Fix #6201: honor @JacksonInject(useInput=FALSE) on Field/Setter

[aysha-afrah26]

@JacksonInject documents useInput = OptBoolean.FALSE as meaning the value from input is ignored and the injected value always wins, and CreatorProperty.isInjectionOnly() together with the [databind#1381] checks in the property-based-Creator loops makes that true for Creator properties. A property backed by a Field or a Setter gets no such treatment: getInjectionDefinition() returns null for it, so it stays in the settable set and binds like any other property, while injectValues() runs right after the bean is constructed and before the first property is read. The injected value is written first and then overwritten by whatever the document carries under the same name, which turns a pinned server-side value such as a tenant id or a principal into something the request body can set. I noticed it comparing the Creator and Field forms of the same class while reading JacksonInject1381Test, whose fixtures all reach the value through a Creator, so the Field and Setter path has no coverage there. Dropping such a property from the settable set at deserializer-construction time keeps every binding path out of it at once, including shape=ARRAY, @JsonPOJOBuilder, @JsonUnwrapped and readerForUpdating(), while ValueInjector still supplies the value. Only the explicit OptBoolean.FALSE setting changes; DEFAULT and TRUE bind from input exactly as before, and Creator properties are left to the existing hasConstructorParameter() guard. Registering the name as ignorable rather than just removing it keeps FAIL_ON_UNKNOWN_PROPERTIES quiet and keeps the value out of an @JsonAnySetter, so the property ends up behaving like a READ_ONLY one, which also means it is skipped positionally under shape=ARRAY.

Reported separately as #6201. Targeted at 3.x since it changes which properties are bindable, but happy to retarget to 3.1 if you would rather have it on the LTS line.

[github-actions]

🧪 Code Coverage Report

Metric	Coverage	Change
Instructions	82.31%	📈 +0.010%
Branches	75.87%	📈 +0.000%

Coverage data generated from JaCoCo test results

[cowtowncoder]

Sounds like 3.x is the right target wrt behavior change.

[github-actions]

🧪 Code Coverage Report

Metric	Coverage	Change
Instructions	82.35%	📈 +0.010%
Branches	75.95%	📈 +0.020%

Coverage data generated from JaCoCo test results

[gitar-bot]

Code Review ✅ Approved

🔴 High risk · Field/setter injection-only properties now ignore JSON values, affecting stored-data integrity.

Fixes @JacksonInject(useInput=FALSE) to honor the injected value for Field and Setter properties by dropping them from the settable set at deserializer construction time, matching the existing behavior for Creator properties. This ensures pinned server-side values cannot be overwritten by the request body across all binding paths including shape=ARRAY, @JsonPOJOBuilder, and readerForUpdating(). No issues found.

Review coverage

📋 Rules No rules evaluated

🧪 Functional validation Not enabled · Set up

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Counting what did not apply, without listing it.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Powered by Gitar — free for open source}

[github-actions]

🧪 Code Coverage Report

Metric	Coverage	Change
Instructions	82.35%	📈 +0.020%
Branches	76.00%	📈 +0.030%

Coverage data generated from JaCoCo test results

[aysha-afrah26]

Sounds good, leaving it on 3.x. Rebuilt after your latest merge of 3.x into the branch and the inject tests are still green, so nothing else pending from my side.