Merge branch '2.x' into 3.1

Author: cowtowncoder

README.md

@@ -29,7 +29,7 @@ Project contains versions 2.0 and above: source code for earlier (1.x) versions
 | Artifact | ![Maven Central](https://img.shields.io/maven-central/v/tools.jackson.core/jackson-core) |
 | OSS Sponsorship | [![Tidelift](https://tidelift.com/badges/package/maven/com.fasterxml.jackson.core:jackson-core)](https://tidelift.com/subscription/pkg/maven-com-fasterxml-jackson-core-jackson-core?utm_source=maven-com-fasterxml-jackson-core-jackson-core&utm_medium=referral&utm_campaign=readme) |
 | Javadocs | [![Javadoc](https://javadoc.io/badge/tools.jackson.core/jackson-core.svg)](https://javadoc.io/doc/tools.jackson.core/jackson-core) |
-| Code coverage (3.0) | [![codecov.io](https://codecov.io/github/FasterXML/jackson-core/coverage.svg?branch=3.x)](https://codecov.io/github/FasterXML/jackson-core?branch=3.x) |
+| Code coverage (3.x) | [![codecov.io](https://codecov.io/github/FasterXML/jackson-core/coverage.svg?branch=3.x)](https://codecov.io/github/FasterXML/jackson-core?branch=3.x) |
 | OpenSSF Score | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/FasterXML/jackson-core/badge)](https://securityscorecards.dev/viewer/?uri=github.com/FasterXML/jackson-core) |
 
 # Get it!

release-notes/CREDITS-2.x

@@ -475,6 +475,14 @@ Vincent Biret (@baywet)
   `com.fasterxml.jackson.core:jackson-core` (from `FastDoubleParser`) [Android]
   (2.18.5)
 
+Prabhav Srinath (@sprabhav7)
+ * Reported #1555: Enforce StreamReadConstraints.maxNumberLength for non-blocking (async) parser
+  (2.18.6)
+
+Rohan Nagendra (@rohan-repos)
+ * Reported #1555: Enforce StreamReadConstraints.maxNumberLength for non-blocking (async) parser
+  (2.18.6)
+
 Yanming Zhou (@quaff)
  * Requested #633: Allow skipping `RS` CTRL-CHAR to support JSON Text Sequences
   (2.19.0)

release-notes/VERSION-2.x

@@ -14,6 +14,14 @@ a pure JSON library.
 === Releases ===
 ------------------------------------------------------------------------
 
+2.21.2 (not yet released)
+
+#1541: Unexpected Illegal surrogate character when parsing field names
+ (fix by @cowtowncoder, w/ Claude code)
+#1570: Fail parsing from `DataInput` if
+  `StreamReadConstraints.getMaxDocumentLength()` set [GHSA-2m67-wjpj-xhg9]
+ (fix by @cowtowncoder, w/ Claude code)
+
 2.21.1 (22-Feb-2026)
 
 #1548: `StreamReadConstraints.maxDocumentLength` not checked when
@@ -62,6 +70,17 @@ No changes since 2.20.1
 #1462: Deprecate `URL`-taking factory method of `JsonFactory`
 - Generate SBOMs [JSTEP-14]
 
+2.19.5 (not yet released)
+
+#1512: Number-parsing fix for `UTF8DataInputJsonParser`
+ (reported by @ventusfortis)
+#1548: `StreamReadConstraints.maxDocumentLength` not checked when
+  creating parser with fixed buffer
+#1555: Enforce `StreamReadConstraints.maxNumberLength` for
+  non-blocking (async) parser
+ (reported by Prabhav S, Rohan N)
+ (fix by @pjfanning)
+
 2.19.4 (29-Oct-2025)
 2.19.3 (29-Oct-2025)
 2.19.2 (18-Jul-2025)
@@ -105,6 +124,12 @@ No changes since 2.19.1
  (requested by Ilenia S)
  (fixed by @pjfanning)
 
+2.18.7 (not yet released)
+
+#1570: Fail parsing from `DataInput` if
+  `StreamReadConstraints.getMaxDocumentLength()` set [GHSA-2m67-wjpj-xhg9]
+ (fix by @cowtowncoder, w/ Claude code)
+
 2.18.6 (22-Feb-2026)
 
 #1512: Number-parsing fix for `UTF8DataInputJsonParser`
@@ -113,6 +138,7 @@ No changes since 2.19.1
   creating parser with fixed buffer
 #1555: Enforce `StreamReadConstraints.maxNumberLength` for
   non-blocking (async) parser
+ (reported by Prabhav S, Rohan N)
  (fix by @pjfanning)
 
 2.18.5 (27-Oct-2025)