Update woodstox dep (6.3.1 -> 6.4.0)

Author: cowtowncoder

pom.xml

@@ -84,10 +84,11 @@ alternative support for serializing POJOs as XML and deserializing XML as pojos.
       -->
     <!-- 16-Jul-2016, tatu: For 2.10, need Woodstox 6.x to get module info -->
     <!-- 28-Jun-2022, tatu: For 2.13.4+, 6.3 to get OSGi metadata -->
+    <!-- 24-Oct-2022, tatu: For 2.13.5+, 6.4 for bug fixes (including 1 CVE) -->
     <dependency>
       <groupId>com.fasterxml.woodstox</groupId>
       <artifactId>woodstox-core</artifactId>
-      <version>6.3.1</version>
+      <version>6.4.0</version>
       <exclusions>
         <exclusion>
 	  <groupId>javax.xml.stream</groupId>

release-notes/VERSION-2.x

@@ -8,6 +8,10 @@ Project: jackson-dataformat-xml
 
 No changes since 2.13
 
+2.13.5 (not yet released)
+
+* Upgrade Woodstox to 6.4.0 for a fix to one CVE
+
 2.13.4 (03-Sep-2022)
 
 #536: Upgrade Woodstox to 6.3.1 to get OSGi metadata