Migrate to Jackson 3.

This commit migrates the SCIM SDK from Jackson 2 APIs to Jackson 3.1.3.
The Jackson 3 release made many backwards-incompatible API changes, so
it is no longer feasible to support Jackson 2 further. For this reason,
the versions have been updated to 6.0.0-SNAPSHOT.

This commit includes other related changes. Some are meant for better
alignment with Jackson 3 defaults, and others take advantage of the
major version bump. More information is available in the CHANGELOG, but
these include:
* Updated the default values of the IGNORE_UNKNOWN_FIELDS and
  USE_GMT_CALENDARS properties.
* Removed the PATCH class and MapperFactory methods that were deprecated
  in 5.1.0.
* Removed "throws ScimException" declarations from methods which no
  longer throw them, allowing clients to avoid unnecessary try/catches.

Many important updates have been made to the SCIM SDK after the 5.0.0
release was shipped (e.g., bulk requests), so these updates should not
be locked behind a Jackson 3 upgrade. For this reason, this commit was
not included with the changes that shipped in 5.1.0. Instead, this
commit will be shipped as part of a focused 6.0.0 release.

Reviewer: dougbulkley
Reviewer: vyhhuang

JiraIssue: DS-51372

Author: kqarryzada

.github/ISSUE_TEMPLATE/bug_report.md

@@ -19,4 +19,4 @@ A clear and concise description of what you expected to happen.
 **Additional context**
 Add any other context about the problem here. For example:
  - Java version: [e.g., Java 25]
- - SCIM 2 SDK version: [e.g., 5.0.0, master branch]
+ - SCIM 2 SDK version: [e.g., 6.0.0, master branch]

CHANGELOG.md

@@ -2,6 +2,71 @@
 All notable changes to this project will be documented in this file.
 This project adheres to [Semantic Versioning](https://semver.org/).
 
+## 6.0.0 - 2026-May-11
+The UnboundID SCIM SDK has been updated to use version 3 of the Jackson library (this release ships
+with v3.1.3). This change aligns the SCIM SDK with HTTP libraries such as Spring Framework 7/Spring
+Boot 4, which are moving away from Jackson 2.x. Jackson 2.x can no longer be supported since Jackson
+3 contains many backwards-incompatible API changes, design changes, and updated default values. The
+most notable updates for applications that use the UnboundID SCIM SDK have been highlighted below:
+* `DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES` has been set to `false` by default in
+  Jackson 3. This marks a major shift: whenever a JSON representing a resource contains extra
+  fields, the unknown fields are now ignored instead of causing exceptions. This behavior is aligned
+  with modern API handling, and provides better resilience for applications interacting with
+  external APIs that may add new fields over time. The SCIM SDK has been updated to use this new
+  setting and will no longer throw exceptions when extra unknown fields are present in JSON objects.
+
+* Jackson exception objects are no longer checked exceptions. In Jackson 2.x, exceptions were based
+  on `java.io.IOException`, but in Jackson 3.x, they are based on `java.lang.RuntimeException`. The
+  SCIM SDK still highlights places where a `JacksonException` is thrown, but it is no longer
+  mandatory to surround these in a try/catch block. These blocks are likely still useful in cases
+  when a descriptive error message should be returned.
+
+* Jackson ObjectMappers are now read-only, and their configuration cannot be modified after they
+  have been built with `JsonMapper.Builder.build()`. To avoid managing object mappers for SCIM uses,
+  always use `JsonUtils.createJsonMapper()` instead of `new ObjectMapper()` when possible. If you
+  need to customize the SCIM SDK's object mapper, see `MapperFactory.java`. Note that the previous
+  `JsonUtils.createObjectMapper()` is equivalent to the new `createJsonMapper()` method.
+
+* Many Jackson classes have been moved or renamed. `TextNode` objects are now `StringNode`, and
+  `JsonProcessingException` objects from Jackson 2.x no longer exist (these can be replaced with
+  `JacksonException`). SCIM SDK classes removed or renamed in this release are listed below.
+
+
+The default values of two configurable SCIM SDK properties have been updated in this release:
+* `BaseScimResource.IGNORE_UNKNOWN_FIELDS` is now `true` by default so that unknown JSON fields on
+  BaseScimResources are ignored instead of throwing exceptions. This change is intended to align
+  with Jackson 3's new default setting for `FAIL_ON_UNKNOWN_PROPERTIES` (referenced above).
+* `DateTimeUtils.USE_GMT_CALENDARS` is now `false` so that Calendars use the `UTC` timezone when
+  they are initialized from a JSON timestamp. This is intended to provide better default values,
+  since it is common to use UTC instead of "GMT+00:00", which complicated equals() checks in tests.
+* To restore the previous behavior of these properties (not recommended), update the value(s) of the
+  "com.unboundid.scim2.common.BaseScimResource.ignoreUnknownFields" and/or
+  "com.unboundid.scim2.common.utils.DateTimeUtils.useGMTCalendars" system properties, or add one of
+  the following lines of code to your project:
+```
+BaseScimResource.IGNORE_UNKNOWN_FIELDS = false;
+DateTimeUtils.USE_GMT_CALENDARS = true;
+```
+
+ 
+
+Removed the `com.unboundid.scim2.server.PATCH` annotation class from scim2-sdk-server, which was
+deprecated in 5.1.0. Applications should use the `jakarta.ws.rs.PATCH` annotation instead.
+
+Removed several fields in the `MapperFactory` class that were deprecated in 5.1.0. Customizations
+should be appended to the `JsonMapper.Builder` object as described by the class-level Javadoc.
+
+Renamed `JsonProcessingExceptionMapper.java` to `JacksonExceptionMapper.java` to reflect the new
+naming convention in Jackson.
+
+Removed `throws ScimException` from several methods which no longer threw them. Note that the SCIM
+SDK still defines this and its subclasses as a checked exception, so this was not changed like
+Jackson exceptions were. ScimExceptions generally indicate failure cases that should be explicitly
+handled, such as invalid client requests.
+
+DateDeserializer's implementation is now based on CalendarDeserializer. The most notable change is
+that DateDeserializer now supports UNIX timestamp values.
+
 ## v5.1.0 - 2026-May-11
 Added support for bulk operations, requests, and responses as defined by the SCIM standard. To get
 started with implementing bulk request support for client or server applications, see the

README.md

@@ -44,14 +44,19 @@ with SCIM 2.0 clients or servers:
   that thoroughly explains SCIM concepts and semantics, such as
   [service provider configuration](https://javadoc.io/doc/com.unboundid.product.scim2/scim2-parent/latest/com/unboundid/scim2/common/types/ServiceProviderConfigResource.html)
   and [bulk requests](https://javadoc.io/doc/com.unboundid.product.scim2/scim2-parent/latest/com/unboundid/scim2/common/bulk/BulkRequest.html).
+* The core `scim2-sdk-common` module only contains a dependency on Jackson, so this library won't
+  contribute to a complex dependency tree in your project.
 * As with other Java libraries, this SDK can be used in projects written in other JVM languages such
   as Kotlin and Scala.
 * Full support for interacting with Ping Identity SCIM services such as the
   [PingOne SCIM API](https://developer.pingidentity.com/pingone-api/platform/scim.html).
 
 ## Supported Versions
 As of version 4.0.0, the UnboundID SCIM SDK requires Java SE 17 or greater.
-This library also depends on the Jackson 2.x libraries for JSON serialization and deserialization.
+
+As of version 6.0.0, [Jackson 3](https://github.com/FasterXML/jackson) is leveraged for high
+performance JSON processing and for broad compatibility with other HTTP libraries. For Jackson 2
+support, use the latest release before 6.0.0.
 
 ## Structure
 This library is separated into multiple modules to target specific use cases, and consists of the
@@ -72,9 +77,9 @@ More information on each section:
 * `scim2-sdk-client`: This component helps create SCIM 2 client applications using
   [JAX-RS](https://projects.eclipse.org/projects/ee4j.rest). For more information, see the
   [wiki](https://github.com/pingidentity/scim2/wiki/JAX-RS-Client-examples).
-* `scim2-sdk-server`: This component helps create SCIM 2 services using JAX-RS. If you are not using
-  JAX-RS and are using another solution (e.g., Spring), the `scim2-sdk-common` component is
-  generally a better choice and may be used directly.
+* `scim2-sdk-server`: This component helps create SCIM 2 services using JAX-RS. If you are using a
+  different solution (e.g., [Spring](https://spring.io/projects/spring-framework)),
+  the `scim2-sdk-common` component is generally a better choice and may be used directly.
 * `scim2-ubid-extensions`: Provides model classes specific to Ping Identity based constructs and
   SCIM extensions. This component is subject to API changes and should be considered experimental.
 * `scim2-parent`: The parent module for all of the other components.
@@ -203,7 +208,7 @@ Note that Ping Identity does not accept third-party code contributions.
 ## License
 As of the 5.0.0 release, the UnboundID SCIM SDK is available under the terms of the following
 licenses:
-* The [Apache License, version 2.0](LICENSE.md) (recommended).
+* The [Apache License, version 2.0](LICENSE.md) (recommended)
 * The GNU General Public License version 2 ([GPLv2](resource/LICENSE-GPLv2.txt))
 * The GNU Lesser General Public License version 2.1 ([LGPLv2.1](resource/LICENSE-LGPLv2.1.txt))
 * The legacy [UnboundID Free Use License](resource/LICENSE-UnboundID-SCIM2.txt)

pom.xml

@@ -84,7 +84,7 @@
     <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
     <compileSource>17</compileSource>
     <main.basedir>${project.basedir}</main.basedir>
-    <jackson.version>2.21.3</jackson.version>
+    <jackson.version>3.1.3</jackson.version>
     <jackson-annotations.version>2.21</jackson-annotations.version>
     <jakarta-rs.version>4.0.0</jakarta-rs.version>
     <jersey.version>4.0.2</jersey.version>
@@ -380,7 +380,7 @@
         <version>${project.version}</version>
       </dependency>
       <dependency>
-        <groupId>com.fasterxml.jackson.core</groupId>
+        <groupId>tools.jackson.core</groupId>
         <artifactId>jackson-core</artifactId>
         <version>${jackson.version}</version>
       </dependency>
@@ -390,17 +390,17 @@
         <version>${jackson-annotations.version}</version>
       </dependency>
       <dependency>
-        <groupId>com.fasterxml.jackson.core</groupId>
+        <groupId>tools.jackson.core</groupId>
         <artifactId>jackson-databind</artifactId>
         <version>${jackson.version}</version>
       </dependency>
       <dependency>
-        <groupId>com.fasterxml.jackson.jakarta.rs</groupId>
+        <groupId>tools.jackson.jakarta.rs</groupId>
         <artifactId>jackson-jakarta-rs-base</artifactId>
         <version>${jackson.version}</version>
       </dependency>
       <dependency>
-        <groupId>com.fasterxml.jackson.jakarta.rs</groupId>
+        <groupId>tools.jackson.jakarta.rs</groupId>
         <artifactId>jackson-jakarta-rs-json-provider</artifactId>
         <version>${jackson.version}</version>
       </dependency>

scim2-sdk-client/pom.xml

@@ -197,15 +197,15 @@
       <artifactId>scim2-sdk-common</artifactId>
     </dependency>
     <dependency>
-      <groupId>com.fasterxml.jackson.core</groupId>
+      <groupId>tools.jackson.core</groupId>
       <artifactId>jackson-core</artifactId>
     </dependency>
     <dependency>
-      <groupId>com.fasterxml.jackson.core</groupId>
+      <groupId>tools.jackson.core</groupId>
       <artifactId>jackson-databind</artifactId>
     </dependency>
     <dependency>
-      <groupId>com.fasterxml.jackson.jakarta.rs</groupId>
+      <groupId>tools.jackson.jakarta.rs</groupId>
       <artifactId>jackson-jakarta-rs-json-provider</artifactId>
     </dependency>
     <dependency>

scim2-sdk-client/src/main/java/com/unboundid/scim2/client/ScimService.java

@@ -32,7 +32,6 @@
 
 package com.unboundid.scim2.client;
 
-import com.fasterxml.jackson.jakarta.rs.json.JacksonJsonProvider;
 import com.unboundid.scim2.client.requests.BulkRequestBuilder;
 import com.unboundid.scim2.client.requests.CreateRequestBuilder;
 import com.unboundid.scim2.client.requests.DeleteRequestBuilder;
@@ -52,6 +51,7 @@
 import com.unboundid.scim2.common.types.SchemaResource;
 import com.unboundid.scim2.common.types.ServiceProviderConfigResource;
 import com.unboundid.scim2.common.utils.JsonUtils;
+import tools.jackson.jakarta.rs.json.JacksonJsonProvider;
 
 import jakarta.ws.rs.client.WebTarget;
 import jakarta.ws.rs.core.MediaType;
@@ -99,9 +99,8 @@ public class ScimService implements ScimInterface
    */
   public ScimService(@NotNull final WebTarget baseTarget)
   {
-    this.baseTarget = baseTarget.register(
-        new JacksonJsonProvider(JsonUtils.createObjectMapper(),
-            JacksonJsonProvider.BASIC_ANNOTATIONS));
+    var mapper = JsonUtils.createJsonMapper();
+    this.baseTarget = baseTarget.register(new JacksonJsonProvider(mapper));
   }
 
   /**
@@ -535,12 +534,10 @@ public <T extends ScimResource> ModifyRequestBuilder.Generic<T> modifyRequest(
    * @param id       The resource identifier.
    * @return The request builder that may be used to specify additional request
    * parameters and to invoke the request.
-   * @throws ScimException if an error occurs.
    */
   @NotNull
   public DeleteRequestBuilder deleteRequest(@NotNull final String endpoint,
                                             @NotNull final String id)
-      throws ScimException
   {
     return new DeleteRequestBuilder(baseTarget.path(endpoint).path(id));
   }
@@ -551,11 +548,9 @@ public DeleteRequestBuilder deleteRequest(@NotNull final String endpoint,
    * @param url The URL of the resource to delete.
    * @return The request builder that may be used to specify additional request
    * parameters and to invoke the request.
-   * @throws ScimException if an error occurs.
    */
   @NotNull
   public DeleteRequestBuilder deleteRequest(@NotNull final URI url)
-      throws ScimException
   {
     return new DeleteRequestBuilder(resolveWebTarget(url));
   }
@@ -567,12 +562,10 @@ public DeleteRequestBuilder deleteRequest(@NotNull final URI url)
    * @param <T> The Java type of the resource.
    * @return The request builder that may be used to specify additional request
    * parameters and to invoke the request.
-   * @throws ScimException if an error occurs.
    */
   @NotNull
   public <T extends ScimResource> DeleteRequestBuilder deleteRequest(
       @NotNull final T resource)
-          throws ScimException
   {
     return deleteRequest(checkAndGetLocation(resource));
   }

scim2-sdk-client/src/main/java/com/unboundid/scim2/client/SearchResultHandler.java

@@ -32,9 +32,9 @@
 
 package com.unboundid.scim2.client;
 
-import com.fasterxml.jackson.databind.node.ObjectNode;
 import com.unboundid.scim2.common.annotations.NotNull;
 import com.unboundid.scim2.common.annotations.Nullable;
+import tools.jackson.databind.node.ObjectNode;
 
 /**
  * An interface for handling the search result response. Methods will be called

scim2-sdk-client/src/main/java/com/unboundid/scim2/client/requests/BulkRequestBuilder.java

@@ -43,7 +43,6 @@
 import jakarta.ws.rs.client.Entity;
 import jakarta.ws.rs.client.WebTarget;
 import jakarta.ws.rs.core.Response;
-
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.List;

scim2-sdk-client/src/main/java/com/unboundid/scim2/client/requests/ListResponseBuilder.java

@@ -32,11 +32,11 @@
 
 package com.unboundid.scim2.client.requests;
 
-import com.fasterxml.jackson.databind.node.ObjectNode;
 import com.unboundid.scim2.client.SearchResultHandler;
 import com.unboundid.scim2.common.annotations.NotNull;
 import com.unboundid.scim2.common.annotations.Nullable;
 import com.unboundid.scim2.common.messages.ListResponse;
+import tools.jackson.databind.node.ObjectNode;
 
 import java.util.LinkedList;
 import java.util.List;

scim2-sdk-client/src/main/java/com/unboundid/scim2/client/requests/ModifyRequestBuilder.java

@@ -32,7 +32,6 @@
 
 package com.unboundid.scim2.client.requests;
 
-import com.fasterxml.jackson.databind.JsonNode;
 import com.unboundid.scim2.common.Path;
 import com.unboundid.scim2.common.ScimResource;
 import com.unboundid.scim2.common.annotations.NotNull;
@@ -41,6 +40,7 @@
 import com.unboundid.scim2.common.messages.PatchOperation;
 import com.unboundid.scim2.common.messages.PatchRequest;
 import com.unboundid.scim2.common.utils.JsonUtils;
+import tools.jackson.databind.JsonNode;
 
 import jakarta.ws.rs.HttpMethod;
 import jakarta.ws.rs.ProcessingException;
@@ -49,7 +49,6 @@
 import jakarta.ws.rs.client.WebTarget;
 import jakarta.ws.rs.core.HttpHeaders;
 import jakarta.ws.rs.core.Response;
-
 import java.util.Collection;
 import java.util.LinkedList;
 import java.util.List;
@@ -433,11 +432,11 @@ public T removeValues(@NotNull final String path)
    * @param path The path to the attribute whose value to remove.
    *
    * @return This patch operation request.
-   * @throws ScimException If the path is invalid.
+   * @throws IllegalArgumentException If the path is invalid.
    */
   @NotNull
   public T removeValues(@NotNull final Path path)
-      throws ScimException
+      throws IllegalArgumentException
   {
     return addOperation(PatchOperation.remove(path));
   }