There are too much CVE related to this old jackson and avro will likely not fix it anytime soon.
Since it is not needed for the product and there is also no will to justify any usage not being vulnerable for each single release and deliverable, we will not deliver this dependency anymore but stay compatible with it if provided.