Upgrade core SDK → Jackson 3

[javier-aliaga]

Describe the proposal

Change Proposal: Migrate core Java SDK from Jackson 2 → Jackson 3

Summary

Move dapr-sdk (and sdk-actors, sdk-springboot, durabletask-client) off Jackson 2 (com.fasterxml.jackson) onto Jackson 3 (tools.jackson), so the whole SDK uses a single Jackson line. Separate PR from the Spring Boot 4 migration — not a prerequisite for it.

Motivation

• SB4 / Spring AI 2.0 already use Jackson 3; core SDK still uses Jackson 2. Both currently coexist on the classpath (works, but two Jackson lines).
• Long-term: single dependency, lighter classpath, aligned with the rest of the ecosystem.

Not urgent

Jackson 2 (2.21.2) is still BOM-managed by Spring Boot 4 and actively maintained upstream. Nothing forces this now. It's cleanup, not a fix.

Scope (what changes)

• Annotations (47 uses): no change. Jackson 3 keeps @JsonProperty etc. in com.fasterxml.jackson.annotation. This is the majority of usage — it rides along free.
• ObjectMapper construction (~13 sites): new ObjectMapper().configure(...) → JsonMapper.builder()…build() (mapper is now immutable). Sites: ObjectSerializer, AbstractDaprClient, DaprHttp, CloudEvent, Filter (sdk); DaprClientImpl, DaprStateAsyncProvider (sdk-actors); DaprBeanPostProcessor (sdk-springboot); JacksonDataConverter (durabletask).
• 2 custom (de)serializers: CloudEvent, StateOptions — extend JsonSerializer/JsonDeserializer, which move to tools.jackson.databind.
• Exceptions: Jackson 3 read/write exceptions are now unchecked → drop throws IOException/JsonProcessingException where they were Jackson-only.

Breaking changes (public API — small but real)

1. CustomizableObjectSerializer(ObjectMapper) constructor + getObjectMapper() — parameter/return type changes package (com.fasterxml… → tools.jackson…).
2. ObjectSerializer.parseNode(byte[]) : JsonNode — JsonNode changes package.

Anyone passing a custom mapper or calling parseNode breaks at source + binary level. The main serializer SPI (DaprObjectSerializer) is Jackson-free, so most users are unaffected.

Plan

1. Bump core modules to tools.jackson (Jackson 3 BOM already on the SB4 dependency tree).
2. Rewrite the ~13 mapper sites + 2 custom serializers; clean up now-unchecked exceptions.
3. Update CustomizableObjectSerializer / parseNode signatures.
4. Document the two breaks in the changelog.

Recommendation

Land it as its own PR with a changelog note, sequenced after the SB4 cutover merges. Because it touches public signatures, treat it as a breaking change for release-versioning purposes.