Skip to content

JSTEP

Jump to bottom
Tatu Saloranta edited this page May 10, 2025 · 73 revisions

Jackson STrategic Enhancement Proposals (JSTEP)

With Jackson 3, we want to start experimenting with something like "Jackson Big Ideas", maybe similar to Kafka KIPs. Not unlike IETF RFCs, but bit smaller documents.

Name chosen (back in 2017) is "JSTEP" (Jackson STrategic Enhancement Proposal") and seems to work.

Last update(s):

  • 2025-02-25: Note that [JSTEP-3] fully complete
  • 2025-02-05: Note that [JSTEP-2] is mostly complete

Completed JSTEPs

  • JSTEP-1: Major Version 3.x High-level Upgrade Compatibility -- Maven, Java package renaming decided, implemented (Jackson 3.0)
  • JSTEP-3: JsonNode improvements (for 3.0.0-rc2)
  • JSTEP-4: Replace checked JsonProcessingException with unchecked JacksonException (Jackson 3.0)
  • JSTEP-6: Jackson 3 Big Renaming of Core Entities -- all planned renaming done
  • JSTEP-7: More modular on/off "Feature"s beyond existing mapper/ser/deser (Jackson 2.x)
  • JSTEP-8: Jackson 3 renaming of format-specific Read/Write features (Jackson 3.0)
  • JSTEP-10: Unifying testing structure/tools (JUnit 5)
    • All Jackson 3.x modules converted
  • JSTEP-11: Native JPMS module-info.java use
    • Missing Scala module: no current plans to complete (JPMS not supported by Scala community)
  • JSTEP-12: Head branch renaming: 2.19->2.x, master->3.x

Mostly Completed JSTEPs

Some of JSTEPs are seemingly completed, but there is a small chance changes or follow-up work might be needed

  • JSTEP-2: Jackson 3 default setting, behavior changes -- a lot has been done, some work may remain (Jackson 3.0)
  • JSTEP-9: Jackson 3.0 Removal of Deprecated 2.x Modules

JSTEPs started

  • JSTEP-5: Unify Date/Time handling, formats, defaults across JDK Classic, Joda and Java 8 date/time
    • Preliminary discussion on scope
  • JSTEP-14: Generate, publish SBOMs for Jackson components
    • Added to generate for 2.20, 3.0.0

JSTEPs not yet worked on

  • JSTEP-13: Long-Term Support (LTS) branches, versions

JSTEPs considered

Processing Limits

Add some kind of processing limits for accepted input (max depth of nesting, number of keys per Object), to protected against DoS attacks. Similar to (for example), Woodstox' limits.

This was actually implemented without writing separate JSTEP entry; initial work for Jackson 2.15. Relevant initial issues include:

Separate Tree Model for jackson-dataformat-xml

Add proper Tree Model for jackson-dataformat-xml (instead, minor improvements to existing JsonNode, like auto-conversion of ObjectNode to ArrayNode

  • Made bit less necessary by 2.12 work to support implicit coercion of sequences into ArrayNode (dataformat-xml#403)
  • Other reasons still exist so this may yet be added

Sources for new JSTEPs

Although any improvement idea can become a JSTEP, one good source is Major Design/Implementation Issues, which lists areas where current design limits implementation improvements.

Also, "most-wanted" labeled issues are a potential source:

Clone this wiki locally