diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9c9ed0d..e85459f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,29 @@ All notable changes to Agents.KT are documented here. The format follows [Keep a
## [Unreleased]
+### Security — jackson-databind bumped 2.21.3 → 2.21.5 (7 advisories)
+
+`jackson-databind` arrives transitively via `langchain4j-core` in `agents-kt-rag-langchain4j` (it is not a
+direct dependency of any module). Dependabot flagged **7 open advisories** against the 2.21.x line it pulled;
+all are cleared by forcing the artifact — and the tightly-coupled `jackson-core` — to **2.21.5** in that
+module's existing `resolutionStrategy.force(...)` block:
+
+- **High** — array-subtype allowlist bypass in `BasicPolymorphicTypeValidator` (`allowIfSubTypeIsArray`),
+ GHSA-rmj7-2vxq-3g9f.
+- **High** — PolymorphicTypeValidator bypass via generic type parameters (arbitrary class instantiation),
+ GHSA-j3rv-43j4-c7qm.
+- **Moderate** — `@JsonView` bypass for unwrapped creator parameters (GHSA-rcqc-6cw3-h962) and for setterless
+ creator properties (GHSA-5hh8-q8hv-fr38).
+- **Moderate** — case-insensitive deserialization bypasses per-property `@JsonIgnoreProperties`
+ (GHSA-9fxm-vc8v-hj55).
+- **Moderate** — renamed `@JsonIgnore`'d setters can still deserialize via private fields (GHSA-hgj6-7826-r7m5).
+- **Moderate** — `InetSocketAddress` deserialization triggers eager DNS resolution (SSRF), GHSA-5jmj-h7xm-6q6v.
+ This one is fixed **only in 2.21.5** (2.21.4 leaves it open), which is why the bump targets 2.21.5 rather than
+ 2.21.4.
+
+No source or API change; a patch bump within the same minor line. Lockfile + `verification-metadata.xml`
+regenerated for `jackson-core`/`jackson-databind`/`jackson-bom` 2.21.5.
+
## [0.8.2] - 2026-07-01
_Standards & trust hardening._ Hardens the experimental x402 buyer (mandatory guardrails, cross-payment
diff --git a/agents-kt-rag-langchain4j/build.gradle.kts b/agents-kt-rag-langchain4j/build.gradle.kts
index 140d87c..469b7a9 100644
--- a/agents-kt-rag-langchain4j/build.gradle.kts
+++ b/agents-kt-rag-langchain4j/build.gradle.kts
@@ -20,6 +20,15 @@ configurations.all {
"org.bouncycastle:bcpg-jdk18on:1.84",
"org.bouncycastle:bcpkix-jdk18on:1.84",
"org.bouncycastle:bcutil-jdk18on:1.84",
+ // Security bump — jackson-databind arrives transitively via langchain4j-core at
+ // 2.21.3; force it (and the tightly-coupled jackson-core) to 2.21.5, which clears
+ // the 7 open advisories on the 2.21.x line: array-subtype allowlist bypass
+ // (GHSA-rmj7-2vxq-3g9f), generic-parameter PTV bypass (GHSA-j3rv-43j4-c7qm),
+ // the @JsonView / @JsonIgnoreProperties / renamed-@JsonIgnore-setter cases
+ // (GHSA-rcqc-6cw3-h962, -9fxm-vc8v-hj55, -5hh8-q8hv-fr38, -hgj6-7826-r7m5), and
+ // InetSocketAddress eager-DNS SSRF (GHSA-5jmj-h7xm-6q6v, fixed only in 2.21.5).
+ "com.fasterxml.jackson.core:jackson-databind:2.21.5",
+ "com.fasterxml.jackson.core:jackson-core:2.21.5",
)
}
}
diff --git a/agents-kt-rag-langchain4j/gradle.lockfile b/agents-kt-rag-langchain4j/gradle.lockfile
index cfa9df4..6408049 100644
--- a/agents-kt-rag-langchain4j/gradle.lockfile
+++ b/agents-kt-rag-langchain4j/gradle.lockfile
@@ -2,9 +2,9 @@
# Manual edits can break the build and are not advised.
# This file is expected to be part of source control.
com.fasterxml.jackson.core:jackson-annotations:2.21=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.core:jackson-core:2.21.3=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.core:jackson-databind:2.21.3=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson:jackson-bom:2.21.3=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.core:jackson-core:2.21.5=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson.core:jackson-databind:2.21.5=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
+com.fasterxml.jackson:jackson-bom:2.21.5=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
dev.langchain4j:langchain4j-core:1.16.3=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
dev.langchain4j:langchain4j:1.16.3=testCompileClasspath,testRuntimeClasspath
org.apache.opennlp:opennlp-tools:2.5.9=testCompileClasspath,testRuntimeClasspath
diff --git a/gradle/verification-metadata.xml b/gradle/verification-metadata.xml
index 792e4da..461f443 100644
--- a/gradle/verification-metadata.xml
+++ b/gradle/verification-metadata.xml
@@ -76,6 +76,11 @@
+
+
+
+
+
@@ -91,6 +96,11 @@
+
+
+
+
+
@@ -130,6 +140,14 @@
+
+
+
+
+
+
+
+
@@ -146,6 +164,14 @@
+
+
+
+
+
+
+
+