Fix #6043: honor FAIL_ON_UNKNOWN_PROPERTIES for creator-based POJOs-as-Array

[seonwooj0810]

Fixes #6043

Root cause

For POJOs serialized as JSON Arrays (@JsonFormat(shape = ARRAY)), the creator-based deserialization path BeanAsArrayDeserializer._deserializeUsingPropertyBased loops over array elements and, once it runs past the property count, hits the prop == null branch where it simply skipChildren() and continues. Unlike the non-creator paths (deserialize/_deserializeNonVanilla), it never consults FAIL_ON_UNKNOWN_PROPERTIES. As a result, extra array elements are silently ignored for creator-based types such as records, even when the feature is enabled.

Change

Add the same FAIL_ON_UNKNOWN_PROPERTIES guard already used on the non-creator paths to the prop == null (extra-element) branch of the creator path, reporting reportWrongTokenException with the existing "Unexpected JSON values; expected at most N properties" message. Behavior is unchanged when the feature is disabled or @JsonIgnoreProperties(ignoreUnknown = true) applies.

Test evidence

Added POJOAsArrayTest.testCreatorUnknownExtraProp using the issue's reproduction (a record XYZParams(int x, int y, int z) annotated @JsonFormat(shape = ARRAY) reading [1, 2, 3, 4]). It fails before the fix (no exception thrown — "should not pass with extra element") and passes after, and also asserts the value still deserializes correctly when the feature is disabled. Full POJOAsArrayTest (27 tests) passes.

Verification done: ran ./mvnw test -Dtest=POJOAsArrayTest (27/27 pass with fix); reverted the source change and confirmed the new test fails (assertion "should not pass with extra element"), then restored.

[github-actions]

🧪 Code Coverage Report

Metric	Coverage	Change
Instructions	81.69%	📈 +0.010%
Branches	75.14%	📈 +0.020%

Coverage data generated from JaCoCo test results

[cowtowncoder]

Makes sense, thank you for submitting this, @seonwooj0810 !

Two quick things:

1. Seems like a safe enough to backport: could you change/re-create to be against 3.2 branch so it could go in 3.2.1 patch?
2. I think this is your first contribution -- if so, we'd need CLA, from https://github.com/FasterXML/jackson/blob/main/CLA-jackson-2026.pdf. It only needs to be sent once (good for all future PRs): usual way is to print, fill & sign, email to cla at fasterxml dot com.

[github-actions]

🧪 Code Coverage Report

Metric	Coverage	Change
Instructions	81.69%	📈 +0.010%
Branches	75.13%	📈 +0.000%

Coverage data generated from JaCoCo test results

[seonwooj0810]

Thanks @cowtowncoder!

1. Done — I've re-targeted this PR to the 3.2 branch. The fix is now rebased on top of 3.2 (your Add tighter check to avoid potential false failures commit is preserved on top), and POJOAsArrayTest passes locally (27/27). The PR shows a clean 2-file diff against 3.2 and reports as mergeable.
2. Yes, this is my first contribution here — I'll print, fill, sign and email the CLA to cla@fasterxml.com.

[cowtowncoder]

Excellent! Thank you.

…

On Mon, Jun 22, 2026 at 5:19 AM seonwoojung ***@***.***> wrote: *seonwooj0810* left a comment (FasterXML/jackson-databind#6047) <#6047 (comment)> Thanks @cowtowncoder <https://github.com/cowtowncoder>! 1. Done — I've re-targeted this PR to the 3.2 branch. The fix is now rebased on top of 3.2 (your Add tighter check to avoid potential false failures commit is preserved on top), and POJOAsArrayTest passes locally (27/27). The PR shows a clean 2-file diff against 3.2 and reports as mergeable. 2. Yes, this is my first contribution here — I'll print, fill, sign and email the CLA to ***@***.*** — Reply to this email directly, view it on GitHub <#6047?email_source=notifications&email_token=AAANOGL6K5TMT5KP65K4QHT5BEP3XA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTINZWHAYTSNZWGE4KM4TFMFZW63VHNVSW45DJN5XKKZLWMVXHJLDGN5XXIZLSL5RWY2LDNM#issuecomment-4768197618>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAANOGPK5TKSA7TA6GLFOPD5BEP3XAVCNFSNUABDKJSXA33TNF2G64TZHMZTAMZYHEZTOO2JONZXKZJ3GQ3TCMRUGI2TCNZTUF3AE> . Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS <https://github.com/notifications/mobile/ios/AAANOGIBPJ5XGRWRVZVRJ4T5BEP3XA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTINZWHAYTSNZWGE4KM4TFMFZW63VHNVSW45DJN5XKKZLWMVXHJKTGN5XXIZLSL5UW64Y> and Android <https://github.com/notifications/mobile/android/AAANOGMZGFGHA6TGBA7F7U35BEP3XA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTINZWHAYTSNZWGE4KM4TFMFZW63VHNVSW45DJN5XKKZLWMVXHJLTGN5XXIZLSL5QW4ZDSN5UWI>. Download it today! You are receiving this because you were mentioned.Message ID: ***@***.***>

[github-actions]

🧪 Code Coverage Report

Metric	Coverage	Change
Instructions	81.69%	📈 +0.010%
Branches	75.14%	📈 +0.010%

Coverage data generated from JaCoCo test results

[seonwooj0810]

Quick correction on the CLA front, @cowtowncoder: I actually already have a signed Jackson CLA on file — I had submitted it previously (emailed to cla@fasterxml.com) rather than this being a brand-new one, so there shouldn't be anything outstanding on that side. Apologies for the mixed signal in my earlier reply. Happy to re-send a copy if it's easier to confirm on your end.

[cowtowncoder]

No need -- I'll double-check I can find it when I get home.

[cowtowncoder]

Found it! Reason I was confused was Github comment on it being the first contribution -- but this is because your earlier PR was for jackson-core, not databind.

[github-actions]

🧪 Code Coverage Report

Metric	Coverage	Change
Instructions	81.69%	📈 +0.010%
Branches	75.15%	📈 +0.030%

Coverage data generated from JaCoCo test results