[arunav-gandhi]

Description

Summary

Fixes the dependency vulnerabilities reported by Auto-Owners Insurance in Guardian Android 0.11.2, which ships java-jwt 4.6.1 and Jackson 2.22.2.

• Bump com.auth0:java-jwt 4.6.1 → 4.6.2.
• Bump the jackson-bom pin 2.22.2 → 2.22.4.
• Declare jackson-core and jackson-databind directly with an explicit 2.22.4, so Maven consumers (nearest-wins) and POM-only scanners also resolve the patched version. java-jwt 4.6.2 still pulls Jackson 2.22.3, which is affected by CVE-2026-110879, so the pin is still needed.

CVE	Artifact	Fixed in
CVE-2026-89425, CVE-2026-89407	jackson-core	2.22.3
CVE-2026-91776, CVE-2026-91777	jackson-databind	2.22.3
CVE-2026-110879	jackson-databind	2.22.4
CVE-2026-85473	java-jwt	4.6.2

Release

Intended to ship as 0.11.3, which was only a pipeline test run and is not published to Maven Central. CHANGELOG.md is deliberately not touched here; it will be updated on release/0.11.3 when the release is cut.

References

• Jira: https://auth0team.atlassian.net/browse/NAPP-244

Testing

• :guardian:dependencies --configuration releaseRuntimeClasspath resolves java-jwt 4.6.2 and jackson-core/databind 2.22.4; no 2.22.2 or 2.22.3 remains.

• :guardian:testReleaseUnitTest: 182 tests, 0 failures.

• :guardian:assembleRelease and :app:assembleDebug build.

• The generated pom-default.xml and module.json list java-jwt 4.6.2 and jackson-core/databind 2.22.4 with explicit versions. Publishing was not run locally because signing is not configured.

• This change adds test coverage for new/changed/fixed functionality

Checklist

• I have added documentation for new/changed functionality in this PR or in auth0.com/docs
• All active GitHub checks for tests, formatting, and security are passing
• The correct base branch is being used, if not the default branch