From c546508ff130d87b863d5d97f032d1aec6d4323e Mon Sep 17 00:00:00 2001
From: Lauren Shareshian <laurenshareshian@squareup.com>
Date: Mon, 10 Aug 2026 12:43:27 -0700
Subject: [PATCH] Fix vulnerable Dokka transitive dependencies

---
 build.gradle.kts          | 14 ++++++++++++++
 gradle/libs.versions.toml |  2 +-
 2 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/build.gradle.kts b/build.gradle.kts
index 6c8a296..4ea3f3e 100644
--- a/build.gradle.kts
+++ b/build.gradle.kts
@@ -15,6 +15,20 @@ buildscript {
     repositories {
         mavenCentral()
     }
+
+    dependencies {
+        classpath(platform("com.fasterxml.jackson:jackson-bom:2.22.1"))
+    }
+}
+
+// Align Dokka's build-only dependencies with versions containing upstream security fixes.
+allprojects {
+    pluginManager.withPlugin("org.jetbrains.dokka") {
+        dependencies {
+            add("dokkaHtmlGeneratorRuntime", platform("com.fasterxml.jackson:jackson-bom:2.22.1"))
+            add("dokkaHtmlGeneratorRuntime", "org.jsoup:jsoup:1.23.1")
+        }
+    }
 }
 
 // Configure binary compatibility validator
diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml
index 7760a5d..a1e1a49 100644
--- a/gradle/libs.versions.toml
+++ b/gradle/libs.versions.toml
@@ -13,7 +13,7 @@ jacoco = "0.8.11"
 
 # Build and tooling
 kotlin = "2.1.20"
-dokka = "2.0.0"
+dokka = "2.2.0"
 mavenPublishGradlePlugin = "0.31.0"
 dependencyAnalysis = "2.13.0"
 binaryCompatibilityValidator = "0.17.0"