diff --git a/infra/cdk/pom.xml b/infra/cdk/pom.xml
index cdf7d80d..0de48732 100644
--- a/infra/cdk/pom.xml
+++ b/infra/cdk/pom.xml
@@ -93,16 +93,6 @@
             <version>2.46.20</version>
         </dependency>
 
-        <!-- Jackson for JSON processing -->
-        <dependency>
-            <groupId>com.fasterxml.jackson.core</groupId>
-            <artifactId>jackson-databind</artifactId>
-            <!-- Pinned to 2.21.4: 2.22.0 is affected by GHSA-5jmj-h7xm-6q6v
-                 (case-insensitive deserialization bypasses per-property
-                 @JsonIgnoreProperties) with no patched 2.22.x release yet. -->
-            <version>2.21.4</version>
-        </dependency>
-
         <!-- JSON library for policy parsing -->
         <dependency>
             <groupId>org.json</groupId>
diff --git a/labs/unicorn-store/software/unicorn-store-spring/pom.xml b/labs/unicorn-store/software/unicorn-store-spring/pom.xml
new file mode 100644
index 00000000..22b246c4
--- /dev/null
+++ b/labs/unicorn-store/software/unicorn-store-spring/pom.xml
@@ -0,0 +1,24 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  TEMPORARY placeholder to purge a stale GitHub dependency-graph manifest.
+
+  The real module under labs/unicorn-store/ was removed from main in Feb 2025,
+  but GitHub never dropped this pom.xml from the dependency graph, so it keeps
+  generating phantom Dependabot alerts / update runs (tomcat, jackson, netty,
+  logback, ...) against dependencies that no longer exist here.
+
+  This dependency-free pom re-registers the path so GitHub re-scans it (clearing
+  the phantom findings), after which it is deleted in a follow-up commit to drop
+  the manifest from the dependency graph entirely.
+
+  DO NOT keep this file. It exists only to force a dependency-graph reconciliation.
+-->
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+    <groupId>com.unicorn</groupId>
+    <artifactId>unicorn-store-spring-removed</artifactId>
+    <version>0.0.0</version>
+    <packaging>pom</packaging>
+</project>