Sync Woodstox/stax2-api deps from jackson-bom (#760)

Author: cowtowncoder

pom.xml

@@ -70,6 +70,7 @@ alternative support for serializing POJOs as XML and deserializing XML as POJOs.
     <dependency>
       <groupId>org.codehaus.woodstox</groupId>
       <artifactId>stax2-api</artifactId>
+      <version>${jackson.version.dep.stax2-api}</version>
       <exclusions>
         <exclusion>
 	  <groupId>javax.xml.stream</groupId>
@@ -86,9 +87,11 @@ alternative support for serializing POJOs as XML and deserializing XML as POJOs.
       -->
     <!-- 21-Jun-2024, tatu: For 2.18, 7.0.0 (Java 8) -->
     <!-- 22-Oct-2024, tatu: For 2.19, 7.1.0 (latest) -->
+    <!-- 15-May-2025, tatu: For 2.20 comes from jackson-bom (7.1.0) -->
     <dependency>
       <groupId>com.fasterxml.woodstox</groupId>
       <artifactId>woodstox-core</artifactId>
+      <version>${jackson.version.dep.woodstox}</version>
       <exclusions>
         <exclusion>
 	  <groupId>javax.xml.stream</groupId>

release-notes/VERSION-2.x

@@ -8,6 +8,10 @@ Project: jackson-dataformat-xml
 
 - Generate SBOMs [JSTEP-14]
 
+2.19.1 (not yet released)
+
+- Add explicit version for Woodstox, stax2-api (no longer managed via jackson-bom)
+
 2.19.0 (24-Apr-2025)
 
 #508: `XmlMapper` is unable to deserialise into an empty record