https://github.com/FasterXML/jackson-databind
hacktoberfest jackson jackson-databind json
Score: 37.711907399621985
Last synced: about 8 hours ago
JSON representation
Repository metadata:
General data-binding package for Jackson: works on streaming API (core) implementation(s)
- Host: GitHub
- URL: https://github.com/FasterXML/jackson-databind
- Owner: FasterXML
- License: apache-2.0
- Created: 2011-12-23T07:17:41.000Z (over 14 years ago)
- Default Branch: 3.x
- Last Pushed: 2026-08-16T17:40:52.000Z (7 days ago)
- Last Synced: 2026-08-20T13:09:19.818Z (3 days ago)
- Topics: hacktoberfest, jackson, jackson-databind, json
- Language: Java
- Homepage:
- Size: 84.6 MB
- Stars: 3,746
- Watchers: 162
- Forks: 1,507
- Open Issues: 132
-
Metadata Files:
- Readme: README.md
- Funding: .github/FUNDING.yml
- License: LICENSE
- Security: SECURITY.md
- Claude: CLAUDE.md
-
Funding:
- Tidelift: maven/com.fasterxml.jackson.core:jackson-databind
- Github: cowtowncoder
Owner metadata:
- Name: FasterXML, LLC
- Login: FasterXML
- Email: info@fasterxml.com
- Kind: organization
- Description:
- Website: http://fasterxml.com
- Location: Seattle, WA
- Twitter:
- Company:
- Icon url: https://avatars.githubusercontent.com/u/382692?v=4
- Repositories: 68
- Last Synced at: 2026-08-23T00:58:59.842Z
- Profile URL: https://github.com/FasterXML
GitHub Events
Total
- Commit comment event: 5
- Create event: 321
- Delete event: 297
- Discussion event: 2
- Fork event: 90
- Gollum event: 1
- Issue comment event: 2550
- Issues event: 900
- Pull request event: 827
- Pull request review comment event: 578
- Pull request review event: 712
- Push event: 2174
- Watch event: 146
- Total: 8603
Last Year
- Commit comment event: 1
- Create event: 169
- Delete event: 157
- Discussion event: 2
- Fork event: 16
- Gollum event: 1
- Issue comment event: 863
- Issues event: 399
- Pull request event: 315
- Pull request review comment event: 167
- Pull request review event: 194
- Push event: 1028
- Watch event: 34
- Total: 3346
Committers metadata
Last synced: 4 days ago
Total Commits: 9,087
Total Committers: 380
Avg Commits per committer: 23.913
Development Distribution Score (DDS): 0.149
Commits in past year: 1,086
Committers in past year: 49
Avg Commits per committer in past year: 22.163
Development Distribution Score (DDS) in past year: 0.179
| Name | Commits | |
|---|---|---|
| Tatu Saloranta | t****a@i****i | 7730 |
| Kim, Joo Hyuk | b****e@g****m | 238 |
| PJ Fanning | p****g | 134 |
| Tatu | t****u@n****m | 78 |
| dependabot[bot] | 4****] | 61 |
| Tatu Saloranta | t****a@s****m | 43 |
| jackphel | j****l@g****m | 27 |
| Pascal Gélinas | p****s@n****m | 26 |
| Lee Jiwon | 1****9 | 23 |
| Jackson | h****5@n****m | 22 |
| Christopher Currie | c****r@c****m | 20 |
| Carter Kozak | c****k@c****t | 19 |
| wrongwrong | k****7 | 14 |
| Francis Galiegue | f****e@g****m | 12 |
| Francis Galiegue | f****e@c****m | 11 |
| Jonas Konrad | j****d@o****m | 11 |
| Bertrand Renuart | b****t@i****u | 10 |
| Andy Boothe | a****e@g****m | 9 |
| Copilot | 1****t | 9 |
| Carsten Wickner | C****r@g****e | 9 |
| Benson Margulies | b****n@b****m | 8 |
| Hugo Wood | h****5@f****r | 8 |
| Sim Yih Tsern | s****n@y****m | 8 |
| Davyd Fridman | d****l@g****m | 8 |
| Ville Koskela | v****e@k****m | 8 |
| Martin Steiger | g****t@m****e | 7 |
| Muhammad Khalikov | 5****2 | 6 |
| iProdigy | 8****y | 6 |
| Matthew Morrissette | y****a@g****m | 6 |
| Michael Spiegel | s****l@a****m | 5 |
| and 350 more... | ||
Issue and Pull Request metadata
Last synced: 1 day ago
Total issues: 773
Total pull requests: 1,090
Average time to close issues: over 1 year
Average time to close pull requests: 29 days
Total issue authors: 505
Total pull request authors: 100
Average comments per issue: 4.96
Average comments per pull request: 2.02
Merged pull request: 830
Bot issues: 1
Bot pull requests: 52
Past year issues: 65
Past year pull requests: 129
Past year average time to close issues: 3 days
Past year average time to close pull requests: 4 days
Past year issue authors: 42
Past year pull request authors: 34
Past year average comments per issue: 4.06
Past year average comments per pull request: 4.06
Past year merged pull request: 63
Past year bot issues: 0
Past year bot pull requests: 4
Top Issue Authors
- cowtowncoder (136)
- pjfanning (23)
- k163377 (17)
- JooHyukKim (11)
- sdeleuze (10)
- yihtserns (7)
- odrotbohm (7)
- joca-bt (7)
- nlisker (6)
- garretwilson (5)
- hajdamak (4)
- quaff (4)
- lbenedetto (3)
- aysha-afrah26 (3)
- Gems (3)
Top Pull Request Authors
- cowtowncoder (387)
- JooHyukKim (278)
- pjfanning (120)
- dependabot[bot] (52)
- k163377 (19)
- yihtserns (14)
- aysha-afrah26 (10)
- timo-a (8)
- giulong (7)
- hannyu (7)
- Dongnyoung (6)
- stevenschlansker (6)
- iifawzi (6)
- zhenlin (6)
- JacksonJang (5)
Top Issue Labels
- to-evaluate (208)
- 3.0 (71)
- has-failing-test (53)
- 2.18 (42)
- need-test-case (42)
- 3.x (26)
- 2.19 (26)
- Record (26)
- 2.17 (18)
- 2.15 (16)
- will-not-fix (16)
- 2.20 (14)
- 3.0-release-notes (14)
- lombok (13)
- duplicate (13)
- most-wanted (10)
- enum (10)
- property-discovery (10)
- pr-welcome (9)
- 2.16 (8)
- 3.2 (8)
- 3.3 (5)
- objectid (4)
- CVE (3)
- performance (3)
- polymorphic-deduction (3)
- 2.21 (3)
- property-iPhone (3)
- date-time-config (3)
- builder-related (3)
Top Pull Request Labels
- dependencies (52)
- cla-received (45)
- 2.19 (28)
- 2.18 (28)
- 3.0 (28)
- github_actions (14)
- 2.20 (12)
- 3.0-release-notes (10)
- 2.17 (8)
- 3.3 (7)
- 3.x (7)
- cla-needed (5)
- 3.2 (3)
- CVE (3)
- 3.1 (3)
- 2.21 (3)
- most-wanted (3)
- to-evaluate (2)
- date-time-config (2)
- gen-ai (1)
- 2.15 (1)
- 2.16 (1)
- Record (1)
- processing-limits (1)
- 희수 (1)
- Feat (1)
- performance (1)
- Refactor (1)
Package metadata
- Total packages: 10
- Total downloads: unknown
- Total docker downloads: 16,205,913,711
- Total dependent packages: 23,585 (may contain duplicates)
- Total dependent repositories: 244,228 (may contain duplicates)
- Total versions: 287
- Total advisories: 81
repo1.maven.org: com.fasterxml.jackson.core:jackson-databind
General data-binding functionality for Jackson: works on core streaming API
- Homepage: https://github.com/FasterXML/jackson
- Documentation: https://appdoc.app/artifact/com.fasterxml.jackson.core/jackson-databind/
- Licenses: The Apache Software License, Version 2.0
- Latest release: 2.22.2 (published 7 days ago)
- Last Synced: 2026-08-22T14:39:58.289Z (1 day ago)
- Versions: 232
- Dependent Packages: 23,566
- Dependent Repositories: 244,221
- Docker Downloads: 16,203,456,674
-
Rankings:
- Docker downloads count: 0.001%
- Dependent packages count: 0.001%
- Dependent repos count: 0.002%
- Average: 2.032%
- Forks count: 4.351%
- Stargazers count: 5.803%
-
Advisories:
- jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserialization
- jackson-databind: `@JsonView` bypass for creator properties with `@JsonTypeInfo(include=As.EXTERNAL_PROPERTY)`
- jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy
- jackson-databind has @JsonView bypass for setterless creator properties
- jackson-databind's renamed @JsonIgnore'd setters can deserialize via private fields
- jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)
- jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)
- jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation
- jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString()
- jackson-databind has a @JsonView bypass for unwrapped creator parameters
- jackson-databind possible Denial of Service if using JDK serialization to serialize JsonNode
- Uncontrolled Resource Consumption in Jackson-databind
- Uncontrolled Resource Consumption in FasterXML jackson-databind
- jackson-databind vulnerable to unsafe deserialization
- Deeply nested json in jackson-databind
- Unsafe Deserialization in jackson-databind
- Unsafe Deserialization in jackson-databind
- Unsafe Deserialization in jackson-databind
- Unsafe Deserialization in jackson-databind
- Unsafe Deserialization in jackson-databind
- Unsafe Deserialization in jackson-databind
- Unsafe Deserialization in jackson-databind
- Unsafe Deserialization in jackson-databind
- Unsafe Deserialization in jackson-databind
- Unsafe Deserialization in jackson-databind
- Unsafe Deserialization in jackson-databind
- Serialization gadget exploit in jackson-databind
- Serialization gadgets exploit in jackson-databind
- Serialization gadgets exploit in jackson-databind
- Code Injection in jackson-databind
- Unsafe Deserialization in jackson-databind
- XML External Entity (XXE) Injection in Jackson Databind
- Deserialization of untrusted data in jackson-databind
- Deserialization of Untrusted Data in jackson-databind
- Deserialization of untrusted data in Jackson Databind
- Deserialization of untrusted data in Jackson Databind
- Deserialization of untrusted data in Jackson Databind
- Deserialization of untrusted data in Jackson Databind
- Deserialization of Untrusted Data in jackson-databind
- Deserialization of Untrusted Data
- Improper Input Validation in jackson-databind
- jackson-databind mishandles the interaction between serialization gadgets and typing
- jackson-databind mishandles the interaction between serialization gadgets and typing
- Polymorphic deserialization of malicious object in jackson-databind
- jackson-databind mishandles the interaction between serialization gadgets and typing
- jackson-databind mishandles the interaction between serialization gadgets and typing
- Polymorphic deserialization of malicious object in jackson-databind
- jackson-databind mishandles the interaction between serialization gadgets and typing
- jackson-databind mishandles the interaction between serialization gadgets and typing
- jackson-databind mishandles the interaction between serialization gadgets and typing
- jackson-databind mishandles the interaction between serialization gadgets and typing
- jackson-databind mishandles the interaction between serialization gadgets and typing
- jackson-databind mishandles the interaction between serialization gadgets and typing
- jackson-databind mishandles the interaction between serialization gadgets and typing
- jackson-databind mishandles the interaction between serialization gadgets and typing
- Deserialization of Untrusted Data in jackson-databind
- Deserialization of Untrusted Data in jackson-databind
- jackson-databind polymorphic typing issue
- jackson-databind polymorphic typing issue
- Polymorphic Typing in FasterXML jackson-databind
- Polymorphic Typing issue in FasterXML jackson-databind
- Polymorphic Typing issue in FasterXML jackson-databind
- Deserialization of untrusted data in FasterXML jackson-databind
- Deserialization of untrusted data in FasterXML jackson-databind
- Deserialization of untrusted data in FasterXML jackson-databind
- Deserialization of Untrusted Data in jackson-databind
- Deserialization of Untrusted Data in FasterXML jackson-databind
- Information exposure in FasterXML jackson-databind
- jackson-databind Deserialization of Untrusted Data vulnerability
- Arbitrary Code Execution in jackson-databind
- XML External Entity Reference (XXE) in jackson-databind
- Server-Side Request Forgery (SSRF) in jackson-databind
- com.fasterxml.jackson.core:jackson-databind vulnerable to Deserialization of Untrusted Data
- Deserialization of Untrusted Data in jackson-databind
- Deserialization of Untrusted Data in jackson-databind due to polymorphic deserialization
- Arbitrary Code Execution in jackson-databind
- jackson-databind vulnerable to remote code execution due to incorrect deserialization and blocklist bypass
- jackson-databind vulnerable to deserialization flaw leading to unauthenticated remote code execution
- FasterXML jackson-databind allows unauthenticated remote code execution
- jackson-databind is vulnerable to a deserialization flaw
proxy.golang.org: github.com/FasterXML/jackson-databind
- Homepage:
- Status: removed
- Documentation: https://pkg.go.dev/github.com/FasterXML/jackson-databind#section-documentation
- Licenses: apache-2.0
- Latest release: v0.0.0-20260812033013-5e2a246e61f7 (published 12 days ago)
- Last Synced: 2026-08-22T14:08:00.290Z (1 day ago)
- Versions: 1
- Dependent Packages: 0
- Dependent Repositories: 0
-
Rankings:
- Dependent packages count: 4.482%
- Average: 4.633%
- Dependent repos count: 4.783%
proxy.golang.org: github.com/fasterxml/jackson-databind
- Homepage:
- Status: removed
- Documentation: https://pkg.go.dev/github.com/fasterxml/jackson-databind#section-documentation
- Licenses: apache-2.0
- Latest release: v0.0.0-20260811033113-87876ca5c056 (published 13 days ago)
- Last Synced: 2026-08-22T15:13:30.406Z (1 day ago)
- Versions: 1
- Dependent Packages: 0
- Dependent Repositories: 0
-
Rankings:
- Dependent packages count: 4.494%
- Average: 4.645%
- Dependent repos count: 4.796%
repo1.maven.org: com.jwebmp.jackson.core:jackson-databind
General data-binding functionality for Jackson: works on core streaming API
- Homepage: http://github.com/FasterXML/jackson
- Documentation: https://appdoc.app/artifact/com.jwebmp.jackson.core/jackson-databind/
- Licenses: The Apache Software License, Version 2.0
- Latest release: 0.66.0.1 (published over 7 years ago)
- Last Synced: 2026-08-22T14:05:22.966Z (1 day ago)
- Versions: 9
- Dependent Packages: 10
- Dependent Repositories: 7
-
Rankings:
- Forks count: 4.351%
- Stargazers count: 5.803%
- Dependent packages count: 5.981%
- Average: 6.327%
- Dependent repos count: 9.173%
repo1.maven.org: com.jwebmp.jpms.jackson.core:jackson-databind
General data-binding functionality for Jackson: works on core streaming API
- Homepage: http://github.com/FasterXML/jackson
- Documentation: https://appdoc.app/artifact/com.jwebmp.jpms.jackson.core/jackson-databind/
- Licenses: The Apache Software License, Version 2.0
- Latest release: 0.68.0.1 (published about 7 years ago)
- Last Synced: 2026-08-22T14:36:39.573Z (1 day ago)
- Versions: 11
- Dependent Packages: 7
- Dependent Repositories: 0
-
Rankings:
- Forks count: 3.265%
- Stargazers count: 4.592%
- Dependent packages count: 8.051%
- Average: 11.972%
- Dependent repos count: 31.98%
repo1.maven.org: com.jwebmp.jre11.jackson.core:jackson-databind
General data-binding functionality for Jackson: works on core streaming API
- Homepage: http://github.com/FasterXML/jackson
- Documentation: https://appdoc.app/artifact/com.jwebmp.jre11.jackson.core/jackson-databind/
- Licenses: The Apache Software License, Version 2.0
- Latest release: 0.63.0.19 (published over 7 years ago)
- Last Synced: 2026-08-22T14:17:33.554Z (1 day ago)
- Versions: 2
- Dependent Packages: 2
- Dependent Repositories: 0
-
Rankings:
- Forks count: 3.265%
- Stargazers count: 4.592%
- Average: 15.549%
- Dependent packages count: 22.361%
- Dependent repos count: 31.98%
repo1.maven.org: org.fasterxml.jackson.core:jackson-databind
General data-binding functionality for Jackson: works on core streaming API
- Homepage: https://github.com/FasterXML/jackson
- Documentation: https://appdoc.app/artifact/org.fasterxml.jackson.core/jackson-databind/
- Licenses: The Apache Software License, Version 2.0
- Latest release: 2.20.2 (published 8 months ago)
- Last Synced: 2026-08-22T14:27:53.110Z (1 day ago)
- Versions: 2
- Dependent Packages: 0
- Dependent Repositories: 0
-
Rankings:
- Dependent repos count: 30.734%
- Average: 37.336%
- Dependent packages count: 43.939%
repo1.maven.org: tools.jackson.core:jackson-databind
General data-binding functionality for Jackson: works on core streaming API
- Homepage: https://github.com/FasterXML/jackson
- Documentation: https://appdoc.app/artifact/tools.jackson.core/jackson-databind/
- Licenses: The Apache Software License, Version 2.0
- Latest release: 3.2.2 (published 8 days ago)
- Last Synced: 2026-08-22T14:17:32.743Z (1 day ago)
- Versions: 26
- Dependent Packages: 0
- Dependent Repositories: 0
- Docker Downloads: 2,457,037
-
Rankings:
- Dependent repos count: 34.658%
- Average: 42.106%
- Dependent packages count: 49.555%
-
Advisories:
- jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserialization
- jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy
- jackson-databind has @JsonView bypass for setterless creator properties
- jackson-databind's renamed @JsonIgnore'd setters can deserialize via private fields
- jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnoreProperties
- jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)
- jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)
- jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation
- jackson-databind has a @JsonView bypass for unwrapped creator parameters
guix: java-fasterxml-jackson-databind
Data-binding functionality and tree-model for the Jackson Data Processor
- Homepage: https://github.com/FasterXML/jackson-databind
- Documentation: https://git.savannah.gnu.org/cgit/guix.git/tree/gnu/packages/java.scm#n10367
- Licenses: asl2.0
- Latest release: 2.9.4 (published 6 months ago)
- Last Synced: 2026-04-27T17:48:50.974Z (4 months ago)
- Versions: 1
- Dependent Packages: 0
- Dependent Repositories: 0
-
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 100%
gentoo-portage: dev-java/jackson-databind
General data-binding functionality for Jackson: works on core streaming API
- Homepage: https://github.com/FasterXML/jackson-databind
- Documentation: https://packages.gentoo.org/packages/dev-java/jackson-databind
- Licenses: Apache-2.0
- Latest release: 2.20.0 (published 7 months ago)
- Last Synced: 2026-05-27T01:31:11.473Z (3 months ago)
- Versions: 2
- Dependent Packages: 0
- Dependent Repositories: 0
-
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 100%
Dependencies
- actions/upload-artifact v3 composite
- google/oss-fuzz/infra/cifuzz/actions/build_fuzzers master composite
- google/oss-fuzz/infra/cifuzz/actions/run_fuzzers master composite
- actions/checkout v3.3.0 composite
- github/codeql-action/analyze v2 composite
- github/codeql-action/autobuild v2 composite
- github/codeql-action/init v2 composite
- actions/checkout v3.3.0 composite
- actions/setup-java v3 composite
- codecov/codecov-action v3 composite
- org.junit:junit-bom 5.9.2 import
- com.fasterxml.jackson.core:jackson-annotations ${jackson.version.annotations}
- com.fasterxml.jackson.core:jackson-core ${jackson.version.core}
- com.google.guava:guava-testlib 31.1-jre test
- javax.measure:jsr-275 0.9.1 test
- org.junit.jupiter:junit-jupiter test
- org.junit.vintage:junit-vintage-engine test
- org.openjdk.jol:jol-core 0.16 test
- org.powermock:powermock-api-mockito2 2.0.9 test
- org.powermock:powermock-core 2.0.9 test
- org.powermock:powermock-module-junit4 2.0.9 test
- peter-evans/repository-dispatch ee5821560769e275d14326eff187898529fb6943 composite
- actions/checkout 3d3c42e5aac5ba805825da76410c181273ba90b1 composite
- actions/setup-java 03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 composite
- actions/checkout 3d3c42e5aac5ba805825da76410c181273ba90b1 composite
- actions/setup-java 03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 composite
- dawidd6/action-download-artifact b6e2e70617bc3265edd6dab6c906732b2f1ae151 composite
- peter-evans/repository-dispatch ee5821560769e275d14326eff187898529fb6943 composite