From 80c07160061e6b61d6382d077769af2ce3a4689c Mon Sep 17 00:00:00 2001
From: "auri-agentic-framework[bot]"
 <auri-agentic-framework[bot]@users.noreply.github.com>
Date: Sun, 10 May 2026 02:39:38 +0000
Subject: [PATCH] fix: upgrade jackson-databind to 4.3.30.RELEASE (12 CVEs)

Remediates 12 CVEs via the Endor UIA package-upgrade group.

Endor UIA reports LOW upgrade risk and no breaking changes expected.
---
 pom.xml | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/pom.xml b/pom.xml
index 5842bbd..470ffea 100644
--- a/pom.xml
+++ b/pom.xml
@@ -22,6 +22,18 @@
         <maven.compiler.target>1.8</maven.compiler.target>
     </properties>
 
+    
+    <dependencyManagement>
+        <dependencies>
+            <!-- Override transitive com.fasterxml.jackson.core:jackson-databind — LOW risk per Endor Labs UIA -->
+            <dependency>
+                <groupId>com.fasterxml.jackson.core</groupId>
+                <artifactId>jackson-databind</artifactId>
+                <version>4.3.30.RELEASE</version>
+            </dependency>
+        </dependencies>
+    </dependencyManagement>
+
     <dependencies>
         <dependency>
             <groupId>org.springframework</groupId>