Jackson Release 2.18.7

Patch version of 2.18, released on April 24, 2026.

Following fixes are included in this patch release.

Changes, core

Streaming

• #1570: Fail parsing from DataInput if StreamReadConstraints.getMaxDocumentLength() set [GHSA-2m67-wjpj-xhg9]
• #1600: Rework 3rd party licenses in jar
• #1602: UTF8DataInputJsonParser needs to enforce StreamReadConstraints.maxNameLength limit

Changes, data formats

CSV

• #615: Feature CsvReadFeature.EMPTY_UNQUOTED_STRING_AS_NULL ignored