From 5529a24d23c950af4cb308875b16451a81cdf542 Mon Sep 17 00:00:00 2001
From: Radu Florian <raduf@us.ibm.com>
Date: Fri, 13 Nov 2026 15:09:59 -0500
Subject: [PATCH] Fix open security alerts

- Bump jackson-databind and jackson-dataformat-xml from 3.2.1 to 3.2.3
  to resolve Dependabot alerts #8-#12 (DoS issues, incomplete
  PolymorphicTypeValidator denylist, Path deserialization scheme checks).
- Restrict the CI workflow token to `contents: read`
  (code scanning alert actions/missing-workflow-permissions).
- Replace implicit double-to-int compound assignment in
  DateTimeUtils.lettersToDecimal with integer arithmetic
  (code scanning alert java/implicit-cast-in-compound-assignment).

Signed-off-by: Radu Florian <raduf@us.ibm.com>
---
 .github/workflows/mvntest.yml                                 | 3 +++
 pom.xml                                                       | 4 ++--
 .../com/api/jsonata4java/expressions/utils/DateTimeUtils.java | 4 +++-
 3 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/mvntest.yml b/.github/workflows/mvntest.yml
index 986365ec..9d4bafef 100644
--- a/.github/workflows/mvntest.yml
+++ b/.github/workflows/mvntest.yml
@@ -2,6 +2,9 @@ name: Java CI
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
diff --git a/pom.xml b/pom.xml
index 6533ddec..52162b37 100644
--- a/pom.xml
+++ b/pom.xml
@@ -118,14 +118,14 @@
     <dependency>
         <groupId>tools.jackson.core</groupId>
         <artifactId>jackson-databind</artifactId>
-        <version>3.2.1</version>
+        <version>3.2.3</version>
         <scope>compile</scope>
     </dependency>
     <!-- Source: https://mvnrepository.com/artifact/tools.jackson.dataformat/jackson-dataformat-xml -->
     <dependency>
         <groupId>tools.jackson.dataformat</groupId>
         <artifactId>jackson-dataformat-xml</artifactId>
-        <version>3.2.1</version>
+        <version>3.2.3</version>
         <scope>compile</scope>
     </dependency>
     <!-- https://mvnrepository.com/artifact/com.fasterxml.woodstox/woodstox-core -->
diff --git a/src/main/java/com/api/jsonata4java/expressions/utils/DateTimeUtils.java b/src/main/java/com/api/jsonata4java/expressions/utils/DateTimeUtils.java
index edee159a..0c75ea4b 100644
--- a/src/main/java/com/api/jsonata4java/expressions/utils/DateTimeUtils.java
+++ b/src/main/java/com/api/jsonata4java/expressions/utils/DateTimeUtils.java
@@ -1393,9 +1393,11 @@ public int parse(String value) {
 
     private static int lettersToDecimal(String letters, char aChar) {
         int decimal = 0;
+        int place = 1;
         char[] chars = letters.toCharArray();
         for (int i = 0; i < chars.length; i++) {
-            decimal += (chars[chars.length - i - 1] - aChar + 1) * Math.pow(26, i);
+            decimal += (chars[chars.length - i - 1] - aChar + 1) * place;
+            place *= 26;
         }
         return decimal;
     }