From 6d1739a3b7b5d69a80b6e707fb8ddc840bb71fd4 Mon Sep 17 00:00:00 2001
From: Gerard Louis Recinto <gerardrecinto@gmail.com>
Date: Thu, 1 Oct 2026 22:23:29 -0700
Subject: [PATCH] bump the spring boot checkout example to 3.5.16 and pin
 tomcat and jackson past the open advisories

---
 bindings/java/examples/spring-boot-checkout-store/pom.xml | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/bindings/java/examples/spring-boot-checkout-store/pom.xml b/bindings/java/examples/spring-boot-checkout-store/pom.xml
index f654b8cb2..c37c50fc3 100644
--- a/bindings/java/examples/spring-boot-checkout-store/pom.xml
+++ b/bindings/java/examples/spring-boot-checkout-store/pom.xml
@@ -17,12 +17,17 @@
     <parent>
         <groupId>org.springframework.boot</groupId>
         <artifactId>spring-boot-starter-parent</artifactId>
-        <version>3.3.4</version>
+        <version>3.5.16</version>
         <relativePath/>
     </parent>
 
     <properties>
         <java.version>21</java.version>
+        <!-- Boot 3.5.16 still manages Tomcat 10.1.55 and Jackson 2.21.4, which
+             have open advisories fixed in these versions. Drop these once the
+             parent catches up. -->
+        <tomcat.version>10.1.60</tomcat.version>
+        <jackson-bom.version>2.21.7</jackson-bom.version>
     </properties>
 
     <dependencies>