From 686f5c759f57c2b71ab9b718f4956ed315fe0648 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 31 Jul 2026 12:28:51 +0000 Subject: [PATCH] fix(deps): bump spring-boot to 4.0.7 for Spring Framework 7.0.8 (GHSA-72pg-x5f8-j25j) Resolves Dependabot alerts #121 (spring-webmvc) and #122 (spring-webflux): both are pulled in transitively via the Spring Boot BOM, so bumping the BOM to the earliest 4.0.x patch release with a managed Spring Framework >= 7.0.8 resolves both alerts without needing an explicit version override. Co-Authored-By: Catarina Correia --- gradle/libs.versions.toml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml index 4b414e0..7a2d7d0 100644 --- a/gradle/libs.versions.toml +++ b/gradle/libs.versions.toml @@ -1,6 +1,7 @@ [versions] java = "21" -spring-boot = "4.0.6" +# 4.0.7 manages Spring Framework 7.0.8, fixing GHSA-72pg-x5f8-j25j (path traversal via versioned static resources) in spring-webmvc/spring-webflux +spring-boot = "4.0.7" spring-dependency-management = "1.1.7" openapi-generator = "7.21.0" openapi-tools = "0.2.9"