Upgrade to Jackson 2.6.3

Closes gh-4170

spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/jackson/JacksonAutoConfiguration.java

@@ -23,6 +23,7 @@ import java.util.Collection;
 import java.util.Locale;
 import java.util.Map;
 import java.util.Map.Entry;
+import java.util.TimeZone;
 
 import com.fasterxml.jackson.annotation.JsonCreator;
 import com.fasterxml.jackson.databind.Module;
@@ -206,7 +207,16 @@ public class JacksonAutoConfiguration {
 							(DateFormat) BeanUtils.instantiateClass(dateFormatClass));
 				}
 				catch (ClassNotFoundException ex) {
-					builder.dateFormat(new SimpleDateFormat(dateFormat));
+					SimpleDateFormat simpleDateFormat = new SimpleDateFormat(dateFormat);
+					// Since Jackson 2.6.3 we always need to set a TimeZone (see gh-4170)
+					// If none in our properties fallback to the Jackson's default
+					TimeZone timeZone = this.jacksonProperties.getTimeZone();
+					if (timeZone == null) {
+						timeZone = new ObjectMapper().getSerializationConfig()
+								.getTimeZone();
+					}
+					simpleDateFormat.setTimeZone(timeZone);
+					builder.dateFormat(simpleDateFormat);
 				}
 			}
 		}

spring-boot-dependencies/pom.xml

@@ -86,7 +86,7 @@
 		<httpclient.version>4.5.1</httpclient.version>
 		<httpcore.version>4.4.4</httpcore.version>
 		<infinispan.version>8.0.1.Final</infinispan.version>
-		<jackson.version>2.6.1</jackson.version>
+		<jackson.version>2.6.3</jackson.version>
 		<janino.version>2.7.8</janino.version>
 		<javassist.version>3.18.1-GA</javassist.version> <!-- Same as Hibernate -->
 		<javax-cache.version>1.0.0</javax-cache.version>