Merge branch '3.2' into 3.x

Author: cowtowncoder

cbor/src/main/java/tools/jackson/dataformat/cbor/CBORParser.java

@@ -7,9 +7,9 @@
 import java.math.BigInteger;
 import java.nio.charset.Charset;
 import java.nio.charset.StandardCharsets;
+import java.util.ArrayDeque;
 import java.util.ArrayList;
 import java.util.Arrays;
-import java.util.Stack;
 
 import tools.jackson.core.*;
 import tools.jackson.core.base.ParserBase;
@@ -206,7 +206,7 @@ public void push(boolean hasNamespace) {
 
         public void pop() {
             --_nestedDepth;
-            if (!_stringRefs.empty() && _stringRefs.peek().depth == _nestedDepth) {
+            if (!_stringRefs.isEmpty() && _stringRefs.peek().depth == _nestedDepth) {
                 _stringRefs.pop();
             }
         }
@@ -216,10 +216,12 @@ public StringRefList peek() {
         }
 
         public boolean empty() {
-            return _stringRefs.empty();
+            return _stringRefs.isEmpty();
         }
 
-        private Stack<StringRefList> _stringRefs = new Stack<>();
+        // 28-Jul-2026, tatu: [dataformats-binary#742] Use non-synchronized
+        //   `ArrayDeque` instead of (synchronized) `Stack`
+        private final ArrayDeque<StringRefList> _stringRefs = new ArrayDeque<>();
         private int _nestedDepth = 0;
     }
 

release-notes/CREDITS

@@ -50,3 +50,8 @@ Juan Farré (@jafarre-bi)
 * Reported #700: (cbor, smile) `META-INF/services/tools.jackson.databind.ObjectMapper`
   references wrong class name (`...databind.CBORMapper` / `...databind.SmileMapper`)
  (3.1.5)
+
+Benoît Mériaux (@benoitmeriaux)
+
+* Reported #742: Use `ArrayDeque` instead of `Stack` in `CBORParser`
+ (3.1.6)

release-notes/VERSION

@@ -39,6 +39,9 @@ No changes since 3.2
 #735: (cbor) "stringref" property-name paths pass 5-bit length marker instead of
   actual length to `shouldReferenceString()`
 #736: (cbor) Long Object property names added to "stringref" reference table twice
+#742: Use `ArrayDeque` instead of `Stack` in `CBORParser`
+ (reported by Benoît M)
+ (fix by @cowtowncoder, w/ Claude code)
 
 3.2.1 (10-Jul-2026)
 
@@ -73,6 +76,9 @@ No changes since 3.2.0
   actual length to `shouldReferenceString()`
 #736: (cbor) Long Object property names added to "stringref" reference table twice
  (NOTE: in 3.x this affected the `nextNameMatch()` decoding path as well)
+#742: Use `ArrayDeque` instead of `Stack` in `CBORParser`
+ (reported by Benoît M)
+ (fix by @cowtowncoder, w/ Claude code)
 
 3.1.5 (07-Jul-2026)