Merge branch '2.19' into 2.20

Author: cowtowncoder

release-notes/CREDITS-2.x

@@ -1915,6 +1915,8 @@ Fawzi Essam (@iifawzi)
 Omkhar Arasaratnam (@omkhar)
  * Reported #5950: Improve `UUIDeserializer` error handling
   (2.18.8)
+ * Reported #5951: Improve `InetSocketAddress` deserialization
+  (2.18.8)
 
 Liam Feid (@fxshlein)
  * Contributed #1467: Support `@JsonUnwrapped` with `@JsonCreator`

release-notes/VERSION-2.x

@@ -187,6 +187,8 @@ No changes since 2.19.2
 
 #5950: Improve `UUIDeserializer` error handling
  (reported by Omkhar A)
+#5951: Improve `InetSocketAddress` deserialization
+ (reported by Omkhar A)
 
 2.18.7 (24-Apr-2026)
 2.18.6 (22-Feb-2026)

src/main/java/com/fasterxml/jackson/databind/deser/std/FromStringDeserializer.java

@@ -492,7 +492,8 @@ private Locale _deSerializeBCP47Locale(String value, int ix, String first, Strin
         }
 
         protected InetSocketAddress _inetSocketAddress(String host, int port) {
-            return new InetSocketAddress(host, port);
+            // 05-May-2026, tatu: [databind#5951] Prevent DNS lookup:
+            return InetSocketAddress.createUnresolved(host, port);
         }
     }
 

src/test/java/com/fasterxml/jackson/databind/deser/jdk/JDKStringLikeTypeDeserTest.java

@@ -183,15 +183,15 @@ public void testInetAddress() throws IOException
     public void testInetSocketAddress() throws IOException
     {
         InetSocketAddress address = MAPPER.readValue(q("127.0.0.1"), InetSocketAddress.class);
-        assertEquals("127.0.0.1", address.getAddress().getHostAddress());
+        assertEquals("127.0.0.1", address.getHostName());
 
         InetSocketAddress ip6 = MAPPER.readValue(
                 q("2001:db8:85a3:8d3:1319:8a2e:370:7348"), InetSocketAddress.class);
-        assertEquals("2001:db8:85a3:8d3:1319:8a2e:370:7348", ip6.getAddress().getHostAddress());
+        assertEquals("2001:db8:85a3:8d3:1319:8a2e:370:7348", ip6.getHostName());
 
         InetSocketAddress ip6port = MAPPER.readValue(
                 q("[2001:db8:85a3:8d3:1319:8a2e:370:7348]:443"), InetSocketAddress.class);
-        assertEquals("2001:db8:85a3:8d3:1319:8a2e:370:7348", ip6port.getAddress().getHostAddress());
+        assertEquals("[2001:db8:85a3:8d3:1319:8a2e:370:7348]", ip6port.getHostName());
         assertEquals(443, ip6port.getPort());
 
         // should we try resolving host names? That requires connectivity...
@@ -203,6 +203,11 @@ public void testInetSocketAddress() throws IOException
         address = MAPPER.readValue(q(HOST_AND_PORT), InetSocketAddress.class);
         assertEquals(HOST, address.getHostName());
         assertEquals(80, address.getPort());
+
+        // [databind#5951]: should NOT resolve address
+        address = MAPPER.readValue(q("localhost:9999"), InetSocketAddress.class);
+        assertTrue(address.isUnresolved(),
+                "`InetSocketAddress` resolved localhost during deserialization: "+ address);
     }
 
     @Test

src/test/java/com/fasterxml/jackson/databind/ser/jdk/JDKTypeSerializationTest.java

@@ -126,8 +126,12 @@ public void testInetSocketAddress() throws IOException
     {
         assertEquals(q("127.0.0.1:8080"),
                 MAPPER.writeValueAsString(new InetSocketAddress("127.0.0.1", 8080)));
+        assertEquals(q("127.0.0.1:8080"),
+                MAPPER.writeValueAsString(InetSocketAddress.createUnresolved("127.0.0.1", 8080)));
         assertEquals(q("google.com:6667"),
                 MAPPER.writeValueAsString(new InetSocketAddress("google.com", 6667)));
+        assertEquals(q("google.com:6667"),
+                MAPPER.writeValueAsString(InetSocketAddress.createUnresolved("google.com", 6667)));
         assertEquals(q("[2001:db8:85a3:8d3:1319:8a2e:370:7348]:443"),
                 MAPPER.writeValueAsString(new InetSocketAddress("2001:db8:85a3:8d3:1319:8a2e:370:7348", 443)));
     }