From dcdeb6ad61be6982b69807e9adbf805eeec65197 Mon Sep 17 00:00:00 2001
From: Vladimir Aseev <vladimir.aseev@sap.com>
Date: Wed, 2 Sep 2026 10:43:05 +0200
Subject: [PATCH 1/7] fix spring cves

---
 pom.xml | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/pom.xml b/pom.xml
index 8a39d97fe..03ed1d385 100644
--- a/pom.xml
+++ b/pom.xml
@@ -67,6 +67,9 @@
     <surefire.version>3.5.6</surefire.version>
     <spring-ai.version>1.1.8</spring-ai.version>
     <spring-expressions.version>7.0.9</spring-expressions.version>
+    <spring-core.version>7.0.9</spring-core.version>
+    <spring-beans.version>7.0.9</spring-beans.version>
+    <spring-messaging.version>7.0.9</spring-messaging.version>
     <reactor-core.version>3.8.7</reactor-core.version>
     <dotenv-java.version>3.2.0</dotenv-java.version>
     <mockito.version>5.23.0</mockito.version>
@@ -202,6 +205,23 @@
         <artifactId>spring-expression</artifactId>
         <version>${spring-expressions.version}</version>
       </dependency>
+      <!-- CVE-2026-CVE-2026-59313, CVE-2026-47892, CVE-2026-47893, CVE-2026-59283 >= 7.0.9 until we migrate to spring-ai 2 -->
+      <dependency>
+        <groupId>org.springframework</groupId>
+        <artifactId>spring-beans</artifactId>
+        <version>${spring-beans.version}</version>
+      </dependency>
+      <dependency>
+        <groupId>org.springframework</groupId>
+        <artifactId>spring-core</artifactId>
+        <version>${spring-core.version}</version>
+      </dependency>
+      <dependency>
+        <groupId>org.springframework</groupId>
+        <artifactId>spring-messaging</artifactId>
+        <version>${spring-messaging.version}</version>
+      </dependency>
+
       <!-- CVE-2026-54428, 54399, 71290: pin httpcore5-h2, httpcore5 >= 5.6.4 until httpclient5 (pulled via cloud-sdk openapi-core-apache) ships with fixed versions -->
       <dependency>
         <groupId>org.apache.httpcomponents.core5</groupId>

From 6a94ddd827cc8f6b9a35dc3ca1fefdefd5b7544f Mon Sep 17 00:00:00 2001
From: Vladimir Aseev <vladimir.aseev@sap.com>
Date: Wed, 2 Sep 2026 10:53:23 +0200
Subject: [PATCH 2/7] fix spring cves

---
 pom.xml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pom.xml b/pom.xml
index 03ed1d385..20243425c 100644
--- a/pom.xml
+++ b/pom.xml
@@ -66,6 +66,7 @@
     <system-stubs.version>2.1.3</system-stubs.version>
     <surefire.version>3.5.6</surefire.version>
     <spring-ai.version>1.1.8</spring-ai.version>
+    <spring-aop.version>7.0.9</spring-aop.version>
     <spring-expressions.version>7.0.9</spring-expressions.version>
     <spring-core.version>7.0.9</spring-core.version>
     <spring-beans.version>7.0.9</spring-beans.version>
@@ -206,6 +207,11 @@
         <version>${spring-expressions.version}</version>
       </dependency>
       <!-- CVE-2026-CVE-2026-59313, CVE-2026-47892, CVE-2026-47893, CVE-2026-59283 >= 7.0.9 until we migrate to spring-ai 2 -->
+      <dependency>
+        <groupId>org.springframework</groupId>
+        <artifactId>spring-aop</artifactId>
+        <version>${spring-aop.version}</version>
+      </dependency>
       <dependency>
         <groupId>org.springframework</groupId>
         <artifactId>spring-beans</artifactId>

From f84a57d539b6b9331cf99db95594ef5d65e81366 Mon Sep 17 00:00:00 2001
From: Vladimir Aseev <vladimir.aseev@sap.com>
Date: Wed, 2 Sep 2026 12:33:44 +0200
Subject: [PATCH 3/7] fix spring cves

---
 .github/workflows/fosstars-report.yml | 2 +-
 pom.xml                               | 6 ++++++
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/fosstars-report.yml b/.github/workflows/fosstars-report.yml
index 05bff71b5..ed6b068c0 100644
--- a/.github/workflows/fosstars-report.yml
+++ b/.github/workflows/fosstars-report.yml
@@ -86,7 +86,7 @@ jobs:
           token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: 'Slack Notification'
-        if: failure()
+        if: false # failure()
         uses: slackapi/slack-github-action@v4.0.0
         with:
           webhook: ${{ secrets.SLACK_WEBHOOK }}
diff --git a/pom.xml b/pom.xml
index 20243425c..74f4f72de 100644
--- a/pom.xml
+++ b/pom.xml
@@ -67,6 +67,7 @@
     <surefire.version>3.5.6</surefire.version>
     <spring-ai.version>1.1.8</spring-ai.version>
     <spring-aop.version>7.0.9</spring-aop.version>
+    <spring-context.version>7.0.9</spring-context.version>
     <spring-expressions.version>7.0.9</spring-expressions.version>
     <spring-core.version>7.0.9</spring-core.version>
     <spring-beans.version>7.0.9</spring-beans.version>
@@ -207,6 +208,11 @@
         <version>${spring-expressions.version}</version>
       </dependency>
       <!-- CVE-2026-CVE-2026-59313, CVE-2026-47892, CVE-2026-47893, CVE-2026-59283 >= 7.0.9 until we migrate to spring-ai 2 -->
+      <dependency>
+        <groupId>org.springframework</groupId>
+        <artifactId>spring-context</artifactId>
+        <version>${spring-context.version}</version>
+      </dependency>
       <dependency>
         <groupId>org.springframework</groupId>
         <artifactId>spring-aop</artifactId>

From 9d26ad3740837fbb89505e3c652901ac22b63c65 Mon Sep 17 00:00:00 2001
From: Vladimir Aseev <vladimir.aseev@sap.com>
Date: Wed, 2 Sep 2026 13:02:09 +0200
Subject: [PATCH 4/7] fix spring cves

---
 .github/workflows/fosstars-report.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/fosstars-report.yml b/.github/workflows/fosstars-report.yml
index ed6b068c0..05bff71b5 100644
--- a/.github/workflows/fosstars-report.yml
+++ b/.github/workflows/fosstars-report.yml
@@ -86,7 +86,7 @@ jobs:
           token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: 'Slack Notification'
-        if: false # failure()
+        if: failure()
         uses: slackapi/slack-github-action@v4.0.0
         with:
           webhook: ${{ secrets.SLACK_WEBHOOK }}

From d9c8bdb6ea2b823433b3ad946ec0609caf3ac015 Mon Sep 17 00:00:00 2001
From: Vladimir Aseev <vladimir.aseev@sap.com>
Date: Wed, 2 Sep 2026 13:10:44 +0200
Subject: [PATCH 5/7] fix spring cves

---
 .github/workflows/fosstars-report.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/fosstars-report.yml b/.github/workflows/fosstars-report.yml
index 05bff71b5..855de1700 100644
--- a/.github/workflows/fosstars-report.yml
+++ b/.github/workflows/fosstars-report.yml
@@ -86,7 +86,7 @@ jobs:
           token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: 'Slack Notification'
-        if: failure()
+        if: github.ref_name == 'main' && failure()
         uses: slackapi/slack-github-action@v4.0.0
         with:
           webhook: ${{ secrets.SLACK_WEBHOOK }}

From 46e2cbf11cdadf73d8adadcdc59e6d836c2f7beb Mon Sep 17 00:00:00 2001
From: Vladimir Aseev <vladimir.aseev@sap.com>
Date: Wed, 2 Sep 2026 13:18:44 +0200
Subject: [PATCH 6/7] fix spring cves

---
 pom.xml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/pom.xml b/pom.xml
index 74f4f72de..d04a73a97 100644
--- a/pom.xml
+++ b/pom.xml
@@ -201,13 +201,12 @@
         <version>${jackson.version}</version>
       </dependency>
       <!-- conflicts resolution scope "compile" -->
-      <!-- CVE-2026-59283: pin spring-expression >= 7.0.9 until we migrate to spring-ai 2 -->
+      <!-- CVE-2026-CVE-2026-59313, 47892, 47893, 59283 >= 7.0.9 until we migrate to spring-ai 2 -->
       <dependency>
         <groupId>org.springframework</groupId>
         <artifactId>spring-expression</artifactId>
         <version>${spring-expressions.version}</version>
       </dependency>
-      <!-- CVE-2026-CVE-2026-59313, CVE-2026-47892, CVE-2026-47893, CVE-2026-59283 >= 7.0.9 until we migrate to spring-ai 2 -->
       <dependency>
         <groupId>org.springframework</groupId>
         <artifactId>spring-context</artifactId>

From 7b9eac61aec05dbe49471276240f6ded7284b034 Mon Sep 17 00:00:00 2001
From: Vladimir Aseev <vladimir.aseev@sap.com>
Date: Wed, 2 Sep 2026 13:20:01 +0200
Subject: [PATCH 7/7] fix spring cves

---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index d04a73a97..2c941409d 100644
--- a/pom.xml
+++ b/pom.xml
@@ -201,7 +201,7 @@
         <version>${jackson.version}</version>
       </dependency>
       <!-- conflicts resolution scope "compile" -->
-      <!-- CVE-2026-CVE-2026-59313, 47892, 47893, 59283 >= 7.0.9 until we migrate to spring-ai 2 -->
+      <!-- CVE-2026-CVE-2026-59313, 47892, 47893, 59283 pin spring deps >= 7.0.9 until we migrate to spring-ai 2 -->
       <dependency>
         <groupId>org.springframework</groupId>
         <artifactId>spring-expression</artifactId>