From 61798a2b7959db03a905a3d01a87edfbfbc05dc3 Mon Sep 17 00:00:00 2001
From: Nils Behlen <nils.behlen@netknights.it>
Date: Thu, 1 Oct 2026 14:18:18 +0200
Subject: [PATCH 1/3] Use java-jwt only for tests; align Jackson on 2.22.3

java-jwt is only used by TestJWT, so it no longer becomes a compile/runtime dependency of the client. Bumped to 4.6.1, with the Jackson modules it pulls in aligned via jackson-bom 2.22.3.
---
 pom.xml | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index e61a60b..4ceda6a 100644
--- a/pom.xml
+++ b/pom.xml
@@ -116,10 +116,24 @@
             <version>2.0.19</version>
             <scope>test</scope>
         </dependency>
+        <!-- Only used by the tests to build JWTs; the client itself does not decode them with it. -->
         <dependency>
             <groupId>com.auth0</groupId>
             <artifactId>java-jwt</artifactId>
-            <version>4.6.0</version>
+            <version>4.6.1</version>
+            <scope>test</scope>
         </dependency>
     </dependencies>
+    <dependencyManagement>
+        <dependencies>
+            <!-- Align the Jackson modules java-jwt pulls in on the current patch release. -->
+            <dependency>
+                <groupId>com.fasterxml.jackson</groupId>
+                <artifactId>jackson-bom</artifactId>
+                <version>2.22.3</version>
+                <type>pom</type>
+                <scope>import</scope>
+            </dependency>
+        </dependencies>
+    </dependencyManagement>
 </project>

From 404c48fccc3ff332670919a9476876a96080e9ef Mon Sep 17 00:00:00 2001
From: Nils Behlen <nils.behlen@netknights.it>
Date: Thu, 1 Oct 2026 14:29:54 +0200
Subject: [PATCH 2/3] Changelog for 1.6.0

---
 Changelog.md | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/Changelog.md b/Changelog.md
index 6a50f3d..1cac602 100644
--- a/Changelog.md
+++ b/Changelog.md
@@ -1,6 +1,9 @@
 # Changelog
 
-### 1.6.0 - 6 August 2026
+### 1.6.0 - 1 October 2026
+* Updated the bundled kotlin-stdlib to 2.4.0 and okio to 3.18.2.
+* java-jwt is now a test-only dependency, so neither it nor the Jackson libraries it pulls in are part of the
+  client's dependency tree anymore.
 * Capture the remember-device cookie on WebAuthn and passkey authentications (previously only the OTP path
   propagated the Set-Cookie, so "remember this device" silently did nothing with a security key / passkey).
 * Add a getTokenInfo(username, headers) overload so callers can forward request headers on GET /token

From 38581f3603ff170ec240bd810a19895b2c472101 Mon Sep 17 00:00:00 2001
From: Nils Behlen <nils.behlen@netknights.it>
Date: Thu, 1 Oct 2026 14:34:30 +0200
Subject: [PATCH 3/3] Update OkHttp to 5.4.0 via okhttp-jvm; reference okio-jvm
 directly

OkHttp 5 is published as Kotlin Multiplatform: the plain okhttp artifact only carries metadata, so Maven builds need okhttp-jvm (which is why Dependabot PR #87 failed to compile). Declaring okio-jvm directly keeps 3.18.2 instead of the 3.17.0 okhttp-jvm would pull in.
---
 Changelog.md | 4 +++-
 pom.xml      | 6 +++---
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/Changelog.md b/Changelog.md
index 1cac602..b4686b2 100644
--- a/Changelog.md
+++ b/Changelog.md
@@ -1,7 +1,9 @@
 # Changelog
 
 ### 1.6.0 - 1 October 2026
-* Updated the bundled kotlin-stdlib to 2.4.0 and okio to 3.18.2.
+* Updated the bundled OkHttp to 5.4.0, kotlin-stdlib to 2.4.0 and okio to 3.18.2. OkHttp and okio are now
+  referenced by their `-jvm` artifacts: OkHttp 5 is a Kotlin Multiplatform release whose plain `okhttp` artifact
+  carries no classes for Maven builds.
 * java-jwt is now a test-only dependency, so neither it nor the Jackson libraries it pulls in are part of the
   client's dependency tree anymore.
 * Capture the remember-device cookie on WebAuthn and passkey authentications (previously only the OTP path
diff --git a/pom.xml b/pom.xml
index 4ceda6a..034786e 100644
--- a/pom.xml
+++ b/pom.xml
@@ -91,12 +91,12 @@
         </dependency>
         <dependency>
             <groupId>com.squareup.okhttp3</groupId>
-            <artifactId>okhttp</artifactId>
-            <version>4.12.0</version>
+            <artifactId>okhttp-jvm</artifactId>
+            <version>5.4.0</version>
         </dependency>
         <dependency>
             <groupId>com.squareup.okio</groupId>
-            <artifactId>okio</artifactId>
+            <artifactId>okio-jvm</artifactId>
             <version>3.18.2</version>
         </dependency>
         <dependency>