From 9ed721aaee0645dc2e510902ee52137e25b271a4 Mon Sep 17 00:00:00 2001
From: Andrii Bodnar <29282228+andrii-bodnar@users.noreply.github.com>
Date: Tue, 22 Sep 2026 11:10:40 +0300
Subject: [PATCH] fix: bump jackson-databind to 2.22.3 and submit Gradle
 dependency graph

Upgrade jackson-databind from 2.17.3 to 2.22.3 to pick up the fixes for
the open Dependabot alerts (CVE-2026-54512, CVE-2026-54513,
CVE-2026-68497 and related jackson-core advisories).

Add a dependency-submission workflow so GitHub's dependency graph is
built from the actual Gradle dependencies instead of the pom.xml that
was removed in 2019, which is what the current alerts still reference.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 .github/workflows/dependency-submission.yml | 24 +++++++++++++++++++++
 build.gradle                                |  2 +-
 2 files changed, 25 insertions(+), 1 deletion(-)
 create mode 100644 .github/workflows/dependency-submission.yml

diff --git a/.github/workflows/dependency-submission.yml b/.github/workflows/dependency-submission.yml
new file mode 100644
index 000000000..87760d4eb
--- /dev/null
+++ b/.github/workflows/dependency-submission.yml
@@ -0,0 +1,24 @@
+name: Dependency Submission
+
+on:
+  push:
+    branches:
+      - master
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+jobs:
+  dependency-submission:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: 8
+
+      - name: Generate and submit dependency graph
+        uses: gradle/actions/dependency-submission@v4
diff --git a/build.gradle b/build.gradle
index a8051821c..8a32e6f2a 100644
--- a/build.gradle
+++ b/build.gradle
@@ -27,7 +27,7 @@ dependencies {
     annotationProcessor 'org.projectlombok:lombok:1.18.32'
 
     implementation 'org.apache.httpcomponents:httpclient:4.5.13'
-    implementation 'com.fasterxml.jackson.core:jackson-databind:2.17.3'
+    implementation 'com.fasterxml.jackson.core:jackson-databind:2.22.3'
 
     testImplementation 'org.junit.jupiter:junit-jupiter-api:5.9.0','org.mockito:mockito-core:4.11.0'
     testRuntimeOnly 'org.junit.jupiter:junit-jupiter-engine:5.9.0'