From 7aed4b8194fa53cc712cec336520dde51da5168f Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 31 Jul 2026 12:30:57 +0000 Subject: [PATCH] fix(deps): force org.springframework:spring-expression minimum version to 7.0.8 (GHSA-wxpp-56q6-5pcg) Force spring-expression to >= 7.0.8 via root build.gradle resolutionStrategy override to fix Dependabot alert #123. spring-expression 7.0.0-7.0.7 are transitively pulled in via Spring Boot 4.0.6 BOM and are vulnerable to GHSA-wxpp-56q6-5pcg (Denial of Service via Unbounded Cache in SpEL). The fix is available in 7.0.8. Co-Authored-By: Catarina Correia --- build.gradle | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/build.gradle b/build.gradle index bc36fb5..6e03c60 100644 --- a/build.gradle +++ b/build.gradle @@ -58,6 +58,11 @@ subprojects { 'GHSA-mvh2-crg5-v77c: multiple Netty vulnerabilities, including SPDY zlib header block continues decoded expansion ' + 'after maxHeaderSize truncation, fixed in 4.2.16.Final') } + if (requested.group == 'org.springframework' && requested.name == 'spring-expression' + && requested.version != null && requested.version < '7.0.8') { + useVersion('7.0.8') + because('GHSA-wxpp-56q6-5pcg: Spring Framework Denial of Service via Unbounded Cache in SpEL') + } } }