diff --git a/karate-core/pom.xml b/karate-core/pom.xml
index 9607504e6..a9ac00ef5 100644
--- a/karate-core/pom.xml
+++ b/karate-core/pom.xml
@@ -93,7 +93,7 @@
         <dependency>
             <groupId>io.github.classgraph</groupId>
             <artifactId>classgraph</artifactId>
-            <version>4.8.152</version>
+            <version>4.8.160</version>
         </dependency>
         <dependency>
             <groupId>io.github.t12y</groupId>
diff --git a/karate-core/src/test/resources/readme.txt b/karate-core/src/test/resources/readme.txt
index c29eb3537..e5d4daf9c 100644
--- a/karate-core/src/test/resources/readme.txt
+++ b/karate-core/src/test/resources/readme.txt
@@ -5,6 +5,7 @@ mvn versions:set versions:commit -DnewVersion=2.0.0
 cve check
 =========
 mvn clean verify -P depcheck
+(save the above report)
 
 prod:
 =====
@@ -26,6 +27,8 @@ mvn versions:set versions:commit -DnewVersion=@@@
     karate-core/target/karate-XXX.jar
     karate-robot/target/karate-robot-XXX.jar
 
+(save the sonatype report)
+
 release radar
 =============
 https://github.com/github/release-radar/issues/new?assignees=MishManners&labels=&template=release-radar-request.yml&title=%5BRelease+Radar+Request%5D+%3Ctitle%3E