From d8cbdc427e220cdec085ba76558eca2a5c59e6b4 Mon Sep 17 00:00:00 2001 From: Justin Beckwith Date: Mon, 20 Jul 2026 13:24:21 -0700 Subject: [PATCH 1/2] build(deps): patch Spring Boot starter dependencies --- openai-java-spring-boot-starter/build.gradle.kts | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/openai-java-spring-boot-starter/build.gradle.kts b/openai-java-spring-boot-starter/build.gradle.kts index 10b131609..cf2d6aa1c 100644 --- a/openai-java-spring-boot-starter/build.gradle.kts +++ b/openai-java-spring-boot-starter/build.gradle.kts @@ -9,6 +9,9 @@ repositories { dependencies { constraints { + implementation("org.springframework:spring-expression:5.3.39") { + because("5.3.39 fixes CVE-2024-38808 in Spring Boot's transitive runtime") + } testImplementation("org.xmlunit:xmlunit-core:2.11.0") { because("2.10.0 fixes CVE-2024-31573 in this test-only dependency") } @@ -19,6 +22,12 @@ dependencies { version { strictly("1.7.36") } because("Spring Boot 2.7 and Logback 1.2 require SLF4J 1.7 at test runtime") } + testImplementation("ch.qos.logback:logback-classic:1.2.13") { + because("1.2.13 fixes vulnerabilities in Spring Boot's test logging stack") + } + testImplementation("ch.qos.logback:logback-core:1.2.13") { + because("1.2.13 fixes vulnerabilities in Spring Boot's test logging stack") + } } api(project(":openai-java")) From d9cf1e49d35b055e0e03564fa83f43c702c388ad Mon Sep 17 00:00:00 2001 From: Justin Beckwith Date: Mon, 20 Jul 2026 14:17:45 -0700 Subject: [PATCH 2/2] build(deps): limit patch to test-only Logback --- openai-java-spring-boot-starter/build.gradle.kts | 3 --- 1 file changed, 3 deletions(-) diff --git a/openai-java-spring-boot-starter/build.gradle.kts b/openai-java-spring-boot-starter/build.gradle.kts index cf2d6aa1c..a7c4cfa6d 100644 --- a/openai-java-spring-boot-starter/build.gradle.kts +++ b/openai-java-spring-boot-starter/build.gradle.kts @@ -9,9 +9,6 @@ repositories { dependencies { constraints { - implementation("org.springframework:spring-expression:5.3.39") { - because("5.3.39 fixes CVE-2024-38808 in Spring Boot's transitive runtime") - } testImplementation("org.xmlunit:xmlunit-core:2.11.0") { because("2.10.0 fixes CVE-2024-31573 in this test-only dependency") }