diff --git a/release-notes/VERSION-2.x b/release-notes/VERSION-2.x
index 3e66801d..277d36f5 100644
--- a/release-notes/VERSION-2.x
+++ b/release-notes/VERSION-2.x
@@ -12,7 +12,7 @@ Sub-modules:
 
 2.17.0 (not yet released)
 
--
+* Woodstox dependency now 6.6.0
 
 2.16.1 (24-Dec-2023)
 
diff --git a/xml/pom.xml b/xml/pom.xml
index 54114f5b..28041989 100644
--- a/xml/pom.xml
+++ b/xml/pom.xml
@@ -62,9 +62,7 @@
       <groupId>org.codehaus.woodstox</groupId>
       <artifactId>stax2-api</artifactId>
       <!-- Ideally we'd accept range of versions but won't really work with Maven... -->
-
-<!--      <version>[4.0, 5.0)</version>  -->
-      <version>4.2.1</version>
+      <version>4.2.2</version>
     </dependency>
 
     <!-- Also: While JDK-included SJSXP almost works, there are some rough edges;
@@ -73,7 +71,7 @@
     <dependency>
       <groupId>com.fasterxml.woodstox</groupId>
       <artifactId>woodstox-core</artifactId>
-      <version>6.5.1</version>
+      <version>6.6.0</version>
       <exclusions>
         <exclusion>
           <groupId>javax.xml.stream</groupId>