Jackson version bump to 2.18.9 for CVE

Author: rudraroop

aws-lambda-java-serialization/RELEASE.CHANGELOG.md

@@ -1,3 +1,7 @@
+### Aug 20, 2026
+`1.4.2`:
+- Update `jackson-databind` dependency from 2.18.6 to 2.18.9
+
 ### May 20, 2026
 `1.4.1`:
 - Fix build issue

aws-lambda-java-serialization/pom.xml

@@ -35,7 +35,7 @@
         <maven.compiler.source>1.8</maven.compiler.source>
         <maven.compiler.target>1.8</maven.compiler.target>
         <relocation.prefix>com.amazonaws.lambda.thirdparty</relocation.prefix>
-        <jackson.version>2.18.6</jackson.version>
+        <jackson.version>2.18.9</jackson.version>
         <gson.version>2.10.1</gson.version>
         <json.version>20231013</json.version>
         <owasp.version>7.3.2</owasp.version>