From b8e157625e1ecada70a8b7ed0612d31cda6a0e2b Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 31 Jul 2026 12:31:20 +0000 Subject: [PATCH 1/2] fix(deps): pin spring-webmvc and spring-webflux minimum version to 7.0.8 (GHSA-h3qp-gqrc-q736) Co-Authored-By: Catarina Correia --- build.gradle | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/build.gradle b/build.gradle index bc36fb5..991dcef 100644 --- a/build.gradle +++ b/build.gradle @@ -58,6 +58,16 @@ subprojects { 'GHSA-mvh2-crg5-v77c: multiple Netty vulnerabilities, including SPDY zlib header block continues decoded expansion ' + 'after maxHeaderSize truncation, fixed in 4.2.16.Final') } + if (requested.group == 'org.springframework' && requested.name == 'spring-webmvc' + && requested.version != null && requested.version < '7.0.8') { + useVersion('7.0.8') + because('GHSA-h3qp-gqrc-q736: Open Redirect vulnerability in Spring Framework (Spring MVC), fixed in 7.0.8') + } + if (requested.group == 'org.springframework' && requested.name == 'spring-webflux' + && requested.version != null && requested.version < '7.0.8') { + useVersion('7.0.8') + because('GHSA-h3qp-gqrc-q736: Open Redirect vulnerability in Spring Framework (Spring WebFlux), fixed in 7.0.8') + } } } From 012de1783dfae47110ad2c2085a1279c584718b7 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 31 Jul 2026 12:34:58 +0000 Subject: [PATCH 2/2] fix(deps): pin spring-framework version to 7.0.8 in example apps (GHSA-h3qp-gqrc-q736) Add ext['spring-framework.version'] override in both example Spring Boot apps (example-spring-boot-starter-web and example-spring-boot-starter-webflux), in lockstep with the resolutionStrategy floor added for spring-webmvc and spring-webflux in the root build.gradle. These examples use the Spring Dependency Management plugin's strict BOM import, which is not affected by resolutionStrategy.eachDependency and requires its own ext[] property override to move the floor, following the same pattern already used there for jackson, logback, netty and tomcat. Co-Authored-By: Catarina Correia --- examples/example-spring-boot-starter-web/build.gradle | 1 + examples/example-spring-boot-starter-webflux/build.gradle | 1 + 2 files changed, 2 insertions(+) diff --git a/examples/example-spring-boot-starter-web/build.gradle b/examples/example-spring-boot-starter-web/build.gradle index 6f5b6d6..89eff0b 100644 --- a/examples/example-spring-boot-starter-web/build.gradle +++ b/examples/example-spring-boot-starter-web/build.gradle @@ -10,6 +10,7 @@ ext['jackson-2-bom.version'] = '2.21.5' ext['logback.version'] = '1.5.34' ext['netty.version'] = '4.2.16.Final' ext['tomcat.version'] = '11.0.22' +ext['spring-framework.version'] = '7.0.8' dependencies { implementation project(':examples:examples-common') diff --git a/examples/example-spring-boot-starter-webflux/build.gradle b/examples/example-spring-boot-starter-webflux/build.gradle index 94c60a6..32c62b5 100644 --- a/examples/example-spring-boot-starter-webflux/build.gradle +++ b/examples/example-spring-boot-starter-webflux/build.gradle @@ -10,6 +10,7 @@ ext['jackson-2-bom.version'] = '2.21.5' ext['logback.version'] = '1.5.34' ext['netty.version'] = '4.2.16.Final' ext['tomcat.version'] = '11.0.22' +ext['spring-framework.version'] = '7.0.8' dependencies { implementation project(':examples:examples-common')