fix(deps): bump jackson-databind to 2.21.7 to fix CVE-2026-54512/54513 (#95)

Our own direct pin (2.21.0) falls in the vulnerable range (>=2.19.0,
<2.21.4) for both CVEs — a PolymorphicTypeValidator bypass allowing
arbitrary class instantiation during deserialization. Fixed upstream
in 2.21.4; bumped to the latest 2.21.x patch (2.21.7).

Dependabot's PR #89 targeted json-schema-validator 1.4.3 -> 3.0.7
instead, but that dependency is optional and its transitive jackson
version is overridden by our direct pin anyway (Maven dependency
mediation), so bumping it doesn't touch the actually-vulnerable
artifact. It also doesn't build: 3.0.7 replaced the whole
JsonSchemaFactory/ValidationMessage API with a jackson 3.x
(tools.jackson) rewrite, which would pull in a second, incompatible
Jackson major version. Bumping our own jackson-databind pin fixes
the CVEs directly without any of that.

547 tests green.

Closes #94.

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

Author: shossain786

pom.xml

@@ -64,7 +64,7 @@
         <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
             <artifactId>jackson-databind</artifactId>
-            <version>2.21.0</version>
+            <version>2.21.7</version>
         </dependency>
 
         <!--