How to update package version in external libraries

I want to update this package's version, but I didn't find this package in my pom file under root directory

How can I update this package's version? Do I need to do it directly in the pom file under the Maven package?

This is my dependency tree, and I want to upgrade to 1.31

If you don’t use it directly, then it is coming from one of your dependencies. You can check which one using

mvn dependency:tree

With IntelliJ IDEA, you can also open the Maven view, then right-click the project and select “Analyze Dependencies…” to get the same information.

Ideally, you should keep it as a transitive dependency, otherwise you will have to take care of its upgrade every time you upgrade the library that actually depends on it. Moreover, there can be issues if you upgrade only the transitive dependency and not the intermediate one (e.g. for Spring).

The best solution would thus be to upgrade that intermediate dependency, assuming that they have released a new version of it (SnakeYAML 1.29 being affected by CVE-2022-25857, there are good chances).

Only if you can’t do that, you should add the dependency in the <dependencyManagement> section of your pom.xml, but don’t forget tot maintain it from now on (and remove it once the intermediate dependency is upgraded).