diff --git a/.gitignore b/.gitignore
index 2ab04841ab7..3cde5ddc8cf 100644
--- a/.gitignore
+++ b/.gitignore
@@ -103,6 +103,7 @@ $RECYCLE.BIN/
 .idea/*.iml
 .idea/modules
 .idea/sonarlint
+.idea/copilot.data.*.xml
 *.iml
 *.ipr
 
@@ -235,4 +236,4 @@ matchbox-server/src/main/resources/static/prerendered-routes.json
 
 *.repomixignore
 repomix-output.xml
-repomix.config.json
\ No newline at end of file
+repomix.config.json
diff --git a/docs/changelog.md b/docs/changelog.md
index c71b9d5c6f2..722d4d7f2ac 100644
--- a/docs/changelog.md
+++ b/docs/changelog.md
@@ -1,3 +1,7 @@
+Release 4.0.15
+
+- Upgrade Tomcat to fix [CVE-2025-55752](https://github.com/advisories/GHSA-wmwf-9ccg-fff5)
+
 2025/10/21 Release 4.0.14
 
 - Further MCP Server integration [#398](https://github.com/ahdis/matchbox/issues/398)
diff --git a/pom.xml b/pom.xml
index 59414e08f19..041bb859539 100644
--- a/pom.xml
+++ b/pom.xml
@@ -80,7 +80,7 @@
 
         <!-- Other dependencies we need -->
         <lombok_version>1.18.36</lombok_version>
-        <tomcat_embed_version>10.1.44</tomcat_embed_version>
+        <tomcat_embed_version>10.1.48</tomcat_embed_version>
         <postgresql_version>42.7.7</postgresql_version>
         <h2_version>2.3.232</h2_version>
         <jakarta_servlet_version>6.1.0</jakarta_servlet_version>