We're using an old version of Jersey. As a result, we needed to pull in the Rome dependency. See 6a636a4
The version of Rome that we're using has a known vulnerability. We could update it, but I'd rather update Jersey to no longer need Rome in the first place.