This is an automated email from the ASF dual-hosted git repository.
yesamer pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/incubator-kie.git
The following commit(s) were added to refs/heads/main by this push:
new a200b792f50 [NO-ISSUE] spring patch version upgrade for Security
fixes. (#7086)
a200b792f50 is described below
commit a200b792f5067cd70dc7aa724bc1fc3b687e289a
Author: Jijo Thomas K <[email protected]>
AuthorDate: Mon Sep 7 20:57:09 2026 +0530
[NO-ISSUE] spring patch version upgrade for Security fixes. (#7086)
* spring patch version upgrade
* removing companian upgrades
* corrected the comment
---------
Co-authored-by: Jijo Thomas K <[email protected]>
---
kogito-springboot/bom/pom.xml | 12 ++++--------
optaplanner-build/optaplanner-build-parent/pom.xml | 4 ++--
2 files changed, 6 insertions(+), 10 deletions(-)
diff --git a/kogito-springboot/bom/pom.xml b/kogito-springboot/bom/pom.xml
index 80a5a7456eb..f54627cdec2 100644
--- a/kogito-springboot/bom/pom.xml
+++ b/kogito-springboot/bom/pom.xml
@@ -36,17 +36,13 @@
<allowedPomsList>org.kie.kogito:kogito-spring-boot-bom</allowedPomsList>
<!-- Aligned with Spring Boot Cloud (spring-cloud-kubernetes-fabric8 5.0.1
declares fabric8 7.4.0) -->
<version.io.fabric8>7.4.0</version.io.fabric8>
- <version.io.netty>4.2.16.Final</version.io.netty>
+ <version.io.netty>4.2.17.Final</version.io.netty>
<version.jakarta.servlet>6.0.0</version.jakarta.servlet>
<!-- This is needed to override the default version inherited from
kie-parent-drools -->
- <version.mongodb-driver-sync>5.6.4</version.mongodb-driver-sync>
+ <version.mongodb-driver-sync>5.6.5</version.mongodb-driver-sync>
<version.org.springdoc>2.8.13</version.org.springdoc>
- <version.org.springframework>7.0.8</version.org.springframework>
- <version.org.springframework.boot>4.0.7</version.org.springframework.boot>
- <!-- Spring Boot Cloud aligned with Spring Boot Framework version. See:
https://spring.io/projects/spring-cloud -->
- <!-- 2025.1.x (Oakwood) is the first Spring Cloud train compatible with
Spring Boot 4.0.x;
- 2025.1.1 specifically targets Spring Boot 4.0.1+. -->
- <!--
https://github.com/spring-cloud/spring-cloud-release/wiki/Spring-Cloud-2025.1-Release-Notes
-->
+ <version.org.springframework>7.0.9</version.org.springframework>
+ <version.org.springframework.boot>4.0.8</version.org.springframework.boot>
<version.org.springframework.cloud>2025.1.1</version.org.springframework.cloud>
<!-- CVE-2026-49844: Spring Boot 4.0.7 sets log4j2.version=2.25.4 which is
vulnerable.
Override the version property inherited from kie-parent to 2.26.1
(minimum 2.25.5).
diff --git a/optaplanner-build/optaplanner-build-parent/pom.xml
b/optaplanner-build/optaplanner-build-parent/pom.xml
index df11b380c81..331ceda345f 100644
--- a/optaplanner-build/optaplanner-build-parent/pom.xml
+++ b/optaplanner-build/optaplanner-build-parent/pom.xml
@@ -64,8 +64,8 @@
<version.org.eclipse.parsson>1.1.8</version.org.eclipse.parsson>
<!-- CVE-2026-56624: Apache MINA SSHD fixed version -->
<version.org.apache.sshd>2.19.0</version.org.apache.sshd>
- <version.org.springframework>7.0.8</version.org.springframework>
- <version.org.springframework.boot>4.0.7</version.org.springframework.boot>
+ <version.org.springframework>7.0.9</version.org.springframework>
+ <version.org.springframework.boot>4.0.8</version.org.springframework.boot>
<version.com.fasterxml.jackson.databind>2.22.1</version.com.fasterxml.jackson.databind>
<!--
************************************************************************ -->
<!-- Plugins -->
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
