From 771b93d36355feeafa847424d538712fc597bc72 Mon Sep 17 00:00:00 2001
From: 2pk03 <alo.alt@me.com>
Date: Tue, 7 Jul 2026 14:53:53 +0200
Subject: [PATCH] fix(java-sdk): bump jackson-databind to 2.21.5

Resolves four new Dependabot alerts (#78-#81) for polymorphic
deserialization and InetSocketAddress SSRF CVEs introduced after the
2.19.1 bump in #166.
---
 lfs-client-sdk/java/pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lfs-client-sdk/java/pom.xml b/lfs-client-sdk/java/pom.xml
index 6dfb6236..f43dba23 100644
--- a/lfs-client-sdk/java/pom.xml
+++ b/lfs-client-sdk/java/pom.xml
@@ -31,7 +31,7 @@ limitations under the License.
     <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
     <kafka.clients.version>4.1.2</kafka.clients.version>
     <aws.sdk.version>2.31.5</aws.sdk.version>
-    <jackson.version>2.19.1</jackson.version>
+    <jackson.version>2.21.5</jackson.version>
     <junit.jupiter.version>5.11.0</junit.jupiter.version>
     <testcontainers.version>1.20.2</testcontainers.version>
   </properties>