), [Android](), [client](), [multiplatform](), [Jetpack Compose]() Tags: [android](), [gson](), [jackson](), [jetpack-compose](), [json](), [json-parsing](), [moshi](), [multiplatform](), [parsing](), [serialization]() ### AI overview This tutorial introduces JSON parsing in Android applications, compares common libraries, and describes a pet-project weather app that bundles a JSON city list for offline selection. It notes that this approach involves workarounds and would not be suitable for production. ### Source excerpt Introduction Parsing JSON strings is a must-have on most Android projects that have server-client communication (of course there are some other formats like XML or Protobuf, but I guess JSON is the most common one at least at the moment). Setting up this communication is relatively straightforward: choose a library, add it to a project, describe models, create mappers, and so on. There are a bunch of various libraries to parse JSON: good old Gson, Jackson, or more modern Moshi, kotlinx-serialization and there are more. Set up of these libraries is different, there are differences in the internal implementation, but the general idea is the same for most of them: you can convert JSON-string into a set of objects and vice versa. ## Avoiding dependency hell with Gradle 6 DevFeed: [Avoiding dependency hell with Gradle 6]() Original publisher: [Read original article]() Author: Cédric Champeau Published: 2019-11-11T05:00:00Z Content type: article Language: en Sources: [Gradle]() Topics: [Dependency management](), [Gradle](), [Graphs](), [Scala](), [Jackson](), [Software Testing]() Tags: [dependency](), [dependency-management](), [gradle](), [graph](), [jackson](), [scala](), [testing]() ### AI overview The article explains how Gradle 6 addresses dependency hell in large projects. It describes problems such as incompatible versions, misaligned component dependencies, dynamic upgrades, vulnerable transitive dependencies, unused dependencies, and inconsistent versions across subprojects. Gradle 6 introduces richer module metadata to give dependency resolution more information for detecting and potentially fixing these issues. ### Source excerpt Dependency hell is a big problem for many teams. The larger the project and its dependency graph, the harder it is to maintain it. The solutions provided by existing dependency management tools are insufficient to effectively deal with this issue. Gradle 6 aims at offering actionable tools that will help deal with these kind of problems, making dependency management more maintainable and reliable. Take, for example, this anonymized dependency graph from a real world project: There are hundreds of different libraries in this graph. Some are internal libraries, some are OSS libraries. A proportion of those modules see several releases a week. In practice, with a graph of this size, there's no way you can avoid typical problems like: 2 components depending on the same module but with different, incompatible, APIs multiple libraries providing the same feature (a single logger API, but you end up with multiple implementations) and more like: dealing with incompatible versions of a runtime (e.g: Scala 2.11 vs Scala 2.12) misaligned dependencies of a component (e.g: Jackson Databind 2.9.0 with Jackson Core 2.9.4) builds suddenly failing because of a dynamic version upgrade (version "1.+") rejecting vulnerable transitive dependencies removing unused dependencies inconsistent versions between subprojects in the same repository Dependency issues can cause many problems when building and testing your products and it can be extremely challenging to figure out, on a daily basis, what caused a regression, why the project suddenly doesn't build anymore or what dependency is responsible for an upgrade of another dependency. If you are lucky, you would get a compile time error, but it's common to only see problems occurring when executing tests or even at production runtime. In all these cases the error is often hard to trace back to the source, as it appears after the dependency resolution in the build tool has been successful. So from a dependency management perspective everything [Next page]()