From 8dd18e273cd174e9833b9e5b966870437a99c1cd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bern=C3=A1t=20G=C3=A1bor?= <gaborjbernat@gmail.com>
Date: Wed, 7 Oct 2026 07:31:06 -0700
Subject: [PATCH] =?UTF-8?q?=F0=9F=94=92=20fix(deps):=20pin=20patched=20Jac?=
 =?UTF-8?q?kson=203.x=20BOM=20for=20test=20framework?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The platform test framework's resolution rule pinned the Jackson 3.x
BOM to 3.1.6, which four open Dependabot alerts (#55-#58) cover for
jackson-core and jackson-databind. 3.1.7 is the first patched release.
---
 build.gradle.kts | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/build.gradle.kts b/build.gradle.kts
index c22d964..0b9bdb1 100644
--- a/build.gradle.kts
+++ b/build.gradle.kts
@@ -92,13 +92,14 @@ dependencies {
 }
 
 configurations.matching { it.name.startsWith("intellijPlatformTest") }.configureEach {
-    // The platform test framework pulls in OpenTelemetry 1.48.0, which has an open Dependabot alert.
+    // The platform test framework pulls in OpenTelemetry 1.48.0 and Jackson 3.1.4, both with open
+    // Dependabot alerts. The Jackson artifacts are version-pinned by tools.jackson:jackson-bom.
     resolutionStrategy.eachDependency {
         if (requested.group == "io.opentelemetry" && requested.version?.startsWith("1.48.") == true) {
             useVersion("1.62.0")
         }
         if (requested.group == "tools.jackson" && requested.name == "jackson-bom") {
-            useVersion("3.1.6")
+            useVersion("3.1.7")
         }
     }
 }