Fix possible fix(deps): 2 vulnerable dependencies in pom.xml

[begininvoke]

This changes pom.xml to address something a scan flagged. It is around line 162.

The vulnerability is real: Jackson databind 2.18.6 uses BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() which only checks if a class is an array (clazz.isArray()) without validating the array's element type. This bypasses configured allowlists, allowing deserialization of arbitrary malicious types (e.g., EvilType[]) and can lead to remote code execution when processing untrusted input.

Upgrade Jackson to version 2.18.8 to resolve the reported high‑severity CVEs affecting jackson‑databind and jackson‑core.

For reference: rule CVE-2026-54513. Rated high.

I do not know the codebase, so please check the change fits how the rest of it works. Happy to adjust it or close this if the reasoning is off.

---

Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}