Upgrade to Jackson 3

build-tools/pom.xml

@@ -0,0 +1,20 @@
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+
+	<modelVersion>4.0.0</modelVersion>
+
+	<artifactId>flowable-build-tools</artifactId>
+
+	<parent>
+		<groupId>org.flowable</groupId>
+        <artifactId>flowable-root</artifactId>
+		<version>8.0.0-SNAPSHOT</version>
+	</parent>
+
+    <properties>
+        <maven.deploy.skip>true</maven.deploy.skip>
+        <checkstyle.skip>true</checkstyle.skip>
+    </properties>
+
+
+</project>

build-tools/src/main/resources/build-config/checkstyle.xml

@@ -0,0 +1,51 @@
+<?xml version="1.0"?>
+
+<!DOCTYPE module PUBLIC
+    "-//Puppy Crawl//DTD Check Configuration 1.3//EN"
+    "http://www.puppycrawl.com/dtds/configuration_1_3.dtd">
+
+<!-- Based on sun_checks.xml from the CheckStyle distribution -->
+
+<module name="Checker">
+    <!--
+        If you set the basedir property below, then all reported file
+        names will be relative to the specified directory. See
+        https://checkstyle.sourceforge.io/config.html
+
+        <property name="basedir" value="${basedir}"/>
+    -->
+
+    <property name="cacheFile" value="${checkstyle.cache.file}"/>
+
+    <module name="SuppressWithPlainTextCommentFilter"/>
+
+    <module name="TreeWalker">
+
+        <module name="SuppressWarningsHolder"/>
+
+        <!-- Checks for imports                              -->
+        <!-- See https://checkstyle.sourceforge.io/checks/imports/index.html -->
+        <module name="AvoidStarImport"/>
+        <module name="IllegalImport"/> <!-- defaults to sun.* packages -->
+        <!--<module name="RedundantImport"/>-->
+        <!--<module name="UnusedImports">-->
+        <!--    <property name="processJavadoc" value="true"/>-->
+        <!--</module>-->
+        <module name="ImportControl">
+            <property name="file" value="/build-config/import-control.xml" />
+        </module>
+
+
+        <!-- Checks for class design                         -->
+        <!-- See https://checkstyle.sourceforge.io/checks/design/index.html -->
+<!--        <module name="VisibilityModifier">-->
+<!--            <property name="packageAllowed" value="true" />-->
+<!--            <property name="protectedAllowed" value="true" />-->
+<!--        </module>-->
+
+        <module name="SuppressionCommentFilter"/>
+    </module>
+
+    <module name="SuppressWarningsFilter"/>
+
+</module>

build-tools/src/main/resources/build-config/import-control.xml

@@ -0,0 +1,40 @@
+<?xml version="1.0"?>
+<!DOCTYPE import-control PUBLIC
+        "-//Puppy Crawl//DTD Import Control 1.4//EN"
+        "http://www.puppycrawl.com/dtds/import_control_1_4.dtd">
+<import-control pkg="org">
+
+    <subpackage name="flowable">
+        <allow pkg="com.fasterxml.jackson.annotation"/>
+        <allow pkg="com.fasterxml.uuid"/>
+        <disallow pkg="com.fasterxml"/>
+        <disallow pkg="org.activiti"/>
+
+        <allow pkg=".*" regex="true"/>
+
+        <file name=".*Jackson2.*" regex="true">
+            <allow pkg="com.fasterxml.jackson.databind"/>
+            <allow pkg="com.fasterxml.jackson.core"/>
+        </file>
+
+        <subpackage name="common.engine.impl.json.jackson2">
+            <allow pkg="com.fasterxml.jackson.databind"/>
+            <allow pkg="com.fasterxml.jackson.core"/>
+        </subpackage>
+
+        <subpackage name="compatibility">
+            <allow pkg="org.activiti" />
+        </subpackage>
+    </subpackage>
+
+    <subpackage name="activiti">
+
+        <allow pkg="com.fasterxml.jackson.annotation"/>
+        <allow pkg="com.fasterxml.uuid"/>
+        <disallow pkg="com.fasterxml"/>
+
+        <allow pkg=".*" regex="true"/>
+
+    </subpackage>
+
+</import-control>

distro/src/readme.html

@@ -40,6 +40,53 @@ <h3>Release Notes - Flowable - 8.0.0</h3>
         Date properties e.g., Process Instance start time will be returned as an ISO 8601 in the UTC timezone.
         E.g., if the start time was returned as <code>2025-09-24T09:58:12.609+02:00</code> now it is returned as <code>2025-09-24T07:58:12.609Z</code>.
     </li>
+    <li>
+        Jackson 3 is used for Flowable internal json manipulation.
+        There is still support for Jackson 2 variables.
+        With Spring Boot this can be enabled by setting <code>flowable.variable-json-mapper</code> to <code>jackson2</code>.
+        By default, Jackson 3 is being used for variables.
+        When configuring Flowable without Spring Boot then the <code>variableJsonMapper</code> on the process, cmmn and app engine configurations
+        should be set to be <code>org.flowable.common.engine.impl.json.jackson2.Jackson2VariableJsonMapper</code>
+        and the <code>org.flowable.common.rest.variable.Jackson2JsonObjectRestVariableConverter</code> should be added to the appropriate rest response factories.
+    </li>
+    <li>
+        Notable changes when using JSON in expressions / scripts:
+        <ul>
+            <li>Packages have changed from <code>com.fasterxml.jackson.databind</code> and <code>com.fasterxml.jackson.core</code> to <code>tools.jackson.databind</code> and <code>tools.jackson.core</code> </li>
+            <li><code>elements()</code> no longer returns <code>Iterator&lt;JsonNode&gt;</code> and instead returns <code>Collection&lt;JsonNode&gt;</code></li>
+            <li><code>values()</code> no longer returns <code>Iterator&lt;JsonNode&gt;</code> and instead returns <code>Collection&lt;JsonNode&gt;</code></li>
+            <li><code>Iterator&lt;String&gt; fieldNames()</code> replaced by <code>Collection&lt;String&gt; propertyNames()</code></li>
+            <li><code>Iterator&lt;Map.Entry&lt;String, JsonNode&gt;&gt; fields()</code> replaced by <code>Set&lt;Map.Entry&lt;String, JsonNode&gt;&gt; properties()</code></li>
+            <li><code>JsonNode with(String)</code> replaced by <code>ObjectNode withObject(String)</code>, and if not using a pointer then it is better to use <code>ObjectNode withProperty(String)</code></li>
+            <li><code>TextNode textNode(String)</code> replaced by <code>StringNode stringNode(String)</code></li>
+            <li><code>List&lt;String&gt; findValuesAsText(String)</code> replaced by <code>List&lt;String&gt; findValuesAsString(String)</code></li>
+            <li><code>List&lt;String&gt; findValuesAsText(String, List&lt;String&gt;)</code> replaced by <code>List&lt;String&gt; findValuesAsString(String, List&lt;String&gt;)</code></li>
+            <li><code>boolean isContainerNode()</code> replaced by <code>boolean isContainer()</code></li>
+            <li><code>boolean isEmpty(SerializerProvider)</code> replaced by <code>boolean isEmpty(SerializationContext)</code></li>
+            <li><code>JsonNode put(String, JsonNode)</code> replaced by <code>JsonNode replace(String, JsonNode)</code></li>
+            <li><code>JsonNode putAll(Map&lt;String, ? extends JsonNode&gt;)</code> replaced by <code>JsonNode setAll(Map&lt;String, ? extends JsonNode&gt;)</code></li>
+            <li><code>JsonNode putAll(ObjectNode)</code> replaced by <code>JsonNode setAll(ObjectNode)></code></li>
+            <li><code>JsonParser traverse()</code> removed without replacement</li>
+            <li><code>JsonParser traverse(ObjectCodec)</code> replaced by <code>JsonParser traverse(ObjectReadContext)</code></li>
+            <li><code>void serialize(JsonGenerator, SerializerProvider)</code> replaced by <code>void serialize(JsonGenerator, SerializationContext)</code></li>
+            <li><code>void serializeWithType(JsonGenerator, SerializerProvider, TypeSerializer)</code> replaced by <code>void serializeWithType(JsonGenerator, SerializationContext, TypeSerializer)</code></li>
+        </ul>
+        Methods deprecated in Jackson 3:
+        <ul>
+            <li><code>String asText()</code> replaced by <code>String asString()</code></li>
+            <li><code>String asText(String)</code> replaced by <code>String asString(String)</code></li>
+            <li><code>boolean isTextual()</code> replaced by <code>boolean isString()</code></li>
+            <li><code>String textValue()</code> replaced by <code>String stringValue()</code></li>
+        </ul>
+        There is also a behaviour change in the different <code>xxxValue</code> and <code>asXXX</code> methods.
+        In Jackson 3 those methods would fail if the node is not of the appropriate type and / or if it cannot coerce the value to the requested type.
+        e.g.
+        <ul>
+            <li>When using <code>stringValue</code> on a non <code>StringNode</code> or <code>NullNode</code> it would fail, in Jackson 2 it would return <code>null</code>.</li>
+            <li>When using <code>asString</code> on a <code>ObjectNode</code> or <code>ArrayNode</code> it would fail, in Jackson 2 it would return an empty string.</li>
+        </ul>
+
+    </li>
 </ul>
 <h3>Release Notes - Flowable - 7.2.0</h3>
 

modules/flowable-app-engine-rest/src/main/java/org/flowable/app/rest/service/api/repository/AppDeploymentResponse.java

@@ -17,7 +17,7 @@
 import org.flowable.app.api.repository.AppDeployment;
 import org.flowable.common.rest.util.DateToStringSerializer;
 
-import com.fasterxml.jackson.databind.annotation.JsonSerialize;
+import tools.jackson.databind.annotation.JsonSerialize;
 
 import io.swagger.annotations.ApiModelProperty;
 

modules/flowable-app-engine-rest/src/test/java/org/flowable/app/rest/DispatcherServletConfiguration.java

@@ -17,19 +17,19 @@
 import org.springframework.context.annotation.ComponentScan;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.http.converter.HttpMessageConverters;
-import org.springframework.http.converter.json.MappingJackson2HttpMessageConverter;
+import org.springframework.http.converter.json.JacksonJsonHttpMessageConverter;
 import org.springframework.web.multipart.MultipartResolver;
 import org.springframework.web.multipart.support.StandardServletMultipartResolver;
 import org.springframework.web.servlet.config.annotation.WebMvcConfigurationSupport;
 
-import com.fasterxml.jackson.databind.ObjectMapper;
+import tools.jackson.databind.json.JsonMapper;
 
 @Configuration(proxyBeanMethods = false)
 @ComponentScan({ "org.flowable.app.rest.service.api" })
 public class DispatcherServletConfiguration extends WebMvcConfigurationSupport {
 
     @Autowired
-    private ObjectMapper objectMapper;
+    private JsonMapper objectMapper;
 
     @Bean
     public MultipartResolver multipartResolver() {
@@ -38,7 +38,7 @@ public MultipartResolver multipartResolver() {
 
     @Override
     protected void configureMessageConverters(HttpMessageConverters.ServerBuilder builder) {
-        builder.withJsonConverter(new MappingJackson2HttpMessageConverter(objectMapper));
+        builder.withJsonConverter(new JacksonJsonHttpMessageConverter(objectMapper));
     }
 
 }

modules/flowable-app-engine-rest/src/test/java/org/flowable/app/rest/conf/common/JacksonConfiguration.java

@@ -15,7 +15,7 @@
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 
-import com.fasterxml.jackson.databind.ObjectMapper;
+import tools.jackson.databind.json.JsonMapper;
 
 /**
  * @author Joram Barrez
@@ -24,10 +24,9 @@
 public class JacksonConfiguration {
 
     @Bean()
-    public ObjectMapper objectMapper() {
+    public JsonMapper objectMapper() {
         // To avoid instantiating and configuring the mapper everywhere
-        ObjectMapper mapper = new ObjectMapper();
-        return mapper;
+        return JsonMapper.shared();
     }
 
 }

modules/flowable-app-engine-rest/src/test/java/org/flowable/app/rest/service/BaseSpringRestTestCase.java

@@ -60,10 +60,9 @@
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.test.context.junit.jupiter.web.SpringJUnitWebConfig;
 
-import com.fasterxml.jackson.core.JsonProcessingException;
-import com.fasterxml.jackson.databind.JsonNode;
-import com.fasterxml.jackson.databind.ObjectMapper;
-import com.fasterxml.jackson.databind.node.ObjectNode;
+import tools.jackson.databind.JsonNode;
+import tools.jackson.databind.ObjectMapper;
+import tools.jackson.databind.node.ObjectNode;
 
 @SpringJUnitWebConfig(ApplicationConfiguration.class)
 @ExtendWith(InternalFlowableAppSpringExtension.class)
@@ -186,7 +185,7 @@ protected String encode(String string) {
     /**
      * Checks if the returned "data" array (child-node of root-json node returned by invoking a GET on the given url) contains entries with the given ID's.
      */
-    protected void assertResultsPresentInDataResponse(String url, String... expectedResourceIds) throws JsonProcessingException, IOException {
+    protected void assertResultsPresentInDataResponse(String url, String... expectedResourceIds) throws IOException {
         int numberOfResultsExpected = expectedResourceIds.length;
 
         // Do the actual call
@@ -207,7 +206,7 @@ protected void assertResultsPresentInDataResponse(String url, String... expected
         assertThat(toBeFound).as("Not all expected ids have been found in result, missing: " + StringUtils.join(toBeFound, ", ")).isEmpty();
     }
 
-    protected void assertEmptyResultsPresentInDataResponse(String url) throws JsonProcessingException, IOException {
+    protected void assertEmptyResultsPresentInDataResponse(String url) throws IOException {
         // Do the actual call
         CloseableHttpResponse response = executeRequest(new HttpGet(SERVER_URL_PREFIX + url), HttpStatus.SC_OK);
 
@@ -220,11 +219,11 @@ protected void assertEmptyResultsPresentInDataResponse(String url) throws JsonPr
     /**
      * Checks if the returned "data" array (child-node of root-json node returned by invoking a POST on the given url) contains entries with the given ID's.
      */
-    protected void assertResultsPresentInPostDataResponse(String url, ObjectNode body, String... expectedResourceIds) throws JsonProcessingException, IOException {
+    protected void assertResultsPresentInPostDataResponse(String url, ObjectNode body, String... expectedResourceIds) throws IOException {
         assertResultsPresentInPostDataResponseWithStatusCheck(url, body, HttpStatus.SC_OK, expectedResourceIds);
     }
 
-    protected void assertResultsPresentInPostDataResponseWithStatusCheck(String url, ObjectNode body, int expectedStatusCode, String... expectedResourceIds) throws JsonProcessingException, IOException {
+    protected void assertResultsPresentInPostDataResponseWithStatusCheck(String url, ObjectNode body, int expectedStatusCode, String... expectedResourceIds) throws IOException {
         int numberOfResultsExpected = 0;
         if (expectedResourceIds != null) {
             numberOfResultsExpected = expectedResourceIds.length;

modules/flowable-app-engine-rest/src/test/java/org/flowable/app/rest/service/api/repository/AppDefinitionResourceTest.java

@@ -29,8 +29,8 @@
 import org.flowable.app.rest.service.BaseSpringRestTestCase;
 import org.junit.jupiter.api.Test;
 
-import com.fasterxml.jackson.databind.JsonNode;
-import com.fasterxml.jackson.databind.node.ObjectNode;
+import tools.jackson.databind.JsonNode;
+import tools.jackson.databind.node.ObjectNode;
 
 import net.javacrumbs.jsonunit.core.Option;
 

modules/flowable-app-engine-rest/src/test/java/org/flowable/app/rest/service/api/repository/DeploymentCollectionResourceTest.java

@@ -25,7 +25,7 @@
 import org.flowable.app.rest.service.BaseSpringRestTestCase;
 import org.junit.jupiter.api.Test;
 
-import com.fasterxml.jackson.databind.JsonNode;
+import tools.jackson.databind.JsonNode;
 
 import net.javacrumbs.jsonunit.core.Option;
 

modules/flowable-app-engine-rest/src/test/java/org/flowable/app/rest/service/api/repository/DeploymentResourceResourceTest.java

@@ -30,7 +30,7 @@
 import org.flowable.app.rest.service.BaseSpringRestTestCase;
 import org.junit.jupiter.api.Test;
 
-import com.fasterxml.jackson.databind.JsonNode;
+import tools.jackson.databind.JsonNode;
 
 import net.javacrumbs.jsonunit.core.Option;
 

modules/flowable-app-engine-rest/src/test/java/org/flowable/app/rest/service/api/repository/DeploymentResourceTest.java

@@ -29,7 +29,7 @@
 import org.flowable.common.engine.impl.util.ReflectUtil;
 import org.junit.jupiter.api.Test;
 
-import com.fasterxml.jackson.databind.JsonNode;
+import tools.jackson.databind.JsonNode;
 
 import net.javacrumbs.jsonunit.core.Option;
 

modules/flowable-app-engine-rest/src/test/java/org/flowable/app/rest/service/api/repository/DeploymentResourcesResourceTest.java

@@ -26,7 +26,7 @@
 import org.flowable.app.rest.service.BaseSpringRestTestCase;
 import org.junit.jupiter.api.Test;
 
-import com.fasterxml.jackson.databind.JsonNode;
+import tools.jackson.databind.JsonNode;
 
 import net.javacrumbs.jsonunit.core.Option;
 

modules/flowable-app-engine-spring/src/test/java/org/flowable/app/spring/test/autodeployment/SpringAutoDeployTest.java

@@ -48,9 +48,10 @@
 import org.springframework.jdbc.datasource.DataSourceTransactionManager;
 import org.springframework.transaction.PlatformTransactionManager;
 
-import com.fasterxml.jackson.core.JsonParseException;
 import com.zaxxer.hikari.HikariDataSource;
 
+import tools.jackson.core.JacksonException;
+
 /**
  * @author Tijs Rademakers
  * @author Joram Barrez
@@ -192,7 +193,7 @@ public void testAutoDeployWithInvalidResourcesWithDeploymentModeDefault() {
             .cause()
             .hasMessageContaining("Error reading app resource")
             .isInstanceOf(FlowableException.class)
-            .hasRootCauseInstanceOf(JsonParseException.class);
+            .hasRootCauseInstanceOf(JacksonException.class);
         assertThat(repositoryService).isNull();
 
         // Some of the resources should have been deployed

modules/flowable-app-engine/pom.xml

@@ -140,6 +140,7 @@
             org.apache.xerces*;resolution:=optional,
             org.springframework*;resolution:=optional,
             com.fasterxml*;resolution:=optional,
+            tools.jackson*;resolution:=optional,
             jakarta.transaction;resolution:=optional,
             jakarta.enterprise.concurrent;resolution:=optional,
         </flowable.osgi.import.additional>