{"id":19563139,"url":"https://github.com/fasterxml/jackson-bom","last_synced_at":"2026-07-30T15:30:15.847Z","repository":{"id":43330184,"uuid":"69940348","full_name":"FasterXML/jackson-bom","owner":"FasterXML","description":"Bill of materials POM for Jackson projects","archived":false,"fork":false,"pushed_at":"2025-02-13T23:29:11.000Z","size":532,"stargazers_count":54,"open_issues_count":3,"forks_count":33,"subscribers_count":9,"default_branch":"2.19","last_synced_at":"2025-02-14T00:29:19.735Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Logos","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/FasterXML.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2016-10-04T06:46:45.000Z","updated_at":"2025-02-01T22:19:28.000Z","dependencies_parsed_at":"2023-09-27T03:58:57.268Z","dependency_job_id":"42e06358-6a4b-48db-8590-81e772e8d78e","html_url":"https://github.com/FasterXML/jackson-bom","commit_stats":null,"previous_names":[],"tags_count":125,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/FasterXML%2Fjackson-bom","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/FasterXML%2Fjackson-bom/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/FasterXML%2Fjackson-bom/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/FasterXML%2Fjackson-bom/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/FasterXML","download_url":"https://codeload.github.com/FasterXML/jackson-bom/tar.gz/refs/heads/2.19","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":240822691,"owners_count":19863307,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-11T05:16:42.606Z","updated_at":"2026-07-30T15:30:15.532Z","avatar_url":"https://github.com/FasterXML.png","language":"Logos","funding_links":["https://tidelift.com/badges/package/maven/com.fasterxml.jackson:jackson-bom","https://tidelift.com/subscription/pkg/maven-com-fasterxml-jackson-jackson-bom?utm_source=maven-com-fasterxml-jackson-jackson-bom\u0026utm_medium=referral\u0026utm_campaign=readme","https://tidelift.com/subscription/pkg/maven-com-fasterxml-jackson-jackson-bom"],"categories":[],"sub_categories":[],"readme":"# Jackson BOM\n\nThis project contains \"bill of materials\" POM for Jackson dependencies.\nFor more on concept of BOMs, see:\n\n* [The Bill of Materials in Maven](https://dzone.com/articles/the-bill-of-materials-in-maven)\n* [Using Maven’s Bill of Materials (BOM)](https://reflectoring.io/maven-bom/)\n\nBut the basic idea is that instead of specifying version explicitly for every Jackson\ncomponent, as part of dependency definition, one can use a BOM to get a full, complete\nset of consistent versions to use.\n\n## Status\n\n[![Build Status](https://travis-ci.org/FasterXML/jackson-bom.svg)](https://travis-ci.org/FasterXML/jackson-bom)\n[![Tidelift](https://tidelift.com/badges/package/maven/com.fasterxml.jackson:jackson-bom)](https://tidelift.com/subscription/pkg/maven-com-fasterxml-jackson-jackson-bom?utm_source=maven-com-fasterxml-jackson-jackson-bom\u0026utm_medium=referral\u0026utm_campaign=readme)\n\n## Usage\n\nThere are two ways to use the BOM pom: either as parent pom:\n\n```xml\n  \u003cparent\u003e\n    \u003cgroupId\u003ecom.fasterxml.jackson\u003c/groupId\u003e\n    \u003cartifactId\u003ejackson-bom\u003c/artifactId\u003e\n    \u003cversion\u003e2.16.1\u003c/version\u003e\n  \u003c/parent\u003e\n```\n\nor by importing the BOM to get versions via so-called \"managed dependencies\"\n(NOTE: BOM can NOT be used as an explicit dependency; it MUST be either parent pom\nor imported in `\u003cdependencyManagement\u003e` section)\n\n```xml\n\u003cdependencyManagement\u003e\n  \u003cdependencies\u003e\n    \u003cdependency\u003e\n      \u003cgroupId\u003ecom.fasterxml.jackson\u003c/groupId\u003e\n      \u003cartifactId\u003ejackson-bom\u003c/artifactId\u003e\n      \u003cversion\u003e2.16.1\u003c/version\u003e\n      \u003cscope\u003eimport\u003c/scope\u003e\n      \u003ctype\u003epom\u003c/type\u003e\n    \u003c/dependency\u003e   \n  \u003c/dependencies\u003e\n\u003c/dependencyManagement\u003e\n```\n\nTwo approaches are same with respect to dependency inclusion; latter ONLY includes dependencies,\nformer includes many other settings.\nUsually latter is preferable, unless component is very closely coupled with core Jackson components.\n\n## Jackson Versioning\n\n### Semantic Versioning\n\nJackson tries to follow [Semantic Versioning](https://en.wikipedia.org/wiki/Software_versioning#Semantic_versioning) (aka \"SemVer\")\nfor its Public API; public methods of types like `ObjectMapper` and `JsonFactory` that calling applications need.\nThis means that code written against Jackson 2.0.0 that only uses Public API should still work with no changes with Jackson 2.16.0.\n\nSemantic versioning is, however, NOT guaranteed for types considered internal, and in particular customizations by sub-classing is not covered by same guarantees.\nIn case of Internal API (extension points meant for Jackson core components) Jackson will still try to guarantee compatibility with \"adjacent\" minor versions: that is, code written against Jackson 2.9.0 should still work against Jackson 2.10.x (and in many cases further, but at least with the \"next version\").\nDeprecation markers are added for internal methods and types where necessary so that if no deprecation warnings are encountered, code should work for next two minor versions.\n\nIt is understood that the distinction between \"Public\" and \"Internal\" APIs is not always easy to distinguish; Javadocs are used in places to try to make distinction clear.\n\nHaving said all that, for most users and most usage Semantic Versioning is maintained.\n\n### \"Normal\" minor version releases\n\nMost of the time all Jackson components are released using 3-digit version, like `2.16.0`.\nIf so, there will be, for this version:\n\n1. A full set of all core Jackson components under `FasterXML` Github organization\n2. Matching `jackson-bom`\n\nBut occasionally there is a need for a \"hot fix\" -- usually a fix to a security issue (aka \"CVE\") --\neither in-between \"full minor releases\" or after specific branch has been closed for active\ndevelopment. In such cases a version of only component affected (most often `jackson-databind`)\nis released and there is no full set of components.\nVersion number will, in such cases, consist of 4 digits like [jackson-databind-2.12.6.1](https://mvnrepository.com/artifact/com.fasterxml.jackson.core/jackson-databind/2.12.6.1).\nNote: the reason for NOT releasing a full set in such cases is both due to effort needed (full set takes multiple hours to release in the optimal case) and to avoid having multiple full sets with very few changes.\n\nBecause there is no full set of `2.12.6.1` components -- and there may be 1 or more components with `2.12.6.1` (or we may have `2.12.6.2` and so on), it is not practical to release BOM with that version (both since there may be various numbers of micro-patches over time, and since assumption by users could be there IS a full set), a different version convention is used for these case: use of datestamp version.\n\nAs the specific example, `jackson-databind` `2.12.6.1` was released on March 26, 2022, and so the matching bom is [jackson-bom-2.12.6.20220326](https://mvnrepository.com/artifact/com.fasterxml.jackson/jackson-bom/2.12.6.20220326). Some users dislike this longer notation, but it has some specific benefits:\n\n* Version numbers will sort appropriately: `2.12.6.20220326` comes after both `2.12.6` and hypothetical `2.12.6.1`\n* Version number gives an idea of release date, wrt time of hot fix(es) included\n\n## Secondary: \"base\" sub-project\n\nNote that this repo ALSO contains `jackson-base` (see under dir `base/`), which is the intended\nparent pom for Jackson core components.\nIt extends `jackson-bom`, augmenting with settings that\nare only/mostly relevant for Jackson components, but not to things that depend on Jackson in general.\nUse of `jackson-base` is not recommended for libraries that are not meant to be coupled with Jackson\nrelease cycle and settings.\n\n## Support\n\n### Community support\n\nJackson components are supported by the Jackson community through mailing lists, Gitter forum,\nGithub issues. See [CONTRIBUTING](https://github.com/FasterXML/jackson/blob/master/CONTRIBUTING.md)\nfor full details.\n\n### Enterprise support\n\nAvailable as part of the [Tidelift](https://tidelift.com/subscription/pkg/maven-com-fasterxml-jackson-jackson-bom) Subscription.\n\nThe maintainers of `jackson-bom` and thousands of other packages are working with Tidelift to deliver\ncommercial support and maintenance for the open source dependencies you use to build your applications.\nSave time, reduce risk, and improve code health, while paying the maintainers of the exact dependencies\nyou use.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffasterxml%2Fjackson-bom","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ffasterxml%2Fjackson-bom","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffasterxml%2Fjackson-bom/lists"}