Skip to content

Comments

Update all non-major maven dependencies#8

Open
renovate[bot] wants to merge 1 commit intomasterfrom
renovate/all-maven-minor-patch
Open

Update all non-major maven dependencies#8
renovate[bot] wants to merge 1 commit intomasterfrom
renovate/all-maven-minor-patch

Conversation

@renovate
Copy link

@renovate renovate bot commented Feb 15, 2025 •
edited
Loading

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
org.springframework.boot:spring-boot-starter-validation (source) 3.3.1 → 3.5.11 age confidence
org.springframework:spring-core 6.1.6 → 6.2.16 age confidence
org.springframework:spring-web 6.1.6 → 6.1.21 age confidence
jakarta.validation:jakarta.validation-api (source) 3.0.2 → 3.1.1 age confidence
com.fasterxml.jackson.datatype:jackson-datatype-jsr310 2.14.0 → 2.21.1 age confidence
com.fasterxml.jackson.core:jackson-databind (source) 2.14.0 → 2.21.1 age confidence
net.logstash.logback:logstash-logback-encoder 7.1.1 → 7.4 age confidence
ch.qos.logback:logback-classic (source, changelog) 1.2.11 → 1.2.13 age confidence
ch.qos.logback:logback-core (source, changelog) 1.2.11 → 1.5.25 age confidence
org.projectlombok:lombok (source) 1.18.36 → 1.18.42 age confidence
commons-codec:commons-codec (source) 1.15 → 1.21.0 age confidence
org.apache.commons:commons-lang3 (source) 3.12.0 → 3.18.0 age confidence

GitHub Vulnerability Alerts

CVE-2024-38809

Description

Applications that parse ETags from If-Match or If-None-Match request headers are vulnerable to DoS attack.

Affected Spring Products and Versions

org.springframework:spring-web in versions

6.1.0 through 6.1.11
6.0.0 through 6.0.22
5.3.0 through 5.3.37

Older, unsupported versions are also affected

Mitigation

Users of affected versions should upgrade to the corresponding fixed version.
6.1.x -> 6.1.12
6.0.x -> 6.0.23
5.3.x -> 5.3.38
No other mitigation steps are necessary.

Users of older, unsupported versions could enforce a size limit on If-Match and If-None-Match headers, e.g. through a Filter.

CVE-2024-38820

The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive. However, String.toLowerCase() has some Locale dependent exceptions that could potentially result in fields not protected as expected.

CVE-2025-41234

Description

In Spring Framework, versions 6.0.x as of 6.0.5, versions 6.1.x and 6.2.x, an application is vulnerable to a reflected file download (RFD) attack when it sets a “Content-Disposition” header with a non-ASCII charset, where the filename attribute is derived from user-supplied input.

Specifically, an application is vulnerable when all the following are true:

  • The header is prepared with org.springframework.http.ContentDisposition.
  • The filename is set via ContentDisposition.Builder#filename(String, Charset).
  • The value for the filename is derived from user-supplied input.
  • The application does not sanitize the user-supplied input.
  • The downloaded content of the response is injected with malicious commands by the attacker (see RFD paper reference for details).

An application is not vulnerable if any of the following is true:

  • The application does not set a “Content-Disposition” response header.
  • The header is not prepared with org.springframework.http.ContentDisposition.
  • The filename is set via one of:
    • ContentDisposition.Builder#filename(String), or
    • ContentDisposition.Builder#filename(String, ASCII)
  • The filename is not derived from user-supplied input.
  • The filename is derived from user-supplied input but sanitized by the application.
  • The attacker cannot inject malicious content in the downloaded content of the response.

Affected Spring Products and VersionsSpring Framework

  • 6.2.0 - 6.2.7
  • 6.1.0 - 6.1.20
  • 6.0.5 - 6.0.28
  • Older, unsupported versions are not affected

Mitigation

Users of affected versions should upgrade to the corresponding fixed version.

Affected version(s) Fix version Availability
6.2.x 6.2.8 OSS
6.1.x 6.1.21 OSS
6.0.x 6.0.29 Commercial

No further mitigation steps are necessary.

CVE-2023-6378

A serialization vulnerability in logback receiver component part of logback allows an attacker to mount a Denial-Of-Service attack by sending poisoned data.

This is only exploitable if logback receiver component is deployed. See https://logback.qos.ch/manual/receivers.html

CVE-2024-12798

ACE vulnerability in JaninoEventEvaluator by QOS.CH logback-core up to and including version 1.5.12 in Java applications allows attackers to execute arbitrary code by compromising an existing logback configuration file or by injecting an environment variable before program execution.

Malicious logback configuration files can allow the attacker to execute arbitrary code using the JaninoEventEvaluator extension.

A successful attack requires the user to have write access to a configuration file. Alternatively, the attacker could inject a malicious environment variable pointing to a malicious configuration file. In both cases, the attack requires existing privilege.

CVE-2024-12801

Server-Side Request Forgery (SSRF) in SaxEventRecorder by QOS.CH logback version 1.5.12 on the Java platform, allows an attacker to forge requests by compromising logback configuration files in XML.

The attacks involves the modification of DOCTYPE declaration in  XML configuration files.

CVE-2025-11226

QOS.CH logback-core versions up to 1.5.18 contain an ACE vulnerability in conditional configuration file processing in Java applications. This vulnerability allows an attacker to execute arbitrary code by compromising an existing logback configuration file or by injecting a malicious environment variable before program execution.

A successful attack requires the Janino library and Spring Framework to be present on the user's class path. Additionally, the attacker must have write access to a configuration file. Alternatively, the attacker could inject a malicious environment variable pointing to a malicious configuration file. In both cases, the attack requires existing privileges.

CVE-2026-1225

ACE vulnerability in configuration file processing by QOS.CH logback-core up to and including version 1.5.24 in Java applications, allows an attacker to instantiate classes already present on the class path by compromising an existing logback configuration file.

The instantiation of a potentially malicious Java class requires that said class is present on the user's class-path. In addition, the attacker must have write access to a configuration file. However, after successful instantiation, the instance is very likely to be discarded with no further ado.

CVE-2025-48924

Uncontrolled Recursion vulnerability in Apache Commons Lang.

This issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0.

The methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a StackOverflowError could cause an application to stop.

Users are recommended to upgrade to version 3.18.0, which fixes the issue.

Release Notes

spring-projects/spring-boot (org.springframework.boot:spring-boot-starter-validation)

v3.5.11

Compare Source

🐞 Bug Fixes

  • Whitespace can be incorrectly removed when spring-boot-configuration-processor runs on multi-line javadoc #​49039
  • server.jetty.threads.max is ignored when using virtual threads #​48982
  • Docker credential helpers with file extensions cannot be executed on Windows #​48965

📔 Documentation

  • Couchbase and Kafka are incorrectly listed as supporting SSL with Docker Compose #​49211
  • Document that use of non idiomatic format for '@Value' still apply for environment variables #​49054
  • Document naming convention for custom test-scoped starters #​49014
  • LICENSE.txt and NOTICE.txt files have the wrong content in the latest releases #​48996
  • ApplicationContextAssert documents a non-existent assertion in getFailure() #​48973
  • Highlight the importance of the preStop hook when configuring Kubernetes probes #​48936

🔨 Dependency Upgrades

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​dsyer, @​linkian209, @​nosan, @​quaff, @​scordio, and @​srt

v3.5.10

Compare Source

🐞 Bug Fixes

  • Evaluation of bean conditions unnecessarily queries the bean factory for types that are not present #​48836
  • When a bean condition references a type that is not present, it appears as ? in the condition evaluation report #​48835
  • Actuator /info endpoint fails in Java 25 Native Image (VirtualThreadSchedulerMXBean support) #​48810
  • DataSourceBuilder cannot create oracle.ucp.jdbc.PoolDataSourceImpl in a native image #​48702
  • Application JAR created by extract command is not reproductible #​48664
  • AOT processing of tests should not be disabled when 'skipTests' is set #​48661
  • Fix zero-length byte buffer in InspectedContent #​48649

📔 Documentation

  • Update documentation for Buildpack's AOT Cache support #​48768
  • Document support for configuring arguments passed to Docker Compose #​48657
  • Clarify javadoc to make it clear that HazelcastConfigCustomizer beans are only applied if Hazelcast is configured via a config file #​48634
  • Fix grammar and typos in the reference guide #​48596

🔨 Dependency Upgrades

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​GaoSSR, @​izeye, and @​ngocnhan-tran1996

v3.5.9

Compare Source

🐞 Bug Fixes

  • RabbitHealthIndicator reports an error when version is missing from the connection's server properties #​48486
  • Profiles retained during AOT processing are not configured in a native image #​48475
  • NullPointerException in UndertowWebServer.destroy() when using @DirtiesContext and Citrus Spring Boot Simulator #​48450
  • Redis health check reports an error when redis_version is missing from the INFO response #​48326
  • Parent's MeterRegistry beans are closed when child context closes #​48324
  • SpringBootTest.UseMainMethod.WHEN_AVAILABLE and ALWAYS are incompatible with package-private or parameter-less main method #​48271

📔 Documentation

  • Documentation has an outdated reference to the Jackson Kotlin Module #​48533
  • Caching documentation should clarify how to use a no-op implementation to run a test suite #​48531
  • Document that the default rolling policy for Log4j2 requires logging.file.path to be set #​48526
  • License header in build samples is displayed in the reference documentation #​48477
  • Configuring Two DataSources How-To code sample is inconsistent #​48448
  • Improve javadoc for when to use class names rather than class references #​48395
  • Document that org.aspectj.weaver.Advice must be on the classpath to enable support for Micrometer's annotations #​48359
  • Polish TestRestTemplate examples in the reference guide #​48335
  • Fix links to javadoc in the reference documentation #​48299
  • Clarify that @EnableBatchProcessing turns off all batch auto-configuration, including schema initialization #​48265
  • Kotlin auto-configuration examples are not annotated with @AutoConfiguration #​48227
  • Infinispan Cache Documentation is outdated #​48217
  • Revise "Use Liquibase for test-only migrations" section in reference manual #​48169

🔨 Dependency Upgrades

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​banseok1216, @​berry120, @​dmitrysulman, @​geopark021, @​noojung, @​scottfrederick, @​vpavic, and @​youngledo

v3.5.8

Compare Source

⚠️ Noteworthy changes

🐞 Bug Fixes

  • Gradle war task does not exclude starter POMs from lib-provided #​48196
  • Testcontainers integration fails on Docker 29.0.0 #​48192
  • SslMeterBinder doesn't register metrics for dynamically added bundles if no bundles exist at bind time #​48180
  • Properties bound in the child management context ignore the parent's environment prefix #​48176
  • ssl.chain.expiry metrics doesn't update for dynamically registered SSL bundles #​48153
  • Auto-configuration exclusions are checked using a different class loader to the one that loads auto-configuration classes #​48129
  • New arm64 macbooks fail to bootBuildImage due to incorrect platform image #​48127
  • NullPointerException when using @ConditionalOnSingleCandidate with multiple manually registered singletons #​48123
  • Buildpack fails with recent Docker installs due to hardcoded version in URL #​48102
  • Image building may fail when specifying a platform if an image has already been built with a different platform #​48098
  • Undertow's ServletContext is destroy too early, making it unusable in @PreDestroy methods #​48061
  • PortInUseException incorrectly thrown on failure to bind port due to Netty IP misconfiguration #​48058
  • Auto-configured JCacheMetrics cannot be customized #​48056
  • WebSecurityCustomizer beans are excluded by WebMvcTest #​48054
  • Devtools Restarter does not work with a parameterless main method #​47987
  • Setting 'max-uri-tags' does not prevent unlimited meter growth on any AutoConfiguredCompositeMeterRegistry #​47923
  • Docker response 407 is not handled correctly resulting in no error message #​47900
  • spring-boot-maven-plugin process-aot goal does not find package-private main method #​47780

📔 Documentation

  • Revise AWS section of "Deploying to the Cloud" in reference manual #​48156
  • Fix typo in PortInUseException Javadoc #​48133
  • Correct section about required setters in "Type-safe Configuration Properties" #​48130
  • Document EndpointObjectMapper and management.endpoints.jackson.isolated-object-mapper #​48114
  • Document support for configuring servlet context init parameters using properties #​48111
  • Clarify how warnings about soon-to-expire SSL certificates are reported #​48062
  • Document how to use ContextPropagatingTaskDecorator for propagating trace context over thread boundaries #​48052
  • Use since attribute in configuration properties deprecation consistently #​47980
  • BootstrapContext#getOrElseThrow has incorrect reference to IllegalStateException #​47905
  • Clarify when BootstrapContext get methods may return null rather than throwing an exception or calling the fallback supplier #​47898
  • Document that Actuator endpoint may have at most one extension of each type #​47873
  • Limit Kotlin API documentation to Kotlin-specific APIs #​47859
  • Adapt AOTCache documentation to JEP 514 #​47274

🔨 Dependency Upgrades

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​K-jun98, @​TerryTaoYY, @​hojooo, @​linw-bai, @​mipo256, @​namest504, @​ngocnhan-tran1996, @​nosan, @​scottfrederick, @​siva-sai-udaygiri, @​tschut, and @​vpavic

v3.5.7

Compare Source

⭐ New Features

  • Add TWENTY_FIVE to JavaVersion enum #​47609

🐞 Bug Fixes

  • Signed jar verification fails when nested in an uber war running on an Oracle JVM #​47771
  • In an uber war, value of the Sbom-Location manifest attribute does not match the SBOM's actual location #​47737
  • Homebrew formula for the CLI should use libexec #​47722
  • When virtual threads are enabled, embedded Jetty does not use recommended virtual thread configuration #​47717
  • ClientHttpRequestFactoryRuntimeHints is missing timeout methods with Duration overloads #​47678
  • OnBeanCondition no longer correctly finds annotations on scoped target proxy beans #​47635
  • JavaVersion doesn't work reliably in native-image #​47620
  • LiquibaseEndpoint always uses defaultSchema instead of liquibaseSchema #​47346
  • Launcher fails to find main method when it is parameterless #​47311
  • Package private Main class using Java 25 is not found by build plugins #​47309
  • Bitnami legacy images are not automatically detected #​47275
  • Maven plugin does not provide an easy way to exclude optional dependencies from uber jar #​25403

📔 Documentation

  • Some spring.test.* properties are not documented #​47775
  • Dependency management for Maven AntRun Plugin is missing changelog link #​47744
  • Developing Your First Spring Boot Application has outdated tools #​47700
  • Include deprecated configuration properties in the reference documentation #​47669
  • Aggregated Javadoc should link to the proper version of JakartaEE #​47593
  • Update javadoc of TestRestTemplate following change to redirect behavior #​47474
  • Use non-deprecated syntax to configure sourceCompatibility #​47343
  • Fix link to Framework's @Bean annotation #​47330
  • Update managed dependency version override examples in documentation #​47306

🔨 Dependency Upgrades

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​DKARAGODIN, @​JinhyeokFang, @​Lublanski, @​Pankraz76, @​fhiyo, @​ngocnhan-tran1996, @​nosan, @​scottfrederick, and @​xyraclius

v3.5.6

Compare Source

🐞 Bug Fixes

  • Quoted -D arguments break system property resolution on Linux with Spring AOT #​47166
  • Groovy Templates fails with an NPE when rendering an auto new line #​47139
  • available() does not behave correctly when reading stored entries from a NestedJarFile #​47057
  • spring-boot-docker-compose doesn't create service connections when image has registry host but not project #​47019
  • Flyway Ignore Migration Patterns setting can't be set to an empty string #​47013

📔 Documentation

  • Default value of server.tomcat.resource.cache-ttl is not documented #​47253
  • Document Java 25 support #​47245
  • Fix links to Flyway reference documentation #​46988
  • Clarify Javadoc of Customizer interfaces about overriding behavior #​46942

🔨 Dependency Upgrades

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​Chanwon-Seo, @​doljae, @​izeye, and @​quaff

v3.5.5

Compare Source

🐞 Bug Fixes

  • Hazelcast health indicator reports the wrong status when Hazelcast has shut down due to an out-of-memory error #​46909
  • Performance critical tracing code has high overhead due to the use of the Stream API #​46844
  • SpringLiquibaseCustomizer is exposed outside its defined visibility scope #​46758
  • Race condition in OutputCapture can result in stale data #​46721
  • Auto-configured WebClient no longer uses context's ReactorResourceFactory #​46673
  • Default value not detected for a field annoted with @Name #​46666
  • Missing metadata when using @Name with a constructor-bound property #​46663
  • Missing property for Spring Authorization Server's PAR endpoint #​46641
  • Property name is incorrect when reporting a mis-configured OAuth 2 Resource Server JWT public key location #​46636
  • Memory not freed on context restart in JpaMetamodel#CACHE with spring.main.lazy-initialization=true #​46634
  • Auto-configured MockMvc ignores @FilterRegistration annotation #​46605
  • Failure to discover default value for a primitive should not lead to document its default value #​46561

📔 Documentation

  • Kotlin samples for configuration metadata are in the wrong package #​46857
  • Observability examples in the reference guide are missing the Kotlin version [#​46798](https://redirect.g

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot requested a review from a team as a code owner February 15, 2025 11:20
@renovate renovate bot force-pushed the renovate/all-maven-minor-patch branch from a98df02 to 9ecdf2c Compare February 22, 2025 00:07
@renovate renovate bot force-pushed the renovate/all-maven-minor-patch branch 3 times, most recently from 4b1ff84 to a2244b0 Compare March 4, 2025 10:43
@renovate renovate bot force-pushed the renovate/all-maven-minor-patch branch from a2244b0 to b5f9c5f Compare March 22, 2025 03:37
@renovate renovate bot force-pushed the renovate/all-maven-minor-patch branch from b5f9c5f to afd831f Compare April 2, 2025 00:16
@renovate renovate bot force-pushed the renovate/all-maven-minor-patch branch from afd831f to a2b32e0 Compare April 25, 2025 04:15
@renovate renovate bot force-pushed the renovate/all-maven-minor-patch branch 3 times, most recently from a5bfcf8 to 5f0b378 Compare May 29, 2025 09:49
@renovate renovate bot force-pushed the renovate/all-maven-minor-patch branch from 5f0b378 to 40b8e14 Compare June 14, 2025 19:56
@renovate renovate bot force-pushed the renovate/all-maven-minor-patch branch from 40b8e14 to 0c9f678 Compare June 22, 2025 04:04
@renovate renovate bot force-pushed the renovate/all-maven-minor-patch branch from 0c9f678 to 1f35bdb Compare July 12, 2025 19:58
@renovate renovate bot force-pushed the renovate/all-maven-minor-patch branch from 1f35bdb to bd56d59 Compare July 26, 2025 08:09
@renovate renovate bot force-pushed the renovate/all-maven-minor-patch branch from bd56d59 to 4df91d2 Compare August 14, 2025 08:01
@renovate renovate bot force-pushed the renovate/all-maven-minor-patch branch from 4df91d2 to 2050dd1 Compare August 23, 2025 08:02
@renovate renovate bot force-pushed the renovate/all-maven-minor-patch branch 2 times, most recently from 7656fbf to fba6152 Compare September 5, 2025 23:36
@renovate renovate bot force-pushed the renovate/all-maven-minor-patch branch 3 times, most recently from 0c97198 to cad27d5 Compare September 19, 2025 11:59
@renovate renovate bot force-pushed the renovate/all-maven-minor-patch branch 2 times, most recently from 42e2729 to a3617f0 Compare October 26, 2025 07:50
@renovate renovate bot force-pushed the renovate/all-maven-minor-patch branch 2 times, most recently from 9276797 to 262e4c9 Compare November 8, 2025 11:48
@renovate renovate bot force-pushed the renovate/all-maven-minor-patch branch from 262e4c9 to 58009b5 Compare November 20, 2025 15:11
@renovate renovate bot force-pushed the renovate/all-maven-minor-patch branch 2 times, most recently from 89f5575 to 7509fff Compare December 19, 2025 07:37
@renovate renovate bot force-pushed the renovate/all-maven-minor-patch branch from 7509fff to b2b8b83 Compare January 20, 2026 11:49
@renovate renovate bot force-pushed the renovate/all-maven-minor-patch branch from b2b8b83 to 6b3c70d Compare January 23, 2026 07:23
@renovate renovate bot force-pushed the renovate/all-maven-minor-patch branch from 6b3c70d to 8999423 Compare January 30, 2026 12:05
@renovate renovate bot force-pushed the renovate/all-maven-minor-patch branch from 8999423 to 86df21c Compare February 20, 2026 03:44
@renovate renovate bot force-pushed the renovate/all-maven-minor-patch branch from 86df21c to 86d6656 Compare February 24, 2026 05:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants