diff --git a/pom.xml b/pom.xml
index 9bfd464..b9344e1 100644
--- a/pom.xml
+++ b/pom.xml
@@ -19,13 +19,15 @@
     <url>https://github.com/QubitProducts/metrics-flow</url>
 
     <properties>
-        <dataflow.version>1.9.0</dataflow.version>
+        <dataflow.version>1.9.1</dataflow.version>
         <dataflow.common.version>2.0.5-SNAPSHOT</dataflow.common.version>
-        <google.findbugs.version>3.0.1</google.findbugs.version>
+        <google.findbugs.version>3.0.2</google.findbugs.version>
         <hamcrest.version>1.3</hamcrest.version>
-        <java.slang.version>2.0.0</java.slang.version>
+        <java.slang.version>2.0.6</java.slang.version>
         <junit.version>4.12</junit.version>
-        <mockito.version>2.7.19</mockito.version>
+        <mockito.version>2.7.22</mockito.version>
+        <jackson.core.version-override>2.7.9</jackson.core.version-override>
+        <jackson.databind.version-override>2.7.9.3</jackson.databind.version-override>
     </properties>
 
     <dependencies>
@@ -45,6 +47,18 @@
             <version>${google.findbugs.version}</version>
         </dependency>
 
+        <!-- local patch overrides to fix vulnerable libraries -->
+        <dependency>
+            <groupId>com.fasterxml.jackson.core</groupId>
+            <artifactId>jackson-databind</artifactId>
+            <version>${jackson.databind.version-override}</version>
+        </dependency>
+        <dependency>
+            <groupId>com.fasterxml.jackson.core</groupId>
+            <artifactId>jackson-core</artifactId>
+            <version>${jackson.core.version-override}</version>
+        </dependency>
+
         <dependency>
             <groupId>org.hamcrest</groupId>
             <artifactId>hamcrest-core</artifactId>