JSON Duplicate Key Behavior in Jackson 2.17 Across Parsing Modes

Answer

Jackson 2.17 does not change the default duplicate‑key behavior. Applications that rely on the legacy "last‑wins" semantics continue to work without modification unless the new strict validation feature is explicitly enabled.

Confirmed facts

• The default value of DeserializationFeature.FAIL_ON_READING_DUP_TREE_KEY (also exposed as FAIL_ON_DUPLICATE_PROPERTIES) is false.
• With the feature disabled, parsing JSON such as {"a":1,"a":2} yields the value 2 for key "a" in POJOs, maps, and tree models.
• Enabling the feature causes a JsonParseException to be thrown on the first duplicate key encountered, affecting POJO binding, tree model (ObjectMapper.readTree), and any dataformat module that delegates to the core ObjectMapper (JSON, CBOR, Smile, XML, etc.).
• The low‑level streaming API (JsonParser) does not perform duplicate‑key detection regardless of the feature setting; it only reports tokens as they appear.

Steps to verify the behavior

1. Create an ObjectMapper with default settings.
2. Parse the string {"a":1,"a":2} into a Map (or a POJO) and assert that the map contains {a=2}.
3. Enable the strict feature: mapper.enable(DeserializationFeature.FAIL_ON_READING_DUP_TREE_KEY).
4. Repeat the parse and catch JsonParseException; the exception message will indicate a duplicate key.
5. Repeat step 2 using mapper.readTree and a CBOR factory to confirm the same exception occurs when the feature is on.
6. Optionally, iterate with JsonParser directly and verify that no exception is thrown irrespective of the feature.

Assumptions and uncertainty

The findings assume you are using Jackson core 2.17.x and that any third‑party modules you rely on delegate to the core ObjectMapper for deserialization. Some modules may not propagate the core deserialization features; if you observe unexpected behavior, consult the specific module’s documentation or test with that module in isolation.

Recommendation

Leave the duplicate‑key feature at its default (false) to preserve backward compatibility. Only enable it if you want to fail fast on malformed JSON containing duplicate keys.