From 0bbc8627a3f2dbcbab937ab5f9b14668df50c0d7 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 31 Jul 2026 12:29:33 +0000 Subject: [PATCH 1/3] USPR-13800: enforce patched Spring Expression version for GHSA-r5w3-xv2f-j59q Add a resolutionStrategy override to root build.gradle forcing org.springframework:spring-expression to 7.0.8 or higher, following the existing pattern used for jackson/logback/tomcat/netty security floors. Fixes Dependabot alert 128 (Spring Expression Language Algorithmic DoS). --- build.gradle | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/build.gradle b/build.gradle index bc36fb5..96f200e 100644 --- a/build.gradle +++ b/build.gradle @@ -58,6 +58,12 @@ subprojects { 'GHSA-mvh2-crg5-v77c: multiple Netty vulnerabilities, including SPDY zlib header block continues decoded expansion ' + 'after maxHeaderSize truncation, fixed in 4.2.16.Final') } + if (requested.group == 'org.springframework' && requested.name == 'spring-expression' + && requested.version != null && requested.version < '7.0.8') { + useVersion('7.0.8') + because('GHSA-r5w3-xv2f-j59q: Spring Expression Language (SpEL) Algorithmic Denial of Service ' + + 'via crafted expressions causing excessive resource consumption, fixed in 7.0.8') + } } } From ca57a93f91583fbbde40d774e3f5bf477fb1c276 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 31 Jul 2026 12:37:22 +0000 Subject: [PATCH 2/3] USPR-13800: bump example spring-framework.version override and add verification task Add ext['spring-framework.version'] = '7.0.8' to both example subprojects' build.gradle to close the BOM-precedence gap where spring-dependency-management's managed version otherwise overrides the root resolutionStrategy floor. Also add a verifySpringExpressionVersion Gradle task, wired into `check` for every subproject, that fails the build if org.springframework:spring-expression resolves below 7.0.8 anywhere in the dependency graph. --- build.gradle | 18 ++++++++++++++++++ .../build.gradle | 1 + .../build.gradle | 1 + 3 files changed, 20 insertions(+) diff --git a/build.gradle b/build.gradle index 96f200e..34365f1 100644 --- a/build.gradle +++ b/build.gradle @@ -124,4 +124,22 @@ subprojects { consoleOutput = true ruleSets = ["$rootDir/ruleset.xml"] } + + tasks.register('verifySpringExpressionVersion') { + doLast { + configurations.findAll { it.canBeResolved }.each { config -> + config.incoming.resolutionResult.allDependencies.each { dep -> + if (dep instanceof org.gradle.api.artifacts.result.ResolvedDependencyResult) { + def id = dep.selected.moduleVersion + if (id != null && id.group == 'org.springframework' && id.name == 'spring-expression' + && id.version < '7.0.8') { + throw new GradleException("org.springframework:spring-expression resolved to ${id.version} in configuration ${config.name}, but must be >= 7.0.8 (GHSA-r5w3-xv2f-j59q)") + } + } + } + } + } + } + + tasks.named('check') { dependsOn tasks.named('verifySpringExpressionVersion') } } diff --git a/examples/example-spring-boot-starter-web/build.gradle b/examples/example-spring-boot-starter-web/build.gradle index 6f5b6d6..89eff0b 100644 --- a/examples/example-spring-boot-starter-web/build.gradle +++ b/examples/example-spring-boot-starter-web/build.gradle @@ -10,6 +10,7 @@ ext['jackson-2-bom.version'] = '2.21.5' ext['logback.version'] = '1.5.34' ext['netty.version'] = '4.2.16.Final' ext['tomcat.version'] = '11.0.22' +ext['spring-framework.version'] = '7.0.8' dependencies { implementation project(':examples:examples-common') diff --git a/examples/example-spring-boot-starter-webflux/build.gradle b/examples/example-spring-boot-starter-webflux/build.gradle index 94c60a6..32c62b5 100644 --- a/examples/example-spring-boot-starter-webflux/build.gradle +++ b/examples/example-spring-boot-starter-webflux/build.gradle @@ -10,6 +10,7 @@ ext['jackson-2-bom.version'] = '2.21.5' ext['logback.version'] = '1.5.34' ext['netty.version'] = '4.2.16.Final' ext['tomcat.version'] = '11.0.22' +ext['spring-framework.version'] = '7.0.8' dependencies { implementation project(':examples:examples-common') From 4b2ec5258e98e9333d5e87aa79db3f57be373c00 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 31 Jul 2026 12:45:27 +0000 Subject: [PATCH 3/3] USPR-13800: fix CI wiring for verifySpringExpressionVersion and dedupe version constant Wire verifySpringExpressionVersion into the `test` task (in addition to `check`) so it actually executes as part of this repo's CI, which invokes `test` directly rather than the `check` lifecycle task. Also extract the 7.0.8 floor into a single local variable within build.gradle to avoid duplicating the version literal across the resolutionStrategy block and the verification task. --- build.gradle | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/build.gradle b/build.gradle index 34365f1..c3e88ad 100644 --- a/build.gradle +++ b/build.gradle @@ -23,6 +23,8 @@ allprojects { } subprojects { + def springExpressionMinVersion = '7.0.8' + configurations.configureEach { resolutionStrategy.eachDependency { if (requested.group == 'tools.jackson.core' @@ -59,10 +61,10 @@ subprojects { 'after maxHeaderSize truncation, fixed in 4.2.16.Final') } if (requested.group == 'org.springframework' && requested.name == 'spring-expression' - && requested.version != null && requested.version < '7.0.8') { - useVersion('7.0.8') + && requested.version != null && requested.version < springExpressionMinVersion) { + useVersion(springExpressionMinVersion) because('GHSA-r5w3-xv2f-j59q: Spring Expression Language (SpEL) Algorithmic Denial of Service ' + - 'via crafted expressions causing excessive resource consumption, fixed in 7.0.8') + 'via crafted expressions causing excessive resource consumption, fixed in ' + springExpressionMinVersion) } } } @@ -132,8 +134,8 @@ subprojects { if (dep instanceof org.gradle.api.artifacts.result.ResolvedDependencyResult) { def id = dep.selected.moduleVersion if (id != null && id.group == 'org.springframework' && id.name == 'spring-expression' - && id.version < '7.0.8') { - throw new GradleException("org.springframework:spring-expression resolved to ${id.version} in configuration ${config.name}, but must be >= 7.0.8 (GHSA-r5w3-xv2f-j59q)") + && id.version < springExpressionMinVersion) { + throw new GradleException("org.springframework:spring-expression resolved to ${id.version} in configuration ${config.name}, but must be >= ${springExpressionMinVersion} (GHSA-r5w3-xv2f-j59q)") } } } @@ -141,5 +143,6 @@ subprojects { } } + tasks.named('test') { dependsOn tasks.named('verifySpringExpressionVersion') } tasks.named('check') { dependsOn tasks.named('verifySpringExpressionVersion') } }