fix: update Jackson for polymorphic type safety (#28)

Author: JamesbbBriz

CHANGELOG.md

@@ -18,6 +18,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+- Updated Jackson Databind to 2.18.8 to close polymorphic type validator
+  bypasses tracked as CVE-2026-54512 and CVE-2026-54513.
 - Aligned veraPDF validation components so the OpenDataLoader PDF backend does
   not fail at runtime with a `StreamInfo` linkage error.
 

pom.xml

@@ -50,7 +50,7 @@
         <maven.compiler.release>25</maven.compiler.release>
 
         <!-- Runtime deps -->
-        <jackson.version>2.18.2</jackson.version>
+        <jackson.version>2.18.8</jackson.version>
         <slf4j.version>2.0.18</slf4j.version>
         <log4j.version>2.24.3</log4j.version>
         <pdfbox.version>3.0.3</pdfbox.version>