From cc5b1747963898f5d2f0074c23ef444aec27c86f Mon Sep 17 00:00:00 2001
From: Murph Murphy <murph.murphy@ironcorelabs.com>
Date: Tue, 29 Sep 2026 13:15:30 -0600
Subject: [PATCH] Bump maven-model and example jackson-databind to clear
 Dependabot alerts

Upgrade the test-scoped maven-model from 3.9.4 to 3.9.16, which pulls in plexus-utils 3.6.1 in place of the vulnerable 3.5.1. Dependabot cannot update plexus-utils itself because it is a transitive dependency outside its parsed snapshot. Also bump jackson-databind in examples/large-documents from 2.22.1 to 2.22.2.
---
 examples/large-documents/pom.xml | 2 +-
 pom.xml                          | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/examples/large-documents/pom.xml b/examples/large-documents/pom.xml
index 69e99ea..7764561 100644
--- a/examples/large-documents/pom.xml
+++ b/examples/large-documents/pom.xml
@@ -39,7 +39,7 @@
     <dependency>
       <groupId>com.fasterxml.jackson.core</groupId>
       <artifactId>jackson-databind</artifactId>
-      <version>2.22.1</version>
+      <version>2.22.2</version>
     </dependency>
 
   </dependencies>
diff --git a/pom.xml b/pom.xml
index 03b72c8..e02966c 100644
--- a/pom.xml
+++ b/pom.xml
@@ -90,7 +90,7 @@
     <dependency>
       <groupId>org.apache.maven</groupId>
       <artifactId>maven-model</artifactId>
-      <version>3.9.4</version>
+      <version>3.9.16</version>
       <scope>test</scope>
     </dependency>
   </dependencies>