diff --git a/dependencies.md b/dependencies.md
index 217aa26..404e8d9 100644
--- a/dependencies.md
+++ b/dependencies.md
@@ -11,7 +11,7 @@
 | [Spark Project SQL][6]            | [Apache-2.0][7]                                |
 | [aircompressor][8]                | [Apache License 2.0][7]                        |
 | [LZ4 Java Compression][9]         | [Apache License, Version 2.0][10]              |
-| [Scala Library][11]               | [Apache-2.0][10]                               |
+| [scala-library-bootstrapped][11]  | [Apache-2.0][10]                               |
 | [Apache Ivy][12]                  | [The Apache Software License, Version 2.0][13] |
 | [Apache ZooKeeper - Server][14]   | [Apache License, Version 2.0][15]              |
 | [Apache Avro][16]                 | [Apache-2.0][15]                               |
@@ -75,7 +75,7 @@
 [8]: https://github.com/airlift/aircompressor
 [9]: https://github.com/yawkat/lz4-java
 [10]: https://www.apache.org/licenses/LICENSE-2.0
-[11]: https://www.scala-lang.org/
+[11]: https://scala-lang.org/
 [12]: http://ant.apache.org/ivy/
 [13]: http://www.apache.org/licenses/LICENSE-2.0.txt
 [14]: http://zookeeper.apache.org/zookeeper
diff --git a/doc/changes/changelog.md b/doc/changes/changelog.md
index 9b5a820..15ca59e 100644
--- a/doc/changes/changelog.md
+++ b/doc/changes/changelog.md
@@ -1,5 +1,6 @@
 # Changes
 
+* [4.0.1](changes_4.0.1.md)
 * [4.0.0](changes_4.0.0.md)
 * [3.0.0](changes_3.0.0.md)
 * [2.0.16](changes_2.0.16.md)
diff --git a/doc/changes/changes_4.0.1.md b/doc/changes/changes_4.0.1.md
new file mode 100644
index 0000000..ff0ffca
--- /dev/null
+++ b/doc/changes/changes_4.0.1.md
@@ -0,0 +1,36 @@
+# Spark Connector Common Java 4.0.1, released 2026-??-??
+
+Code name: Fixed vulnerabilities CVE-2026-19032, CVE-2026-68497
+
+## Summary
+
+This release fixes the following 2 vulnerabilities:
+
+### CVE-2026-19032 (CWE-470) in dependency `com.fasterxml.jackson.core:jackson-databind:jar:2.22.1:provided`
+com.fasterxml.jackson.core/jackson-databind - Unrestricted URI schemes in Path deserialization
+#### References
+* https://guide.sonatype.com/vulnerability/CVE-2026-19032?component-type=maven&component-name=com.fasterxml.jackson.core%2Fjackson-databind&utm_source=ossindex-client&utm_medium=integration&utm_content=1.8.1
+* http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2026-19032
+* https://github.com/FasterXML/jackson-databind/pull/6129
+
+### CVE-2026-68497 (CWE-770) in dependency `com.fasterxml.jackson.core:jackson-databind:jar:2.22.1:provided`
+jackson-databind - Allocation of Resources Without Limits or Throttling
+#### References
+* https://guide.sonatype.com/vulnerability/CVE-2026-68497?component-type=maven&component-name=com.fasterxml.jackson.core%2Fjackson-databind&utm_source=ossindex-client&utm_medium=integration&utm_content=1.8.1
+* http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2026-68497
+* https://github.com/FasterXML/jackson-databind/pull/6127
+
+## Security
+
+* #111: Fixed vulnerability CVE-2026-19032 in dependency `com.fasterxml.jackson.core:jackson-databind:jar:2.22.1:provided`
+* #112: Fixed vulnerability CVE-2026-68497 in dependency `com.fasterxml.jackson.core:jackson-databind:jar:2.22.1:provided`
+
+## Dependency Updates
+
+### Compile Dependency Updates
+
+* Updated `at.yawk.lz4:lz4-java:1.11.1` to `1.11.2`
+
+### Test Dependency Updates
+
+* Updated `org.junit.jupiter:junit-jupiter-params:6.1.2` to `6.1.3`
diff --git a/pk_generated_parent.pom b/pk_generated_parent.pom
index f3740cf..bb99213 100644
--- a/pk_generated_parent.pom
+++ b/pk_generated_parent.pom
@@ -3,7 +3,7 @@
     <modelVersion>4.0.0</modelVersion>
     <groupId>com.exasol</groupId>
     <artifactId>spark-connector-common-java-generated-parent</artifactId>
-    <version>4.0.0</version>
+    <version>4.0.1</version>
     <packaging>pom</packaging>
     <properties>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
diff --git a/pom.xml b/pom.xml
index 03159bd..6aa6a45 100644
--- a/pom.xml
+++ b/pom.xml
@@ -3,14 +3,14 @@
     <modelVersion>4.0.0</modelVersion>
     <groupId>com.exasol</groupId>
     <artifactId>spark-connector-common-java</artifactId>
-    <version>4.0.0</version>
+    <version>4.0.1</version>
     <name>spark-connector-common-java</name>
     <description>An Exasol common library for Apache Spark connectors</description>
     <url>https://github.com/exasol/spark-connector-common-java/</url>
     <parent>
         <artifactId>spark-connector-common-java-generated-parent</artifactId>
         <groupId>com.exasol</groupId>
-        <version>4.0.0</version>
+        <version>4.0.1</version>
         <relativePath>pk_generated_parent.pom</relativePath>
     </parent>
     <properties>
@@ -23,7 +23,7 @@
             <dependency>
                 <groupId>io.netty</groupId>
                 <artifactId>netty-bom</artifactId>
-                <version>4.2.16.Final</version>
+                <version>4.2.17.Final</version>
                 <!-- contains the CVE fix -->
                 <type>pom</type>
                 <scope>import</scope>
@@ -63,14 +63,14 @@
                 <!-- Fix CVE-2026-54512, CVE-2026-54513, CVE-2026-54514, CVE-2026-54515, CVE-2026-54516, CVE-2026-54517, CVE-2026-54518, CVE-2026-59888, CVE-2026-59889 in transitive dependency of org.apache.spark:spark-sql_2.13 -->
                 <groupId>com.fasterxml.jackson</groupId>
                 <artifactId>jackson-bom</artifactId>
-                <version>2.22.1</version>
+                <version>2.22.2</version>
                 <type>pom</type>
                 <scope>import</scope>
             </dependency>
             <dependency>
                 <groupId>org.junit</groupId>
                 <artifactId>junit-bom</artifactId>
-                <version>6.1.2</version>
+                <version>6.1.3</version>
                 <type>pom</type>
                 <scope>import</scope>
             </dependency>
@@ -95,7 +95,7 @@
         <dependency>
             <groupId>org.apache.spark</groupId>
             <artifactId>spark-sql_2.13</artifactId>
-            <version>4.2.0</version>
+            <version>4.2.0-preview5</version>
             <scope>provided</scope>
             <exclusions>
                 <exclusion>
@@ -130,13 +130,13 @@
             <!-- Replacement for org.lz4:lz4-java to fix CVE-2025-12183 & CVE-2025-66566 -->
             <groupId>at.yawk.lz4</groupId>
             <artifactId>lz4-java</artifactId>
-            <version>1.11.1</version>
+            <version>1.11.2</version>
         </dependency>
         <dependency>
             <groupId>org.scala-lang</groupId>
             <artifactId>scala-library</artifactId>
             <!-- Keep using Scala 2.13 -->
-            <version>2.13.18</version>
+            <version>3.8.4</version>
             <scope>provided</scope>
         </dependency>
         <!-- Upgrade transitive dependency of org.apache.spark:spark-core_2.13 to fix CVE-2022-46751 -->