diff --git a/Dockerfile b/Dockerfile
index db1ecf72..df2bda3c 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -72,7 +72,7 @@ COPY --from=builder $depDir $depDir
# remove reference to missing repo
RUN rm /etc/apt/sources.list.d/apache-arrow.sources
-RUN apt-get update --fix-missing && apt-get install -y openjdk-19-jdk && rm -rf /var/lib/apt/lists/*
+RUN apt-get update --fix-missing && apt-get install -y openjdk-21-jdk && rm -rf /var/lib/apt/lists/*
RUN apt update --fix-missing
RUN DEBIAN_FRONTEND=noninteractive TZ=Etc/UTC apt install -y p7zip-full python3-pip time mpich parallel libgeos-dev expect tmux rsync tzdata
diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md
index 35de89ae..9408bece 100644
--- a/docs/CHANGELOG.md
+++ b/docs/CHANGELOG.md
@@ -1,6 +1,16 @@
All notable changes to this project will be documented in this file.
We follow the [Semantic Versioning 2.0.0](http://semver.org/) format.
+## v4.5.x.x - 2024-07-10 - [PR#1211](https://github.com/NOAA-OWP/inundation-mapping/pull/1211)
+
+Upgrades JDK in docker image to v21.0.3. Whether or not this resolves #1208 depends on if this passes ITSG's security vulnerability scan. A docker system prune (e.g., `docker system prune -a --volumes`) should be done on all environments prior to the scan.
+
+### Changes
+
+- `Dockerfile`: Changes JDK version from 19 to 21.
+
+
+
## v4.5.2.5 - 2024-07-08 - [PR#1205](https://github.com/NOAA-OWP/inundation-mapping/pull/1205)
Snaps crosswalk from the midpoint of DEM-derived reaches to the nearest point on NWM streams within a threshold of 100 meters. DEM-derived streams that do not locate any NWM streams within 100 meters of their midpoints are removed from the FIM hydrofabric and their catchments are not inundated.
@@ -11,7 +21,6 @@ Snaps crosswalk from the midpoint of DEM-derived reaches to the nearest point on
-
## v4.5.2.4 - 2024-07-08 - [PR#1204](https://github.com/NOAA-OWP/inundation-mapping/pull/1204)
Bug fix for extending outlets in order to ensure proper flow direction in depression filling algorithm. This PR adds a distance criteria that in order for the end of an outlet stream to be snapped to the wbd_buffered boundary, the end point must be less than 100 meters from the WBD boundary.