From 56485556c685dc12477dd93a77c0182efb97f30e Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 31 Jul 2026 12:31:03 +0000 Subject: [PATCH 1/2] fix(deps): pin org.springframework:spring-expression to 7.0.8 (GHSA-9f52-rjqv-25qv) Co-Authored-By: Catarina Correia --- build.gradle | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/build.gradle b/build.gradle index bc36fb5..5a272cf 100644 --- a/build.gradle +++ b/build.gradle @@ -58,6 +58,11 @@ subprojects { 'GHSA-mvh2-crg5-v77c: multiple Netty vulnerabilities, including SPDY zlib header block continues decoded expansion ' + 'after maxHeaderSize truncation, fixed in 4.2.16.Final') } + if (requested.group == 'org.springframework' && requested.name == 'spring-expression' + && requested.version != null && requested.version < '7.0.8') { + useVersion('7.0.8') + because('GHSA-9f52-rjqv-25qv: Spring Framework Arbitrary Method Invocation in SpEL Expressions') + } } } From fad0ebe871c1e8349fe60faaf1527461a72bb01e Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 31 Jul 2026 12:40:59 +0000 Subject: [PATCH 2/2] fix(deps): pin spring-framework.version to 7.0.8 in examples (GHSA-9f52-rjqv-25qv) Co-Authored-By: Catarina Correia --- examples/example-spring-boot-starter-web/build.gradle | 1 + examples/example-spring-boot-starter-webflux/build.gradle | 1 + 2 files changed, 2 insertions(+) diff --git a/examples/example-spring-boot-starter-web/build.gradle b/examples/example-spring-boot-starter-web/build.gradle index 6f5b6d6..89eff0b 100644 --- a/examples/example-spring-boot-starter-web/build.gradle +++ b/examples/example-spring-boot-starter-web/build.gradle @@ -10,6 +10,7 @@ ext['jackson-2-bom.version'] = '2.21.5' ext['logback.version'] = '1.5.34' ext['netty.version'] = '4.2.16.Final' ext['tomcat.version'] = '11.0.22' +ext['spring-framework.version'] = '7.0.8' dependencies { implementation project(':examples:examples-common') diff --git a/examples/example-spring-boot-starter-webflux/build.gradle b/examples/example-spring-boot-starter-webflux/build.gradle index 94c60a6..32c62b5 100644 --- a/examples/example-spring-boot-starter-webflux/build.gradle +++ b/examples/example-spring-boot-starter-webflux/build.gradle @@ -10,6 +10,7 @@ ext['jackson-2-bom.version'] = '2.21.5' ext['logback.version'] = '1.5.34' ext['netty.version'] = '4.2.16.Final' ext['tomcat.version'] = '11.0.22' +ext['spring-framework.version'] = '7.0.8' dependencies { implementation project(':examples:examples-common')