Merge branch '2.16' into serialization-order-test

.github/dependabot.yml

@@ -4,3 +4,7 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+    groups:
+      github-actions:
+        patterns:
+          - "*"

.github/workflows/cifuzz.yml

@@ -30,7 +30,7 @@ jobs:
         dry-run: false
         language: jvm
     - name: Upload Crash
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
       if: failure() && steps.build.outcome == 'success'
       with:
         name: artifacts

.github/workflows/codeql-analysis.yml

@@ -23,16 +23,16 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v3.5.3
+      uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v2
+      uses: github/codeql-action/init@74483a38d39275f33fcff5f35b679b5ca4a26a99 # v2.22.5
       with:
         languages: ${{ matrix.language }}
 
     - name: Autobuild
-      uses: github/codeql-action/autobuild@v2
+      uses: github/codeql-action/autobuild@74483a38d39275f33fcff5f35b679b5ca4a26a99 # v2.22.5
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v2
+      uses: github/codeql-action/analyze@74483a38d39275f33fcff5f35b679b5ca4a26a99 # v2.22.5

.github/workflows/main.yml

@@ -25,14 +25,14 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        java_version: ['8', '11', '17']
+        java_version: ['8', '11', '17', '21']
         os: ['ubuntu-20.04']
     env:
       JAVA_OPTS: "-XX:+TieredCompilation -XX:TieredStopAtLevel=1"
     steps:
-    - uses: actions/checkout@v3.5.3
+    - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
     - name: Set up JDK
-      uses: actions/setup-java@v3
+      uses: actions/setup-java@0ab4596768b603586c0de567f2430c30f5b0d2b0 # v3.13.0
       with:
         distribution: 'temurin'
         java-version: ${{ matrix.java_version }}
@@ -63,7 +63,7 @@ jobs:
       run: ./mvnw -B -q -ff -ntp test
     - name: Publish code coverage
       if: github.event_name != 'pull_request' && matrix.java_version == '8'
-      uses: codecov/codecov-action@v3
+      uses: codecov/codecov-action@eaaf4bedf32dbdc6b720b63067d99c4d77d6047d # v3.1.4
       with:
         token: ${{ secrets.CODECOV_TOKEN }}
         file: ./target/site/jacoco/jacoco.xml

.github/workflows/win.yml

@@ -0,0 +1,40 @@
+name: Build and Test Snapshot (Windows)
+on:
+  push:
+    branches:
+    - master
+    - "3.0"
+    - "2.16"
+    paths-ignore:
+    - "README.md"
+    - "release-notes/*"
+  pull_request:
+    branches:
+    - master
+    - "3.0"
+    - "2.16"
+    paths-ignore:
+    - "README.md"
+    - "release-notes/*"
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: 'windows-2022'
+    strategy:
+      fail-fast: false
+      matrix:
+        java_version: ['8']
+    env:
+      JAVA_OPTS: "-XX:+TieredCompilation -XX:TieredStopAtLevel=1"
+    steps:
+    - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+    - name: Set up JDK
+      uses: actions/setup-java@0ab4596768b603586c0de567f2430c30f5b0d2b0 # v3.13.0
+      with:
+        distribution: 'temurin'
+        java-version: ${{ matrix.java_version }}
+        cache: 'maven'
+    - name: Build
+      run: cmd /c "mvnw.cmd -B -ff -ntp clean verify"

.gitignore

@@ -9,7 +9,8 @@ syntax: glob
 .DS_Store
 
 # building
-target
+/target
+.mvn/wrapper/maven-wrapper.jar
 
 # Eclipse
 .classpath

README.md

@@ -18,7 +18,8 @@ Naming of classes uses word 'JSON' in many places even though there is no actual
 | Artifact | [![Maven Central](https://maven-badges.herokuapp.com/maven-central/com.fasterxml.jackson.core/jackson-databind/badge.svg)](https://maven-badges.herokuapp.com/maven-central/com.fasterxml.jackson.core/jackson-databind) |
 | OSS Sponsorship | [![Tidelift](https://tidelift.com/badges/package/maven/com.fasterxml.jackson.core:jackson-databind)](https://tidelift.com/subscription/pkg/maven-com-fasterxml-jackson-core-jackson-databind?utm_source=maven-com-fasterxml-jackson-core-jackson-databind&utm_medium=referral&utm_campaign=readme) |
 | Javadocs | [![Javadoc](https://javadoc.io/badge/com.fasterxml.jackson.core/jackson-databind.svg)](http://www.javadoc.io/doc/com.fasterxml.jackson.core/jackson-databind) |
-| Code coverage (2.15) | [![codecov.io](https://codecov.io/github/FasterXML/jackson-databind/coverage.svg?branch=2.15)](https://codecov.io/github/FasterXML/jackson-databind?branch=2.15) |
+| Code coverage (2.16) | [![codecov.io](https://codecov.io/github/FasterXML/jackson-databind/coverage.svg?branch=2.16)](https://codecov.io/github/FasterXML/jackson-databind?branch=2.16) |
+| OpenSSF Score | [![OpenSSF  Scorecard](https://api.securityscorecards.dev/projects/github.com/FasterXML/jackson-databind/badge)](https://securityscorecards.dev/viewer/?uri=github.com/FasterXML/jackson-databind) |
 
 # Get it!
 
@@ -76,10 +77,12 @@ Jackson-databind package baseline JDK requirements are as follows:
 
 ### Android
 
-List is incomplete due to recent addition of compatibility checker.
+List is incomplete due to compatibility checker addition being done for Jackson 2.13.
 
 * 2.13: Android SDK 24+
 * 2.14: Android SDK 26+
+* 2.15: Android SDK 26+
+* 2.16: Android SDK 26+
 
 for information on Android SDK versions to Android Release names see [https://en.wikipedia.org/wiki/Android_version_history]
 
@@ -156,26 +159,30 @@ Map<String, ResultValue> results = mapper.readValue(jsonSource,
 
 But wait! There is more!
 
+(enters Tree Model...)
+
+### Tree Model
+
 While dealing with `Map`s, `List`s and other "simple" Object types (Strings, Numbers, Booleans) can be simple, Object traversal can be cumbersome.
 This is where Jackson's [Tree model](https://github.com/FasterXML/jackson-databind/wiki/JacksonTreeModel) can come in handy:
 
 ```java
 // can be read as generic JsonNode, if it can be Object or Array; or,
 // if known to be Object, as ObjectNode, if array, ArrayNode etc:
-ObjectNode root = mapper.readTree("stuff.json");
+JsonNode root = mapper.readTree("{ \"name\": \"Joe\", \"age\": 13 }");
 String name = root.get("name").asText();
 int age = root.get("age").asInt();
 
 // can modify as well: this adds child Object as property 'other', set property 'type'
-root.with("other").put("type", "student");
-String json = mapper.writeValueAsString(root);
+root.withObject("/other").put("type", "student");
+String json = mapper.writeValueAsString(root); // prints below
 
 /*
 with above, we end up with something like as 'json' String:
 {
   "name" : "Bob",
   "age" : 13,
-    "other" : {
+  "other" : {
     "type" : "student"
   }
 } 
@@ -184,6 +191,39 @@ with above, we end up with something like as 'json' String:
 
 Tree Model can be more convenient than data-binding, especially in cases where structure is highly dynamic, or does not map nicely to Java classes.
 
+Finally, feel free to mix and match, and even in the same json document (useful when only part of the document is known and modeled in your code)
+
+```java
+// Some parts of this json are modeled in our code, some are not
+JsonNode root = mapper.readTree(complexJson);
+Person p = mapper.treeToValue(root.get("person"), Person.class); // known single pojo
+Map<String, Object> dynamicmetadata = mapper.treeToValue(root.get("dynamicmetadata"), Map.class); // unknown smallish subfield, convert all to collections
+int singledeep = root.get("deep").get("large").get("hiearchy").get("important").intValue(); // single value in very deep optional subfield, ignoring the rest
+int singledeeppath = root.at("/deep/large/hiearchy/important").intValue(); // json path
+int singledeeppathunique = root.findValue("important").intValue(); // by unique field name
+
+// Send an aggregate json from heterogenous sources
+ObjectNode root = mapper.createObjectNode();
+root.putPOJO("person", new Person("Joe")); // simple pojo
+root.putPOJO("friends", List.of(new Person("Jane"), new Person("Jack"))); // generics
+Map<String, Object> dynamicmetadata = Map.of("Some", "Metadata");
+root.putPOJO("dynamicmetadata", dynamicmetadata);  // collections
+root.putPOJO("dynamicmetadata", mapper.valueToTree(dynamicmetadata)); // same thing
+root.set("dynamicmetadata", mapper.valueToTree(dynamicmetadata)); // same thing
+root.withObject("deep").withObject("large").withObject("hiearchy").put("important", 42); // create as you go
+root.withObject("/deep/large/hiearchy").put("important", 42); // json path
+mapper.writeValueAsString(root);
+```
+
+**Supported for Jackson 2.16+ versions**
+
+```java
+// generics
+List<Person> friends = mapper.treeToValue(root.get("friends"), new TypeReference<List<Person>>() { });
+// create as you go but without trying json path
+root.withObjectProperty("deep").withObjectProperty("large").withObjectProperty("hiearchy").put("important", 42);
+```
+
 ## 5 minute tutorial: Streaming parser, generator
 
 As convenient as data-binding (to/from POJOs) can be; and as flexible as Tree model can be, there is one more canonical processing model available: incremental (aka "streaming") model.
@@ -557,14 +597,14 @@ usually a Jackson module.
 `master` branch is for developing the next major Jackson version -- 3.0 -- but there
 are active maintenance branches in which much of development happens:
 
-* `2.15` is the branch for "next" minor version to release (as of November 2022)
-* `2.14` is the current stable minor 2.x version
-* `2.13` is for selected backported fixes
+* `2.16` is the branch for "next" minor version to release (as of July 2023)
+* `2.15` is the current stable minor 2.x version
+* `2.14` is for selected backported fixes
 
 Older branches are usually not maintained after being declared as closed
 on [Jackson Releases](https://github.com/FasterXML/jackson/wiki/Jackson-Releases) page,
 but exist just in case a rare emergency patch is needed.
-All released versions have matching git tags (`jackson-dataformats-binary-2.12.3`).
+All released versions have matching git tags (e.g. `jackson-dataformats-binary-2.12.3`).
 
 -----