One (ok’ish?) solution would be to add databind dependency to Cheshire. It doesn’t really need this, but if shortest path to Jackson is via Cheshire, it would nail down both versions. Jsonista doesn’t really need the latests version, mainly just security patches.
Another would be to coordinate the Jackson dependencies in various JSON libs. But if/as people don’t update their libs to use the latest all the time, the issue of version mismatch remains.