Jackson Release 2.13.5

Possible patch version of 2.13, not yet released.

Following fixes would be included in this patch release.

Changes, core

Databind

• #3590: Add check in primitive value deserializers to avoid deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS [CVE-2022-42003]
• #3659: Improve testing (likely via CI) to try to ensure compatibility with specific Android SDKs
• #3661: Jackson 2.13 uses Class.getTypeName() that is only available on Android SDK 26

Changes, data formats

XML

• Upgrade Woodstox to 6.4.0 for a fix to [CVE-2022-40152]

Changes, other

Jackson-jr

• #98: module-info.java of jr-stree refers to module com.fasterxml.jackson.jr.ob.api, which is not defined