oss-review-toolkit · sschuberth · Oct 14, 2025
@@ -19,15 +19,15 @@
 
 package org.ossreviewtoolkit.analyzer
 
-import com.fasterxml.jackson.databind.annotation.JsonSerialize
-
 import java.io.File
 
 import org.ossreviewtoolkit.model.DependencyGraph
 import org.ossreviewtoolkit.model.Package
 import org.ossreviewtoolkit.model.ProjectAnalyzerResult
 import org.ossreviewtoolkit.model.utils.PackageSortedSetConverter
 
+import tools.jackson.databind.annotation.JsonSerialize
+
 /**
  * A data class representing the result of the execution of a [PackageManager]. An instance contains the single
  * results produced for the definition files the package manager supports. If there are global results (i.e. data that

@@ -19,9 +19,6 @@
 
 package org.ossreviewtoolkit.helper.commands
 
-import com.fasterxml.jackson.databind.PropertyNamingStrategies
-import com.fasterxml.jackson.module.kotlin.readValue
-
 import com.github.ajalt.clikt.parameters.options.convert
 import com.github.ajalt.clikt.parameters.options.default
 import com.github.ajalt.clikt.parameters.options.option
@@ -61,6 +58,9 @@ import org.ossreviewtoolkit.utils.ort.ORT_CONFIG_FILENAME
 import org.ossreviewtoolkit.utils.ort.ortConfigDirectory
 import org.ossreviewtoolkit.utils.spdx.SpdxExpression
 
+import tools.jackson.databind.PropertyNamingStrategies
+import tools.jackson.module.kotlin.readValue
+
 internal class CreateAnalyzerResultFromPackageListCommand : OrtHelperCommand(
     help = "A command which turns a package list file into an analyzer result."
 ) {

@@ -19,9 +19,6 @@
 
 package org.ossreviewtoolkit.helper.commands
 
-import com.fasterxml.jackson.databind.ObjectMapper
-import com.fasterxml.jackson.dataformat.yaml.YAMLGenerator
-
 import com.github.ajalt.clikt.parameters.options.convert
 import com.github.ajalt.clikt.parameters.options.option
 import com.github.ajalt.clikt.parameters.options.required
@@ -36,6 +33,9 @@ import org.ossreviewtoolkit.model.readValue
 import org.ossreviewtoolkit.model.yamlMapper
 import org.ossreviewtoolkit.utils.common.expandTilde
 
+import tools.jackson.databind.ObjectMapper
+import tools.jackson.dataformat.yaml.YAMLGenerator
+
 internal class ImportCopyrightGarbageCommand : OrtHelperCommand(
     help = "Import copyright garbage from a plain text file containing one copyright statement per line into the " +
         "given copyright garbage file."

@@ -19,8 +19,6 @@
 
 package org.ossreviewtoolkit.helper.commands.classifications
 
-import com.fasterxml.jackson.module.kotlin.readValue
-
 import com.github.ajalt.clikt.parameters.arguments.argument
 import com.github.ajalt.clikt.parameters.options.convert
 import com.github.ajalt.clikt.parameters.options.option
@@ -42,6 +40,8 @@ import org.ossreviewtoolkit.model.yamlMapper
 import org.ossreviewtoolkit.utils.common.expandTilde
 import org.ossreviewtoolkit.utils.spdx.SpdxSingleLicenseExpression
 
+import tools.jackson.module.kotlin.readValue
+
 internal class ImportCommand : OrtHelperCommand(
     help = "Import license classifications from supported providers to ORT format."
 ) {

@@ -19,8 +19,6 @@
 
 package org.ossreviewtoolkit.helper.commands.classifications
 
-import com.fasterxml.jackson.module.kotlin.readValue
-
 import com.github.ajalt.clikt.parameters.arguments.argument
 import com.github.ajalt.clikt.parameters.arguments.check
 import com.github.ajalt.clikt.parameters.arguments.convert
@@ -35,6 +33,8 @@ import org.ossreviewtoolkit.model.toYaml
 import org.ossreviewtoolkit.model.yamlMapper
 import org.ossreviewtoolkit.utils.common.expandTilde
 
+import tools.jackson.module.kotlin.readValue
+
 internal class MergeCommand : OrtHelperCommand(
     help = "Merge multiple files with license classifications into one."
 ) {

@@ -19,9 +19,6 @@
 
 package org.ossreviewtoolkit.helper.commands.dev
 
-import com.fasterxml.jackson.databind.JsonNode
-import com.fasterxml.jackson.databind.node.ObjectNode
-
 import com.github.ajalt.clikt.parameters.options.convert
 import com.github.ajalt.clikt.parameters.options.option
 import com.github.ajalt.clikt.parameters.options.required
@@ -43,6 +40,9 @@ import org.ossreviewtoolkit.model.ScanResult
 import org.ossreviewtoolkit.model.ScannerRun
 import org.ossreviewtoolkit.utils.common.expandTilde
 
+import tools.jackson.databind.JsonNode
+import tools.jackson.databind.node.ObjectNode
+
 internal class RewriteTestAssetsCommand : OrtHelperCommand(
     help = "Searches all test assets directories in the given ORT sources directory for recognized serialized files " +
         "and tries to de-serialize and serialize the file. The command can be used to update the test assets " +

@@ -21,9 +21,6 @@
 
 package org.ossreviewtoolkit.helper.utils
 
-import com.fasterxml.jackson.databind.ObjectMapper
-import com.fasterxml.jackson.dataformat.yaml.YAMLGenerator
-
 import java.io.File
 import java.nio.file.Paths
 
@@ -73,6 +70,9 @@ import org.ossreviewtoolkit.utils.ort.CopyrightStatementsProcessor
 import org.ossreviewtoolkit.utils.spdx.SpdxExpression
 import org.ossreviewtoolkit.utils.spdx.SpdxSingleLicenseExpression
 
+import tools.jackson.databind.ObjectMapper
+import tools.jackson.dataformat.yaml.YAMLGenerator
+
 /**
  * Return an approximated minimal sublist of [this] so that the result still matches the exact same entries of the given
  * [projectScopes].

@@ -21,13 +21,6 @@
 
 package org.ossreviewtoolkit.clients.fossid
 
-import com.fasterxml.jackson.databind.DeserializationFeature
-import com.fasterxml.jackson.databind.MapperFeature
-import com.fasterxml.jackson.databind.ObjectMapper
-import com.fasterxml.jackson.databind.PropertyNamingStrategies
-import com.fasterxml.jackson.module.kotlin.jsonMapper
-import com.fasterxml.jackson.module.kotlin.kotlinModule
-
 import java.util.concurrent.TimeUnit
 
 import okhttp3.Interceptor
@@ -61,6 +54,13 @@ import retrofit2.http.Header
 import retrofit2.http.Headers
 import retrofit2.http.POST
 
+import tools.jackson.databind.DeserializationFeature
+import tools.jackson.databind.MapperFeature
+import tools.jackson.databind.ObjectMapper
+import tools.jackson.databind.PropertyNamingStrategies
+import tools.jackson.module.kotlin.jsonMapper
+import tools.jackson.module.kotlin.kotlinModule
+
 private const val READ_TIMEOUT_HEADER = "READ_TIMEOUT"
 
 interface FossIdRestService {
@@ -75,7 +75,8 @@ interface FossIdRestService {
             enable(MapperFeature.ACCEPT_CASE_INSENSITIVE_ENUMS)
             configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false)
             addModule(
-                kotlinModule().addDeserializer(PolymorphicList::class.java, PolymorphicListDeserializer())
+                kotlinModule()
+                    .addDeserializer(PolymorphicList::class.java, PolymorphicListDeserializer())
                     .addDeserializer(PolymorphicInt::class.java, PolymorphicIntDeserializer())
                     .addDeserializer(PolymorphicData::class.java, PolymorphicDataDeserializer())
             )

@@ -19,9 +19,6 @@
 
 package org.ossreviewtoolkit.clients.fossid
 
-import com.fasterxml.jackson.databind.node.ObjectNode
-import com.fasterxml.jackson.databind.node.TextNode
-
 import java.nio.charset.StandardCharsets
 
 import okhttp3.Interceptor
@@ -33,6 +30,9 @@ import okio.GzipSource
 
 import org.apache.logging.log4j.kotlin.logger
 
+import tools.jackson.databind.node.ObjectNode
+import tools.jackson.databind.node.StringNode
+
 /**
  * An interceptor that logs the body of FossID requests, but takes care that the credentials are not logged.
  * This function implementation is partly taken from the OkHttp Logging Interceptor at
@@ -138,9 +138,9 @@ private fun String.sanitizeForLogging(): String {
 
         // Replace the credentials in the Git repository URL. The function [replaceCredentialsInUri]
         // from utils.common is not used to avoid a dependency in the FossID client.
-        if (urlWithCredentials != null && urlWithCredentials is TextNode) {
+        if (urlWithCredentials != null && urlWithCredentials is StringNode) {
             val url = urlWithCredentials.toString().replace("//[\\w:]+@".toRegex(), "//")
-            dataObject.set<ObjectNode>("git_repo_url", TextNode(url))
+            dataObject.set("git_repo_url", StringNode(url))
         }
     }
 

@@ -19,28 +19,27 @@
 
 package org.ossreviewtoolkit.clients.fossid
 
-import com.fasterxml.jackson.core.JsonParser
-import com.fasterxml.jackson.core.JsonToken
-import com.fasterxml.jackson.databind.BeanProperty
-import com.fasterxml.jackson.databind.DeserializationContext
-import com.fasterxml.jackson.databind.JavaType
-import com.fasterxml.jackson.databind.JsonDeserializer
-import com.fasterxml.jackson.databind.deser.ContextualDeserializer
-import com.fasterxml.jackson.databind.deser.std.StdDeserializer
+import tools.jackson.core.JsonParser
+import tools.jackson.core.JsonToken
+import tools.jackson.databind.BeanProperty
+import tools.jackson.databind.DeserializationContext
+import tools.jackson.databind.JavaType
+import tools.jackson.databind.ValueDeserializer
+import tools.jackson.databind.deser.std.StdDeserializer
 
 /**
  * A custom JSON deserializer implementation to deal with inconsistencies in error responses sent by FossID
  * for requests returning a single value. If such a request fails, the response from FossID contains an
  * empty array for the value, which cannot be handled by the default deserialization.
  */
 internal class PolymorphicDataDeserializer(val boundType: JavaType? = null) :
-    StdDeserializer<PolymorphicData<Any>>(PolymorphicData::class.java), ContextualDeserializer {
+    StdDeserializer<PolymorphicData<Any>>(PolymorphicData::class.java) {
     override fun deserialize(p: JsonParser, ctxt: DeserializationContext): PolymorphicData<Any> {
         requireNotNull(boundType) {
             "The PolymorphicDataDeserializer needs a type to deserialize values!"
         }
 
-        return when (p.currentToken) {
+        return when (p.currentToken()) {
             JsonToken.START_ARRAY -> {
                 val arrayType = ctxt.typeFactory.constructArrayType(boundType)
                 val array = ctxt.readValue<Array<Any>>(p, arrayType)
@@ -59,7 +58,7 @@ internal class PolymorphicDataDeserializer(val boundType: JavaType? = null) :
         }
     }
 
-    override fun createContextual(ctxt: DeserializationContext?, property: BeanProperty?): JsonDeserializer<*> {
+    override fun createContextual(ctxt: DeserializationContext?, property: BeanProperty?): ValueDeserializer<*> {
         val type = property?.member?.type?.bindings?.getBoundType(0)
         return PolymorphicDataDeserializer(type)
     }

@@ -19,10 +19,10 @@
 
 package org.ossreviewtoolkit.clients.fossid
 
-import com.fasterxml.jackson.core.JsonParser
-import com.fasterxml.jackson.core.JsonToken
-import com.fasterxml.jackson.databind.DeserializationContext
-import com.fasterxml.jackson.databind.deser.std.StdDeserializer
+import tools.jackson.core.JsonParser
+import tools.jackson.core.JsonToken
+import tools.jackson.databind.DeserializationContext
+import tools.jackson.databind.deser.std.StdDeserializer
 
 /**
  * A class to modify the standard Jackson deserialization to deal with inconsistencies in responses
@@ -39,7 +39,7 @@ import com.fasterxml.jackson.databind.deser.std.StdDeserializer
 internal class PolymorphicIntDeserializer :
     StdDeserializer<PolymorphicInt>(PolymorphicInt::class.java) {
     override fun deserialize(p: JsonParser, ctxt: DeserializationContext): PolymorphicInt =
-        when (p.currentToken) {
+        when (p.currentToken()) {
             JsonToken.VALUE_STRING -> {
                 val value = ctxt.readValue(p, String::class.java)
                 PolymorphicInt(value.toInt())

@@ -19,14 +19,13 @@
 
 package org.ossreviewtoolkit.clients.fossid
 
-import com.fasterxml.jackson.core.JsonParser
-import com.fasterxml.jackson.core.JsonToken
-import com.fasterxml.jackson.databind.BeanProperty
-import com.fasterxml.jackson.databind.DeserializationContext
-import com.fasterxml.jackson.databind.JavaType
-import com.fasterxml.jackson.databind.JsonDeserializer
-import com.fasterxml.jackson.databind.deser.ContextualDeserializer
-import com.fasterxml.jackson.databind.deser.std.StdDeserializer
+import tools.jackson.core.JsonParser
+import tools.jackson.core.JsonToken
+import tools.jackson.databind.BeanProperty
+import tools.jackson.databind.DeserializationContext
+import tools.jackson.databind.JavaType
+import tools.jackson.databind.ValueDeserializer
+import tools.jackson.databind.deser.std.StdDeserializer
 
 /**
  * A class to modify the standard Jackson deserialization to deal with inconsistencies in responses
@@ -38,13 +37,13 @@ import com.fasterxml.jackson.databind.deser.std.StdDeserializer
  * - to address a FossID bug in get_all_scans operation, arrays are converted to list.
  */
 internal class PolymorphicListDeserializer(val boundType: JavaType? = null) :
-    StdDeserializer<PolymorphicList<Any>>(PolymorphicList::class.java), ContextualDeserializer {
+    StdDeserializer<PolymorphicList<Any>>(PolymorphicList::class.java) {
     override fun deserialize(p: JsonParser, ctxt: DeserializationContext): PolymorphicList<Any> {
         requireNotNull(boundType) {
             "The PolymorphicListDeserializer needs a type to deserialize values!"
         }
 
-        return when (p.currentToken) {
+        return when (p.currentToken()) {
             JsonToken.VALUE_FALSE -> PolymorphicList()
 
             JsonToken.START_ARRAY -> {
@@ -71,7 +70,7 @@ internal class PolymorphicListDeserializer(val boundType: JavaType? = null) :
         }
     }
 
-    override fun createContextual(ctxt: DeserializationContext?, property: BeanProperty?): JsonDeserializer<*> {
+    override fun createContextual(ctxt: DeserializationContext?, property: BeanProperty?): ValueDeserializer<*> {
         // Extract the type from the property, i.e. the T in PolymorphicList.data<T>
         val type = property?.member?.type?.bindings?.getBoundType(0)
         return PolymorphicListDeserializer(type)

@@ -19,9 +19,9 @@
 
 package org.ossreviewtoolkit.clients.fossid.model
 
-import com.fasterxml.jackson.core.JsonParser
-import com.fasterxml.jackson.databind.DeserializationContext
-import com.fasterxml.jackson.databind.deser.std.StdDeserializer
+import tools.jackson.core.JsonParser
+import tools.jackson.databind.DeserializationContext
+import tools.jackson.databind.deser.std.StdDeserializer
 
 /**
  * This class deserializes a String containing 0/1 to boolean.

@@ -19,7 +19,7 @@
 
 package org.ossreviewtoolkit.clients.fossid.model
 
-import com.fasterxml.jackson.databind.annotation.JsonDeserialize
+import tools.jackson.databind.annotation.JsonDeserialize
 
 data class Project(
     val id: Int,

@@ -19,7 +19,7 @@
 
 package org.ossreviewtoolkit.clients.fossid.model
 
-import com.fasterxml.jackson.databind.annotation.JsonDeserialize
+import tools.jackson.databind.annotation.JsonDeserialize
 
 data class Scan(
     val id: Int,

@@ -19,10 +19,10 @@
 
 package org.ossreviewtoolkit.clients.fossid.model.identification.common
 
-import com.fasterxml.jackson.databind.annotation.JsonDeserialize
-
 import org.ossreviewtoolkit.clients.fossid.model.IntBooleanDeserializer
 
+import tools.jackson.databind.annotation.JsonDeserialize
+
 data class Component(
     val copyright: String?,
     val cpe: String?,

@@ -19,10 +19,10 @@
 
 package org.ossreviewtoolkit.clients.fossid.model.identification.identifiedFiles
 
-import com.fasterxml.jackson.databind.annotation.JsonDeserialize
-
 import org.ossreviewtoolkit.clients.fossid.model.IntBooleanDeserializer
 
+import tools.jackson.databind.annotation.JsonDeserialize
+
 data class File(
     val id: String?,
 

@@ -19,10 +19,10 @@
 
 package org.ossreviewtoolkit.clients.fossid.model.identification.markedAsIdentified
 
-import com.fasterxml.jackson.databind.annotation.JsonDeserialize
-
 import org.ossreviewtoolkit.clients.fossid.model.IntBooleanDeserializer
 
+import tools.jackson.databind.annotation.JsonDeserialize
+
 data class LicenseFile(
     val licenseIdentifier: String?,