dependabot[bot] opened a new pull request, #125: URL: https://github.com/apache/fineract-loan-origination/pull/125
Bumps [org.springdoc:springdoc-openapi-starter-webmvc-ui](https://github.com/springdoc/springdoc-openapi) from 3.0.3 to 3.1.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/springdoc/springdoc-openapi/releases";>org.springdoc:springdoc-openapi-starter-webmvc-ui's releases</a>.</em></p> <blockquote> <h2>springdoc-openapi v3.1.1 released!</h2> <h3>Security</h3> <ul> <li><a href="https://github.com/springdoc/springdoc-openapi/security/advisories/GHSA-6f5m-mhjg-qwxq";>GHSA-6f5m-mhjg-qwxq</a> – MCP tool callbacks do not encode path parameters, allowing request retargeting</li> <li><a href="https://github.com/springdoc/springdoc-openapi/security/advisories/GHSA-4v2q-56v7-2cpw";>GHSA-4v2q-56v7-2cpw</a> – MCP transport, admin and dashboard endpoints are exposed by default</li> <li><a href="https://github.com/springdoc/springdoc-openapi/security/advisories/GHSA-m4cg-mhpg-rh2r";>GHSA-m4cg-mhpg-rh2r</a> – MCP audit events record credentials and request/response bodies without redaction</li> <li><a href="https://github.com/springdoc/springdoc-openapi/security/advisories/GHSA-5f9r-4mc4-qh3c";>GHSA-5f9r-4mc4-qh3c</a> – Unbounded MCP pending-confirmation store allows memory exhaustion</li> <li><a href="https://github.com/springdoc/springdoc-openapi/security/advisories/GHSA-jcgg-59c8-w4wh";>GHSA-jcgg-59c8-w4wh</a> – MCP request context in a <code>ThreadLocal</code> can leak headers between concurrent WebFlux requests</li> <li><a href="https://github.com/springdoc/springdoc-openapi/security/advisories/GHSA-rhhx-6j8h-8cvw";>GHSA-rhhx-6j8h-8cvw</a> – Unbounded per-locale OpenAPI cache allows memory exhaustion via <code>Accept-Language</code></li> <li><a href="https://github.com/springdoc/springdoc-openapi/security/advisories/GHSA-c925-vm88-mpp9";>GHSA-c925-vm88-mpp9</a> – Scalar starters trust client-supplied forwarded headers and render from a shared mutable bean</li> <li><a href="https://github.com/advisories/GHSA-748c-f84h-hp2v";>CVE-2026-75838</a> – Cross-site scripting in the DOMPurify bundled with swagger-ui, addressed by upgrading swagger-ui to <strong>5.32.14</strong></li> </ul> <h3>Added</h3> <ul> <li><a href="https://redirect.github.com/springdoc/springdoc-openapi/issues/3340";>#3340</a> – Describe <code>JsonNullable</code> values without their Java wrapper</li> <li><a href="https://redirect.github.com/springdoc/springdoc-openapi/issues/3325";>#3325</a> – Manage the swagger artifacts in <code>springdoc-openapi-bom</code>, so that modules holding only the annotations stay in lockstep</li> <li><a href="https://redirect.github.com/springdoc/springdoc-openapi/issues/3321";>#3321</a> – Add <code>springdoc.login-endpoint.username-example</code> and <code>springdoc.login-endpoint.password-example</code> to document the Spring Security login endpoint</li> </ul> <h3>Changed</h3> <ul> <li><strong>MCP is now opt-in.</strong> Set <code>springdoc.ai.mcp.enabled=true</code>, and <code>springdoc.ai.mcp.dashboard-enabled=true</code> for the dashboard</li> <li><strong>The Scalar starters no longer register forwarded-header handling.</strong> Set <code>server.forward-headers-strategy=framework</code> (or <code>native</code>) behind a trusted proxy</li> <li>Add <code>springdoc.cache.max-entries</code> (default <code>100</code>) to bound the per-locale OpenAPI cache</li> <li>Add <code>springdoc.ai.mcp.audit.redact</code> (default <code>true</code>) to mask secrets in MCP audit events</li> <li>Document that the MCP approval flow is a confirmation step, not an authorization control</li> <li>Document the security policy and the release versioning scheme</li> <li><a href="https://redirect.github.com/springdoc/springdoc-openapi/issues/3351";>#3351</a> – <code>java.time.Duration</code>, <code>LocalTime</code> and <code>OffsetTime</code> are now resolved by swagger-core instead of being forced to a bare <code>string</code>, so they carry a <code>format</code> (<code>duration</code> and <code>partial-time</code> respectively for the first two)</li> <li>A property whose type only implements <code>Set</code> indirectly (<code>LinkedHashSet</code>, <code>TreeSet</code>, …) is now described with <code>uniqueItems: true</code>, following <a href="https://redirect.github.com/swagger-api/swagger-core/pull/5265";>swagger-api/swagger-core#5265</a></li> <li>Upgrade swagger-core to version <strong>2.2.55</strong></li> <li>Upgrade swagger-ui to version <strong>5.32.14</strong></li> </ul> <h3>Fixed</h3> <ul> <li><a href="https://redirect.github.com/springdoc/springdoc-openapi/issues/3328";>#3328</a>, <a href="https://redirect.github.com/springdoc/springdoc-openapi/issues/3337";>#3337</a> – <code>/v3/api-docs</code> fails with a <code>NullPointerException</code> when spring-hateoas is on the classpath without <code>HateoasProperties</code></li> <li><a href="https://redirect.github.com/springdoc/springdoc-openapi/issues/3314";>#3314</a> – <code>Json Processing Exception occurred</code> is logged for every constrained parameter whose schema is not a <code>JsonSchema</code></li> <li><a href="https://redirect.github.com/springdoc/springdoc-openapi/issues/3317";>#3317</a> – An injected <code>HttpHeaders</code> parameter is described as a schema</li> <li><a href="https://redirect.github.com/springdoc/springdoc-openapi/issues/3332";>#3332</a> – The properties a Kotlin entity inherits from an <code>@Embeddable</code> are missing from the Spring Data REST schemas</li> <li><a href="https://redirect.github.com/springdoc/springdoc-openapi/issues/3320";>#3320</a> – <code>@Order</code> and <code>Ordered</code> ignored when applying customizers</li> <li><a href="https://redirect.github.com/springdoc/springdoc-openapi/issues/3319";>#3319</a> – A <code>Page</code> nested in another schema is not replaced by <code>PagedModel</code></li> <li><a href="https://redirect.github.com/springdoc/springdoc-openapi/issues/3313";>#3313</a> – Springdoc auto-configurations rely on unspecified auto-configuration ordering</li> <li><a href="https://redirect.github.com/springdoc/springdoc-openapi/issues/3331";>#3331</a> – Validation annotations declared inside <code>Optional</code> parameters are dropped</li> <li><a href="https://redirect.github.com/springdoc/springdoc-openapi/issues/3322";>#3322</a> – Validation annotations on a container's type argument leak between parameters</li> <li><a href="https://redirect.github.com/springdoc/springdoc-openapi/issues/3315";>#3315</a> – An OAS 3.1 <code>JsonSchema</code> cannot be cloned through JSON</li> <li><a href="https://redirect.github.com/springdoc/springdoc-openapi/issues/3300";>#3300</a> – TYPE_USE annotations on <code>@ParameterObject</code> fields are not passed along</li> <li><a href="https://redirect.github.com/springdoc/springdoc-openapi/issues/3341";>#3341</a> – Stabilize Spring Data <code>Sort</code> and <code>Pageable</code> schema property order</li> <li><a href="https://redirect.github.com/springdoc/springdoc-openapi/issues/3338";>#3338</a> – Kotlin nullability interpretation of the <code>Any?</code> type</li> <li><a href="https://redirect.github.com/springdoc/springdoc-openapi/issues/3136";>#3136</a> – A Spring Data REST association to a non-exported entity expands its <code>@EmbeddedId</code> and <code>@MapsId</code> fields recursively in the response schemas</li> <li>The Spring Data REST response post-processing rewrote an association property in place, so the <code>…Response</code> refs could leak into the schema shared with the request body representation</li> </ul> <h2>New Contributors</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/springdoc/springdoc-openapi/blob/main/CHANGELOG.md";>org.springdoc:springdoc-openapi-starter-webmvc-ui's changelog</a>.</em></p> <blockquote> <h2>[3.1.1] - 2026-09-06</h2> <h3>Security</h3> <ul> <li><a href="https://github.com/springdoc/springdoc-openapi/security/advisories/GHSA-6f5m-mhjg-qwxq";>GHSA-6f5m-mhjg-qwxq</a> – MCP tool callbacks do not encode path parameters, allowing request retargeting</li> <li><a href="https://github.com/springdoc/springdoc-openapi/security/advisories/GHSA-4v2q-56v7-2cpw";>GHSA-4v2q-56v7-2cpw</a> – MCP transport, admin and dashboard endpoints are exposed by default</li> <li><a href="https://github.com/springdoc/springdoc-openapi/security/advisories/GHSA-m4cg-mhpg-rh2r";>GHSA-m4cg-mhpg-rh2r</a> – MCP audit events record credentials and request/response bodies without redaction</li> <li><a href="https://github.com/springdoc/springdoc-openapi/security/advisories/GHSA-5f9r-4mc4-qh3c";>GHSA-5f9r-4mc4-qh3c</a> – Unbounded MCP pending-confirmation store allows memory exhaustion</li> <li><a href="https://github.com/springdoc/springdoc-openapi/security/advisories/GHSA-jcgg-59c8-w4wh";>GHSA-jcgg-59c8-w4wh</a> – MCP request context in a <code>ThreadLocal</code> can leak headers between concurrent WebFlux requests</li> <li><a href="https://github.com/springdoc/springdoc-openapi/security/advisories/GHSA-rhhx-6j8h-8cvw";>GHSA-rhhx-6j8h-8cvw</a> – Unbounded per-locale OpenAPI cache allows memory exhaustion via <code>Accept-Language</code></li> <li><a href="https://github.com/springdoc/springdoc-openapi/security/advisories/GHSA-c925-vm88-mpp9";>GHSA-c925-vm88-mpp9</a> – Scalar starters trust client-supplied forwarded headers and render from a shared mutable bean</li> <li><a href="https://github.com/advisories/GHSA-748c-f84h-hp2v";>CVE-2026-75838</a> – Cross-site scripting in the DOMPurify bundled with swagger-ui, addressed by upgrading swagger-ui to <strong>5.32.14</strong></li> </ul> <h3>Added</h3> <ul> <li><a href="https://redirect.github.com/springdoc/springdoc-openapi/issues/3340";>#3340</a> – Describe <code>JsonNullable</code> values without their Java wrapper</li> <li><a href="https://redirect.github.com/springdoc/springdoc-openapi/issues/3325";>#3325</a> – Manage the swagger artifacts in <code>springdoc-openapi-bom</code>, so that modules holding only the annotations stay in lockstep</li> <li><a href="https://redirect.github.com/springdoc/springdoc-openapi/issues/3321";>#3321</a> – Add <code>springdoc.login-endpoint.username-example</code> and <code>springdoc.login-endpoint.password-example</code> to document the Spring Security login endpoint</li> </ul> <h3>Changed</h3> <ul> <li><strong>MCP is now opt-in.</strong> Set <code>springdoc.ai.mcp.enabled=true</code>, and <code>springdoc.ai.mcp.dashboard-enabled=true</code> for the dashboard</li> <li><strong>The Scalar starters no longer register forwarded-header handling.</strong> Set <code>server.forward-headers-strategy=framework</code> (or <code>native</code>) behind a trusted proxy</li> <li>Add <code>springdoc.cache.max-entries</code> (default <code>100</code>) to bound the per-locale OpenAPI cache</li> <li>Add <code>springdoc.ai.mcp.audit.redact</code> (default <code>true</code>) to mask secrets in MCP audit events</li> <li>Document that the MCP approval flow is a confirmation step, not an authorization control</li> <li>Document the security policy and the release versioning scheme</li> <li><a href="https://redirect.github.com/springdoc/springdoc-openapi/issues/3351";>#3351</a> – <code>java.time.Duration</code>, <code>LocalTime</code> and <code>OffsetTime</code> are now resolved by swagger-core instead of being forced to a bare <code>string</code>, so they carry a <code>format</code> (<code>duration</code> and <code>partial-time</code> respectively for the first two)</li> <li>A property whose type only implements <code>Set</code> indirectly (<code>LinkedHashSet</code>, <code>TreeSet</code>, …) is now described with <code>uniqueItems: true</code>, following <a href="https://redirect.github.com/swagger-api/swagger-core/pull/5265";>swagger-api/swagger-core#5265</a></li> <li>Upgrade swagger-core to version <strong>2.2.55</strong></li> <li>Upgrade swagger-ui to version <strong>5.32.14</strong></li> </ul> <h3>Fixed</h3> <ul> <li><a href="https://redirect.github.com/springdoc/springdoc-openapi/issues/3328";>#3328</a>, <a href="https://redirect.github.com/springdoc/springdoc-openapi/issues/3337";>#3337</a> – <code>/v3/api-docs</code> fails with a <code>NullPointerException</code> when spring-hateoas is on the classpath without <code>HateoasProperties</code></li> <li><a href="https://redirect.github.com/springdoc/springdoc-openapi/issues/3314";>#3314</a> – <code>Json Processing Exception occurred</code> is logged for every constrained parameter whose schema is not a <code>JsonSchema</code></li> <li><a href="https://redirect.github.com/springdoc/springdoc-openapi/issues/3317";>#3317</a> – An injected <code>HttpHeaders</code> parameter is described as a schema</li> <li><a href="https://redirect.github.com/springdoc/springdoc-openapi/issues/3332";>#3332</a> – The properties a Kotlin entity inherits from an <code>@Embeddable</code> are missing from the Spring Data REST schemas</li> <li><a href="https://redirect.github.com/springdoc/springdoc-openapi/issues/3320";>#3320</a> – <code>@Order</code> and <code>Ordered</code> ignored when applying customizers</li> <li><a href="https://redirect.github.com/springdoc/springdoc-openapi/issues/3319";>#3319</a> – A <code>Page</code> nested in another schema is not replaced by <code>PagedModel</code></li> <li><a href="https://redirect.github.com/springdoc/springdoc-openapi/issues/3313";>#3313</a> – Springdoc auto-configurations rely on unspecified auto-configuration ordering</li> <li><a href="https://redirect.github.com/springdoc/springdoc-openapi/issues/3331";>#3331</a> – Validation annotations declared inside <code>Optional</code> parameters are dropped</li> <li><a href="https://redirect.github.com/springdoc/springdoc-openapi/issues/3322";>#3322</a> – Validation annotations on a container's type argument leak between parameters</li> <li><a href="https://redirect.github.com/springdoc/springdoc-openapi/issues/3315";>#3315</a> – An OAS 3.1 <code>JsonSchema</code> cannot be cloned through JSON</li> <li><a href="https://redirect.github.com/springdoc/springdoc-openapi/issues/3300";>#3300</a> – TYPE_USE annotations on <code>@ParameterObject</code> fields are not passed along</li> <li><a href="https://redirect.github.com/springdoc/springdoc-openapi/issues/3341";>#3341</a> – Stabilize Spring Data <code>Sort</code> and <code>Pageable</code> schema property order</li> <li><a href="https://redirect.github.com/springdoc/springdoc-openapi/issues/3338";>#3338</a> – Kotlin nullability interpretation of the <code>Any?</code> type</li> <li><a href="https://redirect.github.com/springdoc/springdoc-openapi/issues/3136";>#3136</a> – A Spring Data REST association to a non-exported entity expands its <code>@EmbeddedId</code> and <code>@MapsId</code> fields recursively in the response schemas</li> <li>The Spring Data REST response post-processing rewrote an association property in place, so the <code>…Response</code> refs could leak into the schema shared with the request body representation</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/springdoc/springdoc-openapi/commit/1cc87a7ca2a0003004fb6149ee3a1afe919530b2";><code>1cc87a7</code></a> [maven-release-plugin] prepare release v3.1.1</li> <li><a href="https://github.com/springdoc/springdoc-openapi/commit/4e8ac265f691ae3a3457d08f56c74bb3544916fd";><code>4e8ac26</code></a> docs: record the swagger-ui 5.32.14 upgrade as a security fix for 3.1.1</li> <li><a href="https://github.com/springdoc/springdoc-openapi/commit/958c79a5f3c81aefad9abd64458e3b6c738812e8";><code>958c79a</code></a> Merge swagger-core 2.2.55 upgrade</li> <li><a href="https://github.com/springdoc/springdoc-openapi/commit/cf7d7c71908750bd15b3a5974ff97322821c9c2b";><code>cf7d7c7</code></a> Upgrade swagger-core to 2.2.55</li> <li><a href="https://github.com/springdoc/springdoc-openapi/commit/186adb3741c50eadc235e452dc07b1fc80a2d020";><code>186adb3</code></a> Record the swagger-core 2.2.54 upgrade in the changelog</li> <li><a href="https://github.com/springdoc/springdoc-openapi/commit/2498ffbaaec37d194f6f356e9b246f2bca63d26b";><code>2498ffb</code></a> Merge pull request <a href="https://redirect.github.com/springdoc/springdoc-openapi/issues/3351";>#3351</a> from Mattias-Sehlstedt/update-swagger-core</li> <li><a href="https://github.com/springdoc/springdoc-openapi/commit/d78abd954a1069a324f3909c4363059b17b7a59f";><code>d78abd9</code></a> upgrade swagger-core from 2.2.53 to 2.2.54</li> <li><a href="https://github.com/springdoc/springdoc-openapi/commit/9f7f0995bded2ef6454aeb98466db3f89aa84483";><code>9f7f099</code></a> Rewrite a copy of a Spring Data REST association property</li> <li><a href="https://github.com/springdoc/springdoc-openapi/commit/f47060ea68a8875d44c12702b9ef2344c9abdaca";><code>f47060e</code></a> Record <a href="https://redirect.github.com/springdoc/springdoc-openapi/issues/3321";>#3321</a> in the changelog and align the buildRequestBody indent</li> <li><a href="https://github.com/springdoc/springdoc-openapi/commit/ccb2fc06daed6544179f23ab6830ceaca9c7f0b1";><code>ccb2fc0</code></a> Merge pull request <a href="https://redirect.github.com/springdoc/springdoc-openapi/issues/3323";>#3323</a> from Mattias-Sehlstedt/feature/3321-login-example-va...</li> <li>Additional commits viewable in <a href="https://github.com/springdoc/springdoc-openapi/compare/v3.0.3...v3.1.1";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
