Upgrade to Jackson 2.10.0

[philwebb]

We should also test early with 2.10.0.pr2

[wilkinsona]

I couldn't find a release date for 2.10. Do we know it's going to GA before we want to GA 2.2?

[snicoll]

There has been some discussion with @cowtowncoder and it looks like a release may happen in September. We should probably move this one back to 2.2.x.

[cowtowncoder]

2.10.0.pr2 is out now (released yesterday): intent is to release in second part of September, not expecting blockers. Happy to coordinate, given that 2.10 will get rid of pesky polymorphic deser CVEs that users are... not thrilled to have upgrade for.

[wilkinsona]

Boot builds cleanly with 2.10.0.pr2 with some minor changes. Those changes are also 2.9.x-compatible.

[cowtowncoder]

@wilkinsona Good. Intention was to try to limit compatibility problems. There was one change that may be somewhat visible (assignment-compatibility for TypeReference<T> taking readValue() methods), being source-incompatible in some cases (but fully binary compatible); and for users running on Java 9 and later there is the question of how good module-info definitions are (being the first version with that info).

Please let me know of new issues found. I still hope to fix a few before final release.

[sdeleuze]

Jackson 2.10 release may happen September 26th in time for Spring Framework 5.2 GA, see related issue.