From f475fc6b05323e11966c9f316e429c661985f451 Mon Sep 17 00:00:00 2001 From: Devon Hillard Date: Mon, 24 Aug 2026 14:37:35 -0600 Subject: [PATCH] chore: bump Spring Boot to 4.1.1 and pin PostgreSQL 42.7.12 for security Clears 6 Dependabot alerts by moving to patched dependency versions. None were reachable in this demo, so this is supply-chain hygiene, not an active vulnerability fix. Spring Boot 4.1.0 -> 4.1.1 pulls patched managed BOMs: - jackson-databind 2.21.4 -> 2.21.5 (GHSA-5gvw-p9qm-jgwh #72, GHSA-mhm7-754m-9p8w #69, GHSA-5jmj-h7xm-6q6v #58) - tools.jackson jackson-databind 3.1.4 -> 3.1.5 (GHSA-5gvw-p9qm-jgwh #73) - log4j-api 2.25.4 -> 2.25.5 (GHSA-qv9r-c865-cp47 #96) PostgreSQL is not bumped by the 4.1.1 BOM (still 42.7.11), so pin it explicitly: ext['postgresql.version'] = '42.7.12' fixes the channel-binding downgrade GHSA-j92g-9f8w-j867 (#66). The demo defaults to MariaDB and never opens a Postgres connection. The 3 Apache HttpComponents alerts (#94, #95, #97) are stale: those artifacts are absent from every resolved configuration and were never in the repo or its git history. They clear on the next dependency-graph submission to main. Verified: dependencyInsight resolves all four to the patched versions; ./gradlew test passes (312 tests, 0 failures, 0 errors). Claude-Session: https://claude.ai/code/session_01EJY7pA4NvY9vJt6CfDBVWt --- build.gradle | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/build.gradle b/build.gradle index df8fdf5..9a4ad97 100644 --- a/build.gradle +++ b/build.gradle @@ -1,6 +1,6 @@ plugins { id 'java' - id 'org.springframework.boot' version '4.1.0' + id 'org.springframework.boot' version '4.1.1' id 'io.spring.dependency-management' version '1.1.7' id "com.github.ben-manes.versions" version "0.61.0" @@ -15,6 +15,12 @@ java { } } +// Force the patched PostgreSQL JDBC driver ahead of the Spring Boot 4.1.1 BOM (which still manages +// 42.7.11). 42.7.12 fixes GHSA-j92g-9f8w-j867 (silent channel-binding auth downgrade). The demo defaults +// to MariaDB and never opens a Postgres connection, so this is supply-chain hygiene rather than an active +// fix; drop this override once a future Boot BOM manages 42.7.12+. +ext['postgresql.version'] = '42.7.12' + // Define the configurations used in the project configurations { // Keep developmentOnly out of runtimeOnly, and so out of the boot jar. spring-boot-docker-compose