chore: bump Spring Boot to 4.1.1 and pin PostgreSQL 42.7.12 (Dependabot security) - #94
Merged
Merged
Conversation
Clears 6 Dependabot alerts by moving to patched dependency versions. None were reachable in this demo, so this is supply-chain hygiene, not an active vulnerability fix. Spring Boot 4.1.0 -> 4.1.1 pulls patched managed BOMs: - jackson-databind 2.21.4 -> 2.21.5 (GHSA-5gvw-p9qm-jgwh #72, GHSA-mhm7-754m-9p8w #69, GHSA-5jmj-h7xm-6q6v #58) - tools.jackson jackson-databind 3.1.4 -> 3.1.5 (GHSA-5gvw-p9qm-jgwh #73) - log4j-api 2.25.4 -> 2.25.5 (GHSA-qv9r-c865-cp47 #96) PostgreSQL is not bumped by the 4.1.1 BOM (still 42.7.11), so pin it explicitly: ext['postgresql.version'] = '42.7.12' fixes the channel-binding downgrade GHSA-j92g-9f8w-j867 (#66). The demo defaults to MariaDB and never opens a Postgres connection. The 3 Apache HttpComponents alerts (#94, #95, #97) are stale: those artifacts are absent from every resolved configuration and were never in the repo or its git history. They clear on the next dependency-graph submission to main. Verified: dependencyInsight resolves all four to the patched versions; ./gradlew test passes (312 tests, 0 failures, 0 errors). Claude-Session: https://claude.ai/code/session_01EJY7pA4NvY9vJt6CfDBVWt
Contributor
There was a problem hiding this comment.
Copilot wasn't able to review any files in this pull request.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Clears 6 of the 9 open Dependabot alerts by moving to patched dependency versions. None of the nine is reachable in this demo app (verified by source analysis), so this is supply-chain hygiene rather than an active-vulnerability fix.
Changes
4.1.0→4.1.1— pulls patched managed BOMs:jackson-databind2.21.4 → 2.21.5 (fixes Upgrade to SpringUserFramework 4.4.0 #72 GHSA-5gvw-p9qm-jgwh, Refactor Docker Compose file naming to avoid V2 precedence conflict #69 GHSA-mhm7-754m-9p8w, feat: Add RegistrationGuard SPI demo (invite-code example) #58 GHSA-5jmj-h7xm-6q6v)tools.jacksonjackson-databind3.1.4 → 3.1.5 (fixes docs: document RegistrationGuard SPI demo (closes #58) #73 GHSA-5gvw-p9qm-jgwh)log4j-api2.25.4 → 2.25.5 (fixes #96 GHSA-qv9r-c865-cp47)ext['postgresql.version'] = '42.7.12'— the 4.1.1 BOM still manages 42.7.11, so pin the patched driver explicitly (fixes Add Claude Code GitHub Workflow #66 GHSA-j92g-9f8w-j867, high — silent channel-binding auth downgrade).Reachability (why none is an active fix)
@JsonView,@JsonUnwrapped,@JsonTypeInfo/EXTERNAL_PROPERTY, per-property@JsonIgnoreProperties); Boot's default mapper is case-sensitive. Only its own DTOs are deserialized.log4j-apiis present only as thelog4j-to-slf4jbridge target; the app logs through Logback, there's nolog4j-core, and nothing touches the vulnerableMapMessageJSON path.jdbc:postgresqlanywhere, and nochannelBinding/SCRAM/SSL config. The CVE needschannelBinding=requireover TLS plus an active MITM.Not addressed here (stale, no code change)
The 3 Apache HttpComponents alerts (#94, #95, #97) reference
httpclient5/httpcore5/httpcore5-h2, which are absent from every resolved configuration and were never in the repo or its git history — a transitive of an older dependency the current tree no longer pulls. They clear on the next Automatic Dependency Submission tomain; dismiss manually as "vulnerable code not present" if they linger.Testing
dependencyInsightconfirms all four now resolve to the patched versions../gradlew testpasses: 312 tests, 0 failures, 0 errors (182 profile/container-gated tests skipped, as usual).https://claude.ai/code/session_01EJY7pA4NvY9vJt6CfDBVWt