The biggest problem is; jackson is not just my dependency, but a dependency of my dependencies. And those packages are not heavily managed enterprise things....

The biggest problem is; jackson is not just my dependency, but a dependency of my dependencies. And those packages are not heavily managed enterprise things.... So it's an intense cycle. A great step might be for libraries to note when their implementation of a package is safe.