diff --git a/CHANGELOG.md b/CHANGELOG.md
index 50b779a..224b6c1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,6 +11,13 @@ The release procedure (prompt template and step-by-step instructions) lives in [
 
 ## [Unreleased]
 
+### Fixed
+- Bumped `jackson.version` 2.22.0 → 2.22.1 (`jackson-databind` / `jackson-dataformat-yaml`,
+  pinned in the parent `pom.xml`) to close
+  [GHSA-5jmj-h7xm-6q6v](https://github.com/advisories/GHSA-5jmj-h7xm-6q6v) (CVSS 5.3, Medium),
+  flagged by OSV-Scanner against `srcmorph/pom.xml` and `srcmorph-cli/pom.xml` after the `main`
+  merge of the relocation-stub removal.
+
 ### Removed
 - **Relocation-stub module** (`llamacpp-ai-index-maven-plugin/`, `net.ladenthin:llamacpp-ai-index-maven-plugin`)
   removed from the active reactor. It was published once at `1.0.4` as part of the `1.1.1` release
diff --git a/pom.xml b/pom.xml
index 4db37f4..5cc4716 100644
--- a/pom.xml
+++ b/pom.xml
@@ -59,7 +59,7 @@ SPDX-License-Identifier: Apache-2.0
             parent POM, so the version used by both jackson dependencyManagement entries must live
             at this level. srcmorph-cli/pom.xml does not redeclare it.
         -->
-        <jackson.version>2.22.0</jackson.version>
+        <jackson.version>2.22.1</jackson.version>
     </properties>
 
     <!--