diff --git a/com.ibm.streamsx.elasticsearch/CHANGELOG.md b/com.ibm.streamsx.elasticsearch/CHANGELOG.md
new file mode 100644
index 0000000..a1fcb60
--- /dev/null
+++ b/com.ibm.streamsx.elasticsearch/CHANGELOG.md
@@ -0,0 +1,16 @@
+# Changes
+==========
+
+
+## v2.1.6
+* [#58](https://github.com/IBMStreams/streamsx.elasticsearch/issues/58) Third-party lib updated to resolve security vulnerabilities (commons-codec: 1.14)
+
+## v2.1.5:
+* [#55](https://github.com/IBMStreams/streamsx.elasticsearch/issues/55) Update messages_ja_JP.properties
+
+## v2.1.4:
+* Minor fixes in samples and test scripts
+
+## v2.1.3:
+* [#47](https://github.com/IBMStreams/streamsx.elasticsearch/issues/47) Globalization support
+
diff --git a/com.ibm.streamsx.elasticsearch/info.xml b/com.ibm.streamsx.elasticsearch/info.xml
index 32d5d25..9d123e8 100644
--- a/com.ibm.streamsx.elasticsearch/info.xml
+++ b/com.ibm.streamsx.elasticsearch/info.xml
@@ -23,6 +23,10 @@ The Elasticsearch toolkit is an open source IBM Streams toolkit that provides ad
 
 This is an overview of changes for major and minor version upgrades. For details see the Releases in public Github.
 
+++ What is changed in version 2.1.6
+
+* Third-party lib updated to resolve security vulnerabilities (commons-codec: 1.14)
+
 ++ What is changed in version 2.1.5
 
 * Globalization support: Messages updated
@@ -90,7 +94,7 @@ as they constitute serious security holes.
   you can use this parameter to temporarily disable hostnam verification.
 
 ]]></info:description>
-    <info:version>2.1.5</info:version>
+    <info:version>2.1.6</info:version>
     <info:requiredProductVersion>4.2.0.0</info:requiredProductVersion>
   </info:identity>
   <info:dependencies/>
diff --git a/com.ibm.streamsx.elasticsearch/pom.xml b/com.ibm.streamsx.elasticsearch/pom.xml
index 244987b..bccba05 100644
--- a/com.ibm.streamsx.elasticsearch/pom.xml
+++ b/com.ibm.streamsx.elasticsearch/pom.xml
@@ -14,7 +14,7 @@
     <dependency>
 		<groupId>commons-codec</groupId>
 		<artifactId>commons-codec</artifactId>
-		<version>1.11</version>
+		<version>1.14</version>
     </dependency>
 	<!-- https://mvnrepository.com/artifact/com.google.guava/guava -->
 	<dependency>