June 24, 2026

4.10.16

(chore): Bump jackson-databind from 2.18.6 to 2.18.8 to fix CVE-2026-54513 (allowIfSubTypeIsArray bypass) and CVE-2026-54514 (InetSocketAddress SSRF).