@@ -2,6 +2,11 @@
 All notable changes to this project will be documented in this file.
 This project adheres to [Semantic Versioning](http://semver.org/).
 
+# [9.15.0]
+- Voice: Added `returnCpsOnStarted` to `Call.Builder` (`return_cps_on_started`) to request calls per second (CPS) usage and limit data in the `started` event webhook
+- Voice: Added `getCpsRegionUsage()`, `getCpsGlobalUsage()` and `getCpsLimit()` to `EventWebhook` for the new `started` event CPS fields
+- Dependencies: Bumped Jackson from 2.22.0 to 2.22.2 to address `jackson-databind` security advisories (GHSA-q4xh-88c3-wmh7, GHSA-gx83-3vf8-gh7j, GHSA-wjgm-6hv5-3cvf, GHSA-vvgp-rfg2-7rr6, GHSA-5gvw-p9qm-jgwh, GHSA-5jmj-h7xm-6q6v)
+
 # [9.14.0]
 - Auth: Added public `RequestSigning.verifyRequestSignature(InputStream, String, Map, String, HashType)` overload, so callers can verify signed callbacks (e.g. SMS) using a non-MD5 algorithm such as `HMAC_SHA256`. Previously the only publicly accessible overload was hardcoded to `HashType.MD5` and the algorithm-aware overload was package-private. Existing overloads are unchanged and still default to MD5
 
 
@@ -83,7 +83,7 @@ Add the following to your `build.gradle` or `build.gradle.kts` file:
 
 ```groovy
 dependencies {
-    implementation("com.vonage:server-sdk:9.14.0")
+    implementation("com.vonage:server-sdk:9.15.0")
 }
 ```
 
@@ -94,7 +94,7 @@ Add the following to the `<dependencies>` section of your `pom.xml` file:
 <dependency>
     <groupId>com.vonage</groupId>
     <artifactId>server-sdk</artifactId>
-    <version>9.14.0</version>
+    <version>9.15.0</version>
 </dependency>
 ```
 
 
@@ -5,7 +5,7 @@
 
   <groupId>com.vonage</groupId>
   <artifactId>server-sdk</artifactId>
-  <version>9.14.0</version>
+  <version>9.15.0</version>
 
   <name>Vonage Java Server SDK</name>
   <description>Java client for Vonage APIs</description>
@@ -46,7 +46,7 @@
     <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
     <nexusUrl>https://central.sonatype.com</nexusUrl>
     <mockito.version>5.23.0</mockito.version>
-    <jackson.version>2.22.0</jackson.version>
+    <jackson.version>2.22.2</jackson.version>
     <jjwt.version>0.12.6</jjwt.version>
   </properties>
 
 
@@ -44,7 +44,7 @@ public class HttpWrapper {
 
     private static final String
             CLIENT_NAME = "vonage-java-sdk",
-            CLIENT_VERSION = "9.14.0",
+            CLIENT_VERSION = "9.15.0",
             JAVA_VERSION = System.getProperty("java.version"),
             USER_AGENT = String.format("%s/%s java/%s", CLIENT_NAME, CLIENT_VERSION, JAVA_VERSION);
 
 
@@ -36,7 +36,7 @@ public class Call extends JsonableBaseObject {
     private MachineDetection machineDetection;
     private AdvancedMachineDetection advancedMachineDetection;
     private Integer lengthTimer, ringingTimer;
-    private Boolean fromRandomNumber;
+    private Boolean fromRandomNumber, returnCpsOnStarted;
     private Collection<? extends Action> ncco;
 
     /**
@@ -66,6 +66,7 @@ else if ((fromRandomNumber = builder.fromRandomNumber) != null && fromRandomNumb
         answerUrl = builder.answerUrl != null ? Collections.singletonList(URI.create(builder.answerUrl)) : null;
         eventUrl = builder.eventUrl != null ? Collections.singletonList(URI.create(builder.eventUrl)) : null;
         ncco = builder.ncco;
+        returnCpsOnStarted = builder.returnCpsOnStarted;
         advancedMachineDetection = builder.advancedMachineDetection;
         if ((machineDetection = builder.machineDetection) != null && advancedMachineDetection != null) {
             throw new IllegalStateException("Cannot set both machineDetection and advancedMachineDetection.");
@@ -232,6 +233,20 @@ public Boolean getFromRandomNumber() {
         return fromRandomNumber;
     }
 
+    /**
+     * Whether the {@code started} event webhook will include calls per second (CPS) usage and limit data
+     * ({@code cps_region_usage}, {@code cps_global_usage} and {@code cps_limit}).
+     *
+     * @return {@code true} if CPS data will be included in the {@code started} event,
+     * or {@code null} if unspecified (the default, equivalent to {@code false}).
+     *
+     * @since 9.15.0
+     */
+    @JsonProperty("return_cps_on_started")
+    public Boolean getReturnCpsOnStarted() {
+        return returnCpsOnStarted;
+    }
+
     /**
      * Gets the NCCOs to use for this call.
      *
@@ -265,7 +280,7 @@ public static class Builder {
         private MachineDetection machineDetection;
         private AdvancedMachineDetection advancedMachineDetection;
         private Integer lengthTimer, ringingTimer;
-        private Boolean fromRandomNumber;
+        private Boolean fromRandomNumber, returnCpsOnStarted;
         private Collection<Action> ncco;
 
         Builder() {}
@@ -422,6 +437,22 @@ public Builder fromRandomNumber(boolean fromRandomNumber) {
             return this;
         }
 
+        /**
+         * Set to {@code true} to include calls per second (CPS) usage and limit data in the {@code started}
+         * event webhook. When enabled, the event will contain {@code cps_region_usage}, {@code cps_global_usage}
+         * and {@code cps_limit}. When omitted or {@code false}, the {@code started} event is unchanged.
+         *
+         * @param returnCpsOnStarted Whether to include CPS data in the {@code started} event.
+         *
+         * @return This builder.
+         *
+         * @since 9.15.0
+         */
+        public Builder returnCpsOnStarted(boolean returnCpsOnStarted) {
+            this.returnCpsOnStarted = returnCpsOnStarted;
+            return this;
+        }
+
         /**
          * Sets the actions to take on the call.
          *
 
@@ -40,7 +40,7 @@ public class EventWebhook extends JsonableBaseObject {
     private DtmfResult dtmf;
     private SpeechResults speech;
     private Instant timestamp, startTime, endTime;
-    private Integer duration, size, sipCode;
+    private Integer duration, size, sipCode, cpsRegionUsage, cpsGlobalUsage, cpsLimit;
     private Double rate, price;
     private URI recordingUrl;
     private String to, from, network, reason,
@@ -310,6 +310,45 @@ public Integer getSipCode() {
         return sipCode;
     }
 
+    /**
+     * Calls per second (CPS) in use within the region at the time the call was created. This is only present
+     * on {@linkplain CallStatus#STARTED} events when the call was created with
+     * {@link Call.Builder#returnCpsOnStarted(boolean)} set to {@code true}.
+     *
+     * @return The regional CPS usage, or {@code null} if not applicable.
+     * @since 9.15.0
+     */
+    @JsonProperty("cps_region_usage")
+    public Integer getCpsRegionUsage() {
+        return cpsRegionUsage;
+    }
+
+    /**
+     * Calls per second (CPS) in use across all regions at the time the call was created. This is only present
+     * on {@linkplain CallStatus#STARTED} events when the call was created with
+     * {@link Call.Builder#returnCpsOnStarted(boolean)} set to {@code true}.
+     *
+     * @return The global CPS usage, or {@code null} if not applicable.
+     * @since 9.15.0
+     */
+    @JsonProperty("cps_global_usage")
+    public Integer getCpsGlobalUsage() {
+        return cpsGlobalUsage;
+    }
+
+    /**
+     * Maximum calls per second (CPS) configured for the account. This is only present
+     * on {@linkplain CallStatus#STARTED} events when the call was created with
+     * {@link Call.Builder#returnCpsOnStarted(boolean)} set to {@code true}.
+     *
+     * @return The account's CPS limit, or {@code null} if not applicable.
+     * @since 9.15.0
+     */
+    @JsonProperty("cps_limit")
+    public Integer getCpsLimit() {
+        return cpsLimit;
+    }
+
     /**
      * Constructs an instance, populating this class's fields from the JSON string.
      *
 
@@ -429,6 +429,30 @@ public void testSipHeader() {
         assertThrows(IllegalArgumentException.class, () -> SipHeader.fromString("unknown"));
     }
 
+    @Test
+    public void testToJsonReturnCpsOnStarted() {
+        Call.Builder builder = Call.builder().to(new PhoneEndpoint("4477999000"))
+                .from("44111222333").answerUrl("https://callback.example.com/");
+        String prefix = "{\"to\":[{\"number\":\"4477999000\",\"type\":\"phone\"}],"
+                + "\"from\":{\"number\":\"44111222333\",\"type\":\"phone\"},"
+                + "\"answer_method\":\"GET\",\"answer_url\":[\"https://callback.example.com/\"]";
+
+        Call enabled = builder.returnCpsOnStarted(true).build();
+        assertTrue(enabled.getReturnCpsOnStarted());
+        assertEquals(prefix + ",\"return_cps_on_started\":true}", enabled.toJson());
+
+        Call disabled = builder.returnCpsOnStarted(false).build();
+        assertFalse(disabled.getReturnCpsOnStarted());
+        assertEquals(prefix + ",\"return_cps_on_started\":false}", disabled.toJson());
+    }
+
+    @Test
+    public void testReturnCpsOnStartedOmittedByDefault() {
+        Call call = Call.builder().to(new VbcEndpoint("123")).build();
+        assertNull(call.getReturnCpsOnStarted());
+        assertFalse(call.toJson().contains("return_cps_on_started"));
+    }
+
     @Test
     public void testNulllAnswerMethod() {
         Call call = Call.builder().to(new VbcEndpoint("123"))
 
@@ -155,6 +155,9 @@ public void testSerdesAllFields() {
     public void testParseEmptyJson() {
         EventWebhook event = EventWebhook.fromJson("{}");
         testJsonableBaseObject(event);
+        assertNull(event.getCpsRegionUsage());
+        assertNull(event.getCpsGlobalUsage());
+        assertNull(event.getCpsLimit());
         assertNull(event.getDetail());
         assertNull(event.getCallUuid());
         assertNull(event.getReason());
@@ -273,5 +276,26 @@ public void testEventWithoutSipCode() {
         EventWebhook event = EventWebhook.fromJson(json);
         assertEquals(CallStatus.STARTED, event.getStatus());
         assertNull(event.getSipCode());
+        assertNull(event.getCpsRegionUsage());
+        assertNull(event.getCpsGlobalUsage());
+        assertNull(event.getCpsLimit());
+    }
+
+    @Test
+    public void testStartedEventWithCpsFields() {
+        String json = "{\"from\":\"442079460000\",\"to\":\"447700900000\"," +
+                "\"uuid\":\"aaaaaaaa-bbbb-cccc-dddd-0123456789ab\"," +
+                "\"conversation_uuid\":\"CON-aaaaaaaa-bbbb-cccc-dddd-0123456789ab\"," +
+                "\"status\":\"started\",\"direction\":\"outbound\"," +
+                "\"timestamp\":\"2020-01-01T12:00:00.000Z\"," +
+                "\"cps_region_usage\":1,\"cps_global_usage\":0,\"cps_limit\":3}";
+        EventWebhook event = EventWebhook.fromJson(json);
+        testJsonableBaseObject(event);
+        assertEquals(CallStatus.STARTED, event.getStatus());
+        assertEquals(CallDirection.OUTBOUND, event.getDirection());
+        assertEquals("aaaaaaaa-bbbb-cccc-dddd-0123456789ab", event.getCallUuid());
+        assertEquals(1, event.getCpsRegionUsage());
+        assertEquals(0, event.getCpsGlobalUsage());
+        assertEquals(3, event.getCpsLimit());
     }
 }