From 19b5f9c425e30bac0274002e7e04e7b6f4abbc6f Mon Sep 17 00:00:00 2001
From: Vlad Ligai <vlad.ligai2@gmail.com>
Date: Wed, 9 Sep 2026 15:48:20 -0400
Subject: [PATCH] chore: bump jackson to 2.18.10 and logback to 1.3.16

Clears the outstanding advisories against the SDK's directly declared
dependencies:

  jackson-core / jackson-databind / jackson-datatype-jsr310
    2.17.1 -> 2.18.10
  logback-core / logback-classic
    1.3.14 -> 1.3.16

A consumer-facing scan goes from 3 HIGH, 7 MEDIUM and 4 LOW findings
down to 3 LOW. The three that remain are logback-core issues whose fixes
exist only in the 1.5.x line, which requires Java 21. 1.3.16 is the last
release of the Java 8 compatible line.

All upgraded artifacts are still Java 8 bytecode and the public API is
unchanged: 608 public signatures identical to the published 3.0.8 jar
built from this same source. Verified with the existing 33 tests plus a
28 assertion end-to-end run against a live instance on JDK 8 and JDK 11.
---
 pom.xml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pom.xml b/pom.xml
index a8833c9..1226d98 100644
--- a/pom.xml
+++ b/pom.xml
@@ -67,17 +67,17 @@
     <dependency>
       <groupId>com.fasterxml.jackson.core</groupId>
       <artifactId>jackson-core</artifactId>
-      <version>2.17.1</version>
+      <version>2.18.10</version>
     </dependency>
     <dependency>
       <groupId>com.fasterxml.jackson.core</groupId>
       <artifactId>jackson-databind</artifactId>
-      <version>2.17.1</version>
+      <version>2.18.10</version>
     </dependency>
     <dependency>
       <groupId>com.fasterxml.jackson.datatype</groupId>
       <artifactId>jackson-datatype-jsr310</artifactId>
-      <version>2.17.1</version>
+      <version>2.18.10</version>
     </dependency>
     <!--    Annotation dependencies-->
     <dependency>
@@ -91,7 +91,7 @@
     <dependency>
       <groupId>ch.qos.logback</groupId>
       <artifactId>logback-core</artifactId>
-      <version>1.3.14</version>
+      <version>1.3.16</version>
     </dependency>
 
     <dependency>
@@ -104,7 +104,7 @@
     <dependency>
       <groupId>ch.qos.logback</groupId>
       <artifactId>logback-classic</artifactId>
-      <version>1.3.14</version>
+      <version>1.3.16</version>
     </dependency>
 
     <!--    HTTP request dependencies-->