Our software calls asciidoctorj as a dependent library, which in turn calls jruby, which relies on snakeyaml

snakeyaml < 2.0 currently has a critical CVE, CVE-2022-1471 -- https://nvd.nist.gov/vuln/detail/CVE-2022-1471

jruby pulls in a version prior to 2.0

Please update jruby to pull in snakeyaml 2.0 or greater.

I am very well aware of this previous comment: #7570 (comment)

However, this critical vulnerability is coming up in SBOM reports from pretty much all SCA/OSA vendors and is blocking deployments using the vulnerable version of snakeyaml.

edit: fixed typo