From ddbef0327b83ccf931157f8e436d6bb8afa53060 Mon Sep 17 00:00:00 2001
From: Vasyl Zakharchenko <vaszakharchenko@gmail.com>
Date: Tue, 15 Sep 2026 11:19:52 +0000
Subject: [PATCH] chore(deps): autoupdate 2026-09-15

---
 examples/atlassian-connect-forge-spring-boot-sample/pom.xml | 2 +-
 pom.xml                                                     | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/examples/atlassian-connect-forge-spring-boot-sample/pom.xml b/examples/atlassian-connect-forge-spring-boot-sample/pom.xml
index d79e780..171c3e0 100644
--- a/examples/atlassian-connect-forge-spring-boot-sample/pom.xml
+++ b/examples/atlassian-connect-forge-spring-boot-sample/pom.xml
@@ -33,7 +33,7 @@
         <!-- Override Spring Boot 3.5.14 default (10.1.54) to clear the Tomcat
              CVE batch Snyk reports against sample-core (HTTP/2 headers, Digest
              auth, WebDAV LOCK/PROPFIND, etc.); fixed in 10.1.55. -->
-        <tomcat.version>10.1.59</tomcat.version>
+        <tomcat.version>10.1.60</tomcat.version>
         <!-- frontend toolchain — frontend-maven-plugin downloads Node + npm into target/,
              so contributors do not need a system-wide install and CI is reproducible.
              Node 24.x is the current LTS (Krypton); npm 11.12.1 is what it bundles. -->
diff --git a/pom.xml b/pom.xml
index 8688660..955fd00 100644
--- a/pom.xml
+++ b/pom.xml
@@ -54,7 +54,7 @@
         <spring-security.version>6.5.11</spring-security.version>
         <!-- Override Spring Boot 3.5.14 default (10.1.54) — Dependabot flagged
              several Critical/High Tomcat CVEs fixed in 10.1.55. -->
-        <tomcat.version>10.1.59</tomcat.version>
+        <tomcat.version>10.1.60</tomcat.version>
         <error-prone.version>2.49.0</error-prone.version>
         <atlassian.connect.version>6.0.7</atlassian.connect.version>
         <maven-checkstyle-plugin.version>3.6.0</maven-checkstyle-plugin.version>