From 5d9dfd40b148c2d52e6f6d8f033d312313a31027 Mon Sep 17 00:00:00 2001 From: Juliusz Skowron Date: Wed, 15 Jul 2026 11:05:39 +0200 Subject: [PATCH] Bump Spring Boot to 3.5.16 to remediate app.war CVEs Moves the spring-boot-dependencies BOM from 3.4.10 to 3.5.16, which transitively pulls the fixed tomcat-embed-core 10.1.55 and jackson-bom 2.21.4, and fixes the spring-boot temp-file CVE. This clears all 12 Trivy findings (3 Critical, 9 High) reported in opt/app/app.war: - tomcat-embed-core 10.1.46 -> 10.1.55 CVE-2026-41293, CVE-2026-43512, CVE-2026-43515 (Critical) CVE-2026-24734, CVE-2026-24880, CVE-2026-34483, CVE-2026-41284, CVE-2026-42498, CVE-2026-43513 (High) (also covers Scout-only CVE-2026-29145, CVE-2026-34487) - jackson-databind 2.18.4 -> 2.21.x CVE-2026-54512, CVE-2026-54513 (High) - spring-boot 3.4.10 -> 3.5.16 CVE-2026-40973 (High) springdoc-openapi 2.3.0 -> 2.8.6 and swagger-annotations 2.2.20 -> 2.2.31 are required companions for Spring Boot 3.5.x compatibility. Co-authored-by: Cursor --- buildSrc/src/main/kotlin/Versions.kt | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/buildSrc/src/main/kotlin/Versions.kt b/buildSrc/src/main/kotlin/Versions.kt index 4c6eab9..7d367b0 100644 --- a/buildSrc/src/main/kotlin/Versions.kt +++ b/buildSrc/src/main/kotlin/Versions.kt @@ -6,7 +6,9 @@ object Versions { // Latest Version: // Visit https://central.sonatype.com and search for: g:org.springframework.boot a:spring-boot - const val springBoot = "3.4.10" + // 3.5.16 BOM pulls fixed tomcat-embed-core 10.1.55 and jackson-bom 2.21.4, + // and fixes spring-boot CVE-2026-40973. Do not drop below 3.5.15 (3.5.14 still ships tomcat 10.1.54). + const val springBoot = "3.5.16" object Plugins { @@ -30,7 +32,8 @@ object Versions { // Latest Version: // Visit https://central.sonatype.com and search for: g:org.springdoc a:springdoc-openapi-starter-webmvc-ui - const val openApi = "2.3.0" + // 2.8.x required for Spring Boot 3.5.x compatibility (2.3.0 targets Spring Boot 3.2). + const val openApi = "2.8.6" // Latest Version: // Visit https://central.sonatype.com and search for: g:javax.servlet a:javax.servlet-api @@ -42,7 +45,7 @@ object Versions { // Latest Version: // Visit https://central.sonatype.com and search for: g:io.swagger.core.v3 a:swagger-project - const val swagger = "2.2.20" + const val swagger = "2.2.31" // https://search.maven.org/artifact/org.apache.tomcat.embed/tomcat-embed-core // We can't use 9.0.31+ until this is resolved: