[aikido-autofix]

Thank you for submitting a pull request to the WebGoat!

---

Summary / Description

Upgrade dependencies to fix critical RCE and arbitrary code execution vulnerabilities in XStream, Spring, Tomcat, Thymeleaf, and Jackson. This update includes breaking changes that require manual migration.

---

Security Impact — CVE vulnerabilities fixed by this PR

✅ 48 CVEs resolved by this upgrade, including 16 critical 🚨 CVEs

This PR will resolve the following CVEs:

Issue	Severity	Description
CVE-2021-21345	🚨 CRITICAL	[xstream] A deserialization vulnerability allows remote attackers with sufficient rights to execute arbitrary commands by manipulating input streams. This impacts users relying on the default blacklist security framework rather than implementing a whitelist.
CVE-2013-7285	🚨 CRITICAL	[xstream] API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.
CVE-2021-21344	🚨 CRITICAL	[xstream] A remote code execution vulnerability allows attackers to execute arbitrary code by manipulating input streams, bypassing the default blacklist security framework. Users relying on default security settings must upgrade to mitigate this risk.
CVE-2021-21346	🚨 CRITICAL	[xstream] A remote code execution vulnerability allows attackers to execute arbitrary code by manipulating input streams, bypassing the default blacklist security framework. Users relying on default security settings must upgrade to mitigate this risk.
CVE-2021-21347	🚨 CRITICAL	[xstream] A remote code execution vulnerability allows attackers to execute arbitrary code by manipulating input streams, bypassing the default blacklist security framework. Users relying on default security settings must upgrade to mitigate this risk.
CVE-2021-21350	🚨 CRITICAL	[xstream] Deserialization vulnerability allowing remote code execution through malicious XML input when using default blacklist security settings instead of a whitelist configuration.
CVE-2021-21342	🚨 CRITICAL	[xstream] Deserialization vulnerability allowing attackers to manipulate XML input streams to inject malicious objects, potentially causing server-side request forgery (SSRF) attacks during unmarshalling operations. Default blacklist configurations are vulnerable; whitelist-based security frameworks are unaffected.
CVE-2021-21351	🚨 CRITICAL	[xstream] Deserialization vulnerability allowing remote code execution through malicious XML input when using default blacklist security settings instead of a whitelist configuration.
CVE-2021-39144	🚨 CRITICAL	[xstream] A deserialization vulnerability allows remote attackers with sufficient rights to execute arbitrary commands by manipulating input streams. Users not using XStream's security framework with a whitelist are at risk.
CVE-2020-26217	HIGH	[xstream] A remote code execution vulnerability allows attackers to execute arbitrary shell commands by manipulating input streams when using blocklists. Users relying on allowlists are unaffected.
CVE-2021-29505	HIGH	[xstream] A deserialization vulnerability allows remote attackers to execute arbitrary commands on the host by manipulating input streams when security restrictions are not properly configured. Users with whitelisted type restrictions are not affected.
CVE-2021-21349	HIGH	[xstream] A vulnerability allows remote attackers to access internal resources by manipulating input streams, bypassing the default blacklist security framework. This enables information disclosure of non-public data when using default security settings.
CVE-2021-39141	HIGH	[xstream] Remote attackers can execute arbitrary code by manipulating input streams through unsafe deserialization. This vulnerability allows RCE unless XStream's security framework is configured with a strict whitelist of allowed types.
CVE-2021-39146	HIGH	[xstream] Remote attackers can execute arbitrary code by manipulating input streams through unsafe deserialization. This vulnerability allows RCE unless XStream's security framework is configured with a strict whitelist of allowed types.
CVE-2021-39152	HIGH	[xstream] A deserialization vulnerability allows remote attackers to access internal resources by manipulating input streams on Java 14-8 runtimes. This information disclosure issue bypasses the default blacklist security framework.
CVE-2021-39139	HIGH	[xstream] Deserialization vulnerability allowing remote code execution through malicious XML input when using default settings without security framework restrictions.
CVE-2020-26258	HIGH	[xstream] A Server-Side Request Forgery (SSRF) vulnerability in XStream's unmarshalling process allows remote attackers to access internal resources by manipulating input streams when using the default blacklist security configuration.
CVE-2017-7957	HIGH	[xstream] through 1.4.9, when a certain denyTypes workaround is not used, mishandles attempts to create an instance of the primitive type 'void' during unmarshalling, leading to a remote application crash, as demonstrated by an xstream.fromXML("") call.
CVE-2021-21341	HIGH	[xstream] A vulnerability allows remote attackers to cause denial of service by manipulating input streams to consume 100% CPU resources. This affects systems using default blacklist security settings; whitelist-based configurations are unaffected.
CVE-2022-41966	HIGH	[xstream] A remote attacker can manipulate input streams to trigger recursive hash calculations in collections, causing stack overflow and denial of service. The vulnerability exploits hash code implementations in maps and collections to crash the application.
CVE-2016-3674	HIGH	[xstream] Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files via a crafted XML document.
CVE-2021-39145	HIGH	[xstream] Remote attackers can execute arbitrary code by manipulating input streams through unsafe deserialization. This vulnerability allows RCE unless XStream's security framework is configured with a strict whitelist of allowed types.
CVE-2021-39147	HIGH	[xstream] Remote attackers can execute arbitrary code by manipulating input streams through unsafe deserialization. This vulnerability allows RCE unless XStream's security framework is configured with a strict whitelist of allowed types.
CVE-2021-39148	HIGH	[xstream] Remote attackers can execute arbitrary code by manipulating input streams through unsafe deserialization. This vulnerability allows RCE unless XStream's security framework is configured with a strict whitelist of allowed types.
CVE-2021-39149	HIGH	[xstream] Remote attackers can execute arbitrary code by manipulating input streams through unsafe deserialization. This vulnerability allows RCE unless XStream's security framework is configured with a strict whitelist of allowed types.
CVE-2021-39150	HIGH	[xstream] A deserialization vulnerability allows remote attackers to access internal resources by manipulating input streams on Java 14-8 runtimes. This information disclosure issue bypasses the default blacklist security framework.
CVE-2021-39151	HIGH	[xstream] Remote attackers can execute arbitrary code by manipulating input streams through unsafe deserialization. This vulnerability allows RCE unless XStream's security framework is configured with a strict whitelist of allowed types.
CVE-2021-39153	HIGH	[xstream] A deserialization vulnerability allows remote attackers to execute arbitrary code by manipulating input streams when using Java 14-8 or with JavaFX installed, unless XStream's security whitelist is properly configured.
CVE-2021-39154	HIGH	[xstream] Remote attackers can execute arbitrary code by manipulating input streams through unsafe deserialization. This vulnerability allows RCE unless XStream's security framework is configured with a strict whitelist of allowed types.
CVE-2021-21343	HIGH	[xstream] Deserialization vulnerability allowing arbitrary object instantiation during unmarshalling, enabling attackers to manipulate input streams and delete files on the local system through malicious type information injection.
CVE-2021-21348	HIGH	[xstream] Denial of Service vulnerability allowing remote attackers to consume maximum CPU resources through a malicious serialized object, causing thread hang. Affects systems using default blacklist security configuration.
CVE-2020-26259	MEDIUM	[xstream] XStream is vulnerable to arbitrary file deletion on the local host during unmarshalling when using default blacklist security settings. A remote attacker can delete arbitrary files if the executing process has sufficient permissions.
CVE-2022-40151	MEDIUM	[xstream] Those using Xstream to seralize XML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.
CVE-2021-39140	MEDIUM	[xstream] A vulnerability allows remote attackers to cause denial of service by manipulating input streams to consume 100% CPU resources. This affects systems not using XStream's security framework with a whitelist of minimal required types.
CVE-2021-43859	LOW	[xstream] Deserialization vulnerability allowing remote attackers to cause denial of service by consuming 100% CPU through malicious input stream manipulation. Fixed by implementing time-based threshold monitoring for collection operations.
CVE-2026-41293	🚨 CRITICAL	[tomcat-embed-core] Improper input validation vulnerability allows attackers to bypass security controls or trigger unexpected behavior. Potential impacts include remote code execution, denial of service, or information disclosure depending on exploitation context.
CVE-2026-43512	🚨 CRITICAL	[tomcat-embed-core] Digest authentication bypass vulnerability allowing attackers to bypass authentication mechanisms and gain unauthorized access to protected resources.
CVE-2026-43515	🚨 CRITICAL	[tomcat-embed-core] Improper authorization in method constraints allows attackers to bypass HTTP method restrictions on specific file extensions, potentially enabling unauthorized access to protected resources.
CVE-2026-24880	HIGH	[tomcat-embed-core] HTTP request smuggling vulnerability via invalid chunk extensions allows attackers to bypass security controls and potentially execute arbitrary code or manipulate request handling.
CVE-2026-25854	MEDIUM	[tomcat-embed-core] Open redirect vulnerability in LoadBalancerDrainingValve allows attackers to redirect users to untrusted sites. This could enable phishing attacks or malicious redirects to compromise user security.
CVE-2025-61795	MEDIUM	[tomcat-embed-core] Temporary files from multipart uploads aren't cleaned up immediately during errors, allowing disk space to fill faster than garbage collection clears it, causing denial of service.
CVE-2026-47884	🚨 CRITICAL	[spring-core] XsltView in Spring MVC with "/**" mapping and unspecified view names allows attackers to perform SSRF and RCE attacks through view rendering exploitation.
CVE-2026-22732	🚨 CRITICAL	[spring-security-core] HTTP response security headers may not be written to responses in servlet applications using lazy header writing, potentially allowing security headers to be bypassed and exposing applications to attacks that these headers would normally prevent.
CVE-2026-40477	🚨 CRITICAL	[thymeleaf-spring5] Server-Side Template Injection (SSTI) vulnerability allowing attackers to bypass expression restrictions and access sensitive objects through unvalidated user input. An unauthenticated remote attacker can execute arbitrary code on the server.
CVE-2026-41901	🚨 CRITICAL	[thymeleaf-spring5] Server-Side Template Injection (SSTI) vulnerability in sandboxed expression contexts allows attackers to execute arbitrary code when unsanitized user input is processed in restricted template contexts.
CVE-2026-40478	HIGH	[thymeleaf-spring5] Server-Side Template Injection (SSTI) vulnerability allowing attackers to bypass expression execution protections and execute unauthorized code through unvalidated user input. Remote code execution is possible when user input is passed directly to the template engine.
CVE-2026-54512	HIGH	[jackson-databind] Polymorphic type validator bypass allows attackers to deserialize denied classes by hiding them as generic type parameters within allowed container types. This enables remote code execution through instantiation and property population of malicious gadget classes.
CVE-2026-54513	HIGH	[jackson-databind] BasicPolymorphicTypeValidator's allowIfSubTypeIsArray() method fails to validate array component types against the allowlist, allowing deserialization of non-allowlisted types as array elements. This bypasses type validation and enables remote code execution through malicious object instantiation.

---

Breaking Changes & Upgrade Impact — prefer Warnings / Cautions / ⚠️ sections over implementation sections (upgrade risks, breaking changes, manual migration steps)

⚠️ Incomplete breaking changes analysis (17/19 analyzed)

⚠️ Breaking changes analysis not available for: com.thoughtworks.xstream:xstream, com.fasterxml.jackson.core:jackson-databind

⚠️ The upgrade from Spring Framework 6.2.11 to 7.0.9 introduces breaking changes that affect this codebase:

1. WebJars support removed

• Where your code is affected:

  • pom.xml lines 103, 211-213 (dependency declaration)

  • src/main/resources/webwolf/templates/fragments/header.html lines 6-9 (template references to /webjars/bootstrap/ and /webjars/jquery/)

  • src/main/java/org/owasp/webgoat/webwolf/WebSecurityConfig.java line 25 (security configuration permits /webjars/**)

  • src/main/java/org/owasp/webgoat/webwolf/requests/WebWolfTraceRepository.java line 36 (trace filtering)

• Impact: Spring Framework 7.0 removes WebJars support with org.webjars:webjars-locator-core. The automatic version resolution for WebJars paths (e.g., /webjars/bootstrap/css/bootstrap.min.css → /webjars/bootstrap/5.3.5/css/bootstrap.min.css) will no longer work. Templates referencing /webjars/ paths will fail to load CSS and JavaScript resources.

• Remediation: Either manually configure resource handlers to map /webjars/** to classpath:/META-INF/resources/webjars/ with explicit version numbers in template paths, or migrate to using versioned paths directly in templates and add explicit resource handler mappings in MvcConfiguration classes.

All breaking changes by upgrading org.springframework:spring-core from version 6.2.11 to 7.0.9 (CHANGELOG)

Version	Description
7.0.0-M1	Spring JCL module (spring-jcl) has been removed in favor of Apache Commons Logging 1.3.0
7.0.0-M1	Support for javax.annotation and javax.inject annotations removed; must migrate to jakarta.annotation and jakarta.inject packages
7.0.0-M1	Deprecated path mapping options removed: suffixPatternMatch, registeredSuffixPatternMatch, trailingSlashMatch, favorPathExtension, ignoreUnknownPathExtensions, and matchOptionalTrailingSeparator
7.0.0-M1	Undertow support removed (WebSocket and WebFlux HTTP support classes)
7.0.0-M1	ListenableFuture removed in favor of CompletableFuture
7.0.0-M1	WebJars support with org.webjars:webjars-locator-core removed
7.0.0-M1	OkHttp3 support removed
7.0.0-M1	Theme support removed
7.0.0-M1	HttpComponentsClientHttpRequestFactory#setConnectTimeout methods removed
7.0.0-M1	JdbcOperations Kotlin extensions with Array parameters replaced by vararg variants
7.0.0-M1	HttpHeaders no longer extends MultiValueMap contract; several methods removed
7.0.0-M1	SpEL expressions now limited to 10,000 operations by default (as of 7.0.8); evaluation halts if exceeded
7.0.0-M1	SpringExtension now uses test-method scoped ExtensionContext instead of test-class scope; may break custom TestExecutionListener implementations in @nested test hierarchies
7.0.0-M1	MutablePersistenceUnitInfo no longer implements jakarta.persistence.spi.PersistenceUnitInfo interface directly
7.0.0-M1	Default DestinationResolver changed to SimpleDestinationResolver which caches Session-resolved Queue and Topic instances
7.0.0-M1	Kotlin Serialization converters/codecs now perform additional check via KotlinDetector#hasSerializableAnnotation by default
7.0.0-M1	GraalVM reachability metadata format changed: resource hints syntax changed from java.util.regex.Pattern to glob pattern format; registration of "excludes" removed; reflection hint registration behavior changed
7.0.0-M1	CORS Pre-Flight requests no longer rejected when CORS configuration is empty
7.0.0-M1	WebClient with Reactor client automatically opts-in for system properties for proxy configuration (https.proxyHost and https.proxyPort)
7.0.0-M1	Baseline requirements raised: Servlet 6.1, JPA 3.2, Bean Validation 3.1, GraalVM 25, Netty 4.2, Kotlin 2.2, JUnit 6
7.0.0-M1	Spring nullness annotations with JSR 305 semantics replaced with JSpecify annotations; nullability of array/vararg elements and generic types now specified
7.0.0-M1	MethodParameter#isOptional behavior changed; now only checks local annotations, not inherited ones

All breaking changes by upgrading org.springframework:spring-webmvc from version 6.2.11 to 7.0.9 (CHANGELOG)

Version	Description
7.0.0-M1	Spring JCL module (spring-jcl) has been removed in favor of Apache Commons Logging 1.3.0
7.0.0-M1	Support for javax.annotation and javax.inject annotations removed; must migrate to jakarta.annotation and jakarta.inject packages
7.0.0-M1	Deprecated path mapping options removed: suffixPatternMatch, registeredSuffixPatternMatch, trailingSlashMatch, favorPathExtension, ignoreUnknownPathExtensions, and matchOptionalTrailingSeparator
7.0.0-M1	Undertow support removed (WebSocket and WebFlux HTTP support classes)
7.0.0-M1	ListenableFuture removed in favor of CompletableFuture
7.0.0-M1	WebJars support with org.webjars:webjars-locator-core removed
7.0.0-M1	OkHttp3 support removed
7.0.0-M1	Theme support removed
7.0.0-M1	HttpComponentsClientHttpRequestFactory#setConnectTimeout methods removed
7.0.0-M1	JdbcOperations Kotlin extensions with Array parameters replaced by vararg variants
7.0.0-M1	HttpHeaders no longer extends MultiValueMap contract; several methods removed
7.0.0-M1	SpEL expressions now limited to 10,000 operations by default (as of 7.0.8); evaluation halts if exceeded
7.0.0-M1	SpringExtension now uses test-method scoped ExtensionContext instead of test-class scope; may break custom TestExecutionListener implementations in @nested test hierarchies
7.0.0-M1	MutablePersistenceUnitInfo no longer implements jakarta.persistence.spi.PersistenceUnitInfo interface directly
7.0.0-M1	Default DestinationResolver changed to SimpleDestinationResolver which caches Session-resolved Queue and Topic instances
7.0.0-M1	Kotlin Serialization converters/codecs now perform additional check via KotlinDetector#hasSerializableAnnotation by default
7.0.0-M1	GraalVM reachability metadata format changed: resource hints syntax changed from java.util.regex.Pattern to glob pattern format; registration of "excludes" removed; reflection hint registration behavior changed
7.0.0-M1	CORS Pre-Flight requests no longer rejected when CORS configuration is empty
7.0.0-M1	WebClient with Reactor client automatically opts-in for system properties for proxy configuration (https.proxyHost and https.proxyPort)
7.0.0-M1	Baseline requirements raised: Servlet 6.1, JPA 3.2, Bean Validation 3.1, GraalVM 25, Netty 4.2, Kotlin 2.2, JUnit 6
7.0.0-M1	Spring nullness annotations with JSR 305 semantics replaced with JSpecify annotations; nullability of array/vararg elements and generic types now specified
7.0.0-M1	MethodParameter#isOptional behavior changed; now only checks local annotations, not inherited ones

All breaking changes by upgrading org.springframework:spring-web from version 6.2.11 to 7.0.9 (CHANGELOG)

Version	Description
7.0.0-M1	Spring JCL module (spring-jcl) has been removed in favor of Apache Commons Logging 1.3.0
7.0.0-M1	Support for javax.annotation and javax.inject annotations removed; must migrate to jakarta.annotation and jakarta.inject packages
7.0.0-M1	Deprecated path mapping options removed: suffixPatternMatch, registeredSuffixPatternMatch, trailingSlashMatch, favorPathExtension, ignoreUnknownPathExtensions, and matchOptionalTrailingSeparator
7.0.0-M1	Undertow support removed (WebSocket and WebFlux HTTP support classes)
7.0.0-M1	ListenableFuture removed in favor of CompletableFuture
7.0.0-M1	WebJars support with org.webjars:webjars-locator-core removed
7.0.0-M1	OkHttp3 support removed
7.0.0-M1	Theme support removed
7.0.0-M1	HttpComponentsClientHttpRequestFactory#setConnectTimeout methods removed
7.0.0-M1	JdbcOperations Kotlin extensions with Array parameters replaced by vararg variants
7.0.0-M1	HttpHeaders no longer extends MultiValueMap contract; several methods removed
7.0.0-M1	SpEL expressions now limited to 10,000 operations by default (as of 7.0.8); evaluation halts if exceeded
7.0.0-M1	SpringExtension now uses test-method scoped ExtensionContext instead of test-class scope; may break custom TestExecutionListener implementations in @nested test hierarchies
7.0.0-M1	MutablePersistenceUnitInfo no longer implements jakarta.persistence.spi.PersistenceUnitInfo interface directly
7.0.0-M1	Default DestinationResolver changed to SimpleDestinationResolver which caches Session-resolved Queue and Topic instances
7.0.0-M1	Kotlin Serialization converters/codecs now perform additional check via KotlinDetector#hasSerializableAnnotation by default
7.0.0-M1	GraalVM reachability metadata format changed: resource hints syntax changed from java.util.regex.Pattern to glob pattern format; registration of "excludes" removed; reflection hint registration behavior changed
7.0.0-M1	CORS Pre-Flight requests no longer rejected when CORS configuration is empty
7.0.0-M1	WebClient with Reactor client automatically opts-in for system properties for proxy configuration (https.proxyHost and https.proxyPort)
7.0.0-M1	Baseline requirements raised: Servlet 6.1, JPA 3.2, Bean Validation 3.1, GraalVM 25, Netty 4.2, Kotlin 2.2, JUnit 6
7.0.0-M1	Spring nullness annotations with JSR 305 semantics replaced with JSpecify annotations; nullability of array/vararg elements and generic types now specified
7.0.0-M1	MethodParameter#isOptional behavior changed; now only checks local annotations, not inherited ones

All breaking changes by upgrading org.springframework:spring-beans from version 6.2.11 to 7.0.9 (CHANGELOG)

Version	Description
7.0.0-M1	Spring JCL module (spring-jcl) has been removed in favor of Apache Commons Logging 1.3.0
7.0.0-M1	Support for javax.annotation and javax.inject annotations removed; must migrate to jakarta.annotation and jakarta.inject packages
7.0.0-M1	Deprecated path mapping options removed: suffixPatternMatch, registeredSuffixPatternMatch, trailingSlashMatch, favorPathExtension, ignoreUnknownPathExtensions, and matchOptionalTrailingSeparator
7.0.0-M1	Undertow support removed (WebSocket and WebFlux HTTP support classes)
7.0.0-M1	ListenableFuture removed in favor of CompletableFuture
7.0.0-M1	WebJars support with org.webjars:webjars-locator-core removed
7.0.0-M1	OkHttp3 support removed
7.0.0-M1	Theme support removed
7.0.0-M1	HttpComponentsClientHttpRequestFactory#setConnectTimeout methods removed
7.0.0-M1	JdbcOperations Kotlin extensions with Array parameters replaced by vararg variants
7.0.0-M1	HttpHeaders no longer extends MultiValueMap contract; several methods removed
7.0.0-M1	SpEL expressions now limited to 10,000 operations by default (as of 7.0.8); evaluation halts if exceeded
7.0.0-M1	SpringExtension now uses test-method scoped ExtensionContext instead of test-class scope; may break custom TestExecutionListener implementations in @nested test hierarchies
7.0.0-M1	MutablePersistenceUnitInfo no longer implements jakarta.persistence.spi.PersistenceUnitInfo interface directly
7.0.0-M1	Default DestinationResolver changed to SimpleDestinationResolver which caches Session-resolved Queue and Topic instances
7.0.0-M1	Kotlin Serialization converters/codecs now perform additional check via KotlinDetector#hasSerializableAnnotation by default
7.0.0-M1	GraalVM reachability metadata format changed: resource hints syntax changed from java.util.regex.Pattern to glob pattern format; registration of "excludes" removed; reflection hint registration behavior changed
7.0.0-M1	CORS Pre-Flight requests no longer rejected when CORS configuration is empty
7.0.0-M1	WebClient with Reactor client automatically opts-in for system properties for proxy configuration (https.proxyHost and https.proxyPort)
7.0.0-M1	Baseline requirements raised: Servlet 6.1, JPA 3.2, Bean Validation 3.1, GraalVM 25, Netty 4.2, Kotlin 2.2, JUnit 6
7.0.0-M1	Spring nullness annotations with JSR 305 semantics replaced with JSpecify annotations; nullability of array/vararg elements and generic types now specified
7.0.0-M1	MethodParameter#isOptional behavior changed; now only checks local annotations, not inherited ones

All breaking changes by upgrading org.springframework:spring-expression from version 6.2.11 to 7.0.9 (CHANGELOG)

Version	Description
7.0.0-M1	Spring JCL module (spring-jcl) has been removed in favor of Apache Commons Logging 1.3.0
7.0.0-M1	Support for javax.annotation and javax.inject annotations removed; must migrate to jakarta.annotation and jakarta.inject packages
7.0.0-M1	Deprecated path mapping options removed: suffixPatternMatch, registeredSuffixPatternMatch, trailingSlashMatch, favorPathExtension, ignoreUnknownPathExtensions, and matchOptionalTrailingSeparator
7.0.0-M1	Undertow support removed (WebSocket and WebFlux HTTP support classes)
7.0.0-M1	ListenableFuture removed in favor of CompletableFuture
7.0.0-M1	WebJars support with org.webjars:webjars-locator-core removed
7.0.0-M1	OkHttp3 support removed
7.0.0-M1	Theme support removed
7.0.0-M1	HttpComponentsClientHttpRequestFactory#setConnectTimeout methods removed
7.0.0-M1	JdbcOperations Kotlin extensions with Array parameters replaced by vararg variants
7.0.0-M1	HttpHeaders no longer extends MultiValueMap contract; several methods removed
7.0.0-M1	SpEL expressions now limited to 10,000 operations by default (as of 7.0.8); evaluation halts if exceeded
7.0.0-M1	SpringExtension now uses test-method scoped ExtensionContext instead of test-class scope; may break custom TestExecutionListener implementations in @nested test hierarchies
7.0.0-M1	MutablePersistenceUnitInfo no longer implements jakarta.persistence.spi.PersistenceUnitInfo interface directly
7.0.0-M1	Default DestinationResolver changed to SimpleDestinationResolver which caches Session-resolved Queue and Topic instances
7.0.0-M1	Kotlin Serialization converters/codecs now perform additional check via KotlinDetector#hasSerializableAnnotation by default
7.0.0-M1	GraalVM reachability metadata format changed: resource hints syntax changed from java.util.regex.Pattern to glob pattern format; registration of "excludes" removed; reflection hint registration behavior changed
7.0.0-M1	CORS Pre-Flight requests no longer rejected when CORS configuration is empty
7.0.0-M1	WebClient with Reactor client automatically opts-in for system properties for proxy configuration (https.proxyHost and https.proxyPort)
7.0.0-M1	Baseline requirements raised: Servlet 6.1, JPA 3.2, Bean Validation 3.1, GraalVM 25, Netty 4.2, Kotlin 2.2, JUnit 6
7.0.0-M1	Spring nullness annotations with JSR 305 semantics replaced with JSpecify annotations; nullability of array/vararg elements and generic types now specified
7.0.0-M1	MethodParameter#isOptional behavior changed; now only checks local annotations, not inherited ones

All breaking changes by upgrading org.springframework:spring-context from version 6.2.11 to 7.0.9 (CHANGELOG)

Version	Description
7.0.0-M1	Spring JCL module (spring-jcl) has been removed in favor of Apache Commons Logging 1.3.0
7.0.0-M1	Support for javax.annotation and javax.inject annotations removed; must migrate to jakarta.annotation and jakarta.inject packages
7.0.0-M1	Deprecated path mapping options removed: suffixPatternMatch, registeredSuffixPatternMatch, trailingSlashMatch, favorPathExtension, ignoreUnknownPathExtensions, and matchOptionalTrailingSeparator
7.0.0-M1	Undertow support removed (WebSocket and WebFlux HTTP support classes)
7.0.0-M1	ListenableFuture removed in favor of CompletableFuture
7.0.0-M1	WebJars support with org.webjars:webjars-locator-core removed
7.0.0-M1	OkHttp3 support removed
7.0.0-M1	Theme support removed
7.0.0-M1	HttpComponentsClientHttpRequestFactory#setConnectTimeout methods removed
7.0.0-M1	JdbcOperations Kotlin extensions with Array parameters replaced by vararg variants
7.0.0-M1	HttpHeaders no longer extends MultiValueMap contract; several methods removed
7.0.0-M1	SpEL expressions now limited to 10,000 operations by default (as of 7.0.8); evaluation halts if exceeded
7.0.0-M1	SpringExtension now uses test-method scoped ExtensionContext instead of test-class scope; may break custom TestExecutionListener implementations in @nested test hierarchies
7.0.0-M1	MutablePersistenceUnitInfo no longer implements jakarta.persistence.spi.PersistenceUnitInfo interface directly
7.0.0-M1	Default DestinationResolver changed to SimpleDestinationResolver which caches Session-resolved Queue and Topic instances
7.0.0-M1	Kotlin Serialization converters/codecs now perform additional check via KotlinDetector#hasSerializableAnnotation by default
7.0.0-M1	GraalVM reachability metadata format changed: resource hints syntax changed from java.util.regex.Pattern to glob pattern format; registration of "excludes" removed; reflection hint registration behavior changed
7.0.0-M1	CORS Pre-Flight requests no longer rejected when CORS configuration is empty
7.0.0-M1	WebClient with Reactor client automatically opts-in for system properties for proxy configuration (https.proxyHost and https.proxyPort)
7.0.0-M1	Baseline requirements raised: Servlet 6.1, JPA 3.2, Bean Validation 3.1, GraalVM 25, Netty 4.2, Kotlin 2.2, JUnit 6
7.0.0-M1	Spring nullness annotations with JSR 305 semantics replaced with JSpecify annotations; nullability of array/vararg elements and generic types now specified
7.0.0-M1	MethodParameter#isOptional behavior changed; now only checks local annotations, not inherited ones

---

Fix Details / Technical Implementation (detailed write-up of what was changed and why)

🤖 Remediation details

Remediate critical and high CVEs in xstream, Tomcat, Spring Framework, Spring Security, Thymeleaf, and Jackson (2.x and 3.x)

What was fixed and where: This PR updates pom.xml to resolve security vulnerabilities in com.thoughtworks.xstream:xstream, org.apache.tomcat.embed:tomcat-embed-core (and related Tomcat artifacts), org.springframework:spring-core (and related Spring Framework artifacts), org.springframework.security:spring-security-core (and related Spring Security artifacts), org.thymeleaf:thymeleaf (and related Thymeleaf artifacts), com.fasterxml.jackson.core:jackson-databind (Jackson 2.x), and tools.jackson.core:jackson-databind / tools.jackson.core:jackson-core (Jackson 3.x). Changes are confined to the root pom.xml: the Spring Boot parent version, the xstream.version property, removal of the stale thymeleaf.version property override, addition of a tools.jackson:jackson-bom BOM import override, and a dependencyManagement entry for io.rest-assured:rest-assured to preserve a version that the new parent no longer manages.

---

com.thoughtworks.xstream:xstream

xstream is declared directly in <dependencyManagement> via the ${xstream.version} property and consumed as a direct dependency. The property was pinned at 1.4.5, which is affected by 36 CVEs spanning RCE, SSRF, and DoS classes. The xstream.version property was bumped to 1.4.20, the minimum version that clears all listed advisories, with no other changes required.

org.apache.tomcat.embed:tomcat-embed-core / org.apache.tomcat:tomcat-*

All Tomcat artifacts are transitive dependencies managed entirely by the Spring Boot parent BOM via its tomcat.version property. Spring Boot 3.5.6 resolved Tomcat at 10.1.46, which is below the 10.1.55 floor required to clear the listed Tomcat CVEs. Bumping the Spring Boot parent to 4.0.8 resolves Tomcat at 11.0.24, which satisfies all required fix versions.

org.springframework:spring-core / spring-webmvc / spring-web / spring-beans / spring-expression / spring-context

All Spring Framework artifacts are transitive dependencies managed by the Spring Boot parent BOM via its spring-framework.version property. Spring Boot 3.5.6 resolved Spring Framework at 6.2.11; the required fix version is 7.0.9, which is a major-line jump that no Spring Boot 3.x release covers. Bumping the Spring Boot parent to 4.0.8 resolves Spring Framework at 7.0.9, satisfying the advisory requirement.

org.springframework.security:spring-security-core / spring-security-config / spring-security-web

All Spring Security artifacts are transitive dependencies managed by the Spring Boot parent BOM via its spring-security.version property. Spring Boot 3.5.6 resolved Spring Security at 6.5.5, below the 6.5.9 floor required by the listed CVE. Bumping the Spring Boot parent to 4.0.8 resolves Spring Security at 7.0.7, which satisfies the requirement.

org.thymeleaf:thymeleaf / thymeleaf-spring5 / thymeleaf-spring6

Thymeleaf artifacts are transitive dependencies managed by the Spring Boot parent BOM. Spring Boot 3.5.6 managed Thymeleaf at 3.1.3.RELEASE, and the project's own thymeleaf.version property was overriding that to the older 3.1.2.RELEASE. Both are below the 3.1.5.RELEASE floor required by the listed CVEs. The thymeleaf.version property override was removed (it was pinning a vulnerable version against the parent), and the Spring Boot parent was bumped to 4.0.8, which manages Thymeleaf at 3.1.5.RELEASE.

com.fasterxml.jackson.core:jackson-databind (Jackson 2.x)

jackson-databind (2.x line, com.fasterxml.jackson.core group) is a transitive dependency managed by the Spring Boot parent BOM via the jackson-bom import. Spring Boot 3.5.6 already resolved this at 2.19.2, which meets the 2.18.8 minimum required by the listed CVEs — no change was needed for the 2.x line itself. The parent bump to 4.0.8 moves it to 2.21.5, which continues to satisfy the requirement.

tools.jackson.core:jackson-databind / tools.jackson.core:jackson-core (Jackson 3.x)

Spring Boot 4.0.8 introduced a dependency on the Jackson 3.x line (tools.jackson.core group) by importing tools.jackson:jackson-bom:3.1.5, which resolves both jackson-core and jackson-databind at 3.1.5. That version is affected by 7 CVEs; the minimum fix version covering all of them is 3.1.7. No Spring Boot 4.x release yet ships tools.jackson:jackson-bom at ≥3.1.7, so a targeted BOM import override — tools.jackson:jackson-bom:3.1.7 as a <scope>import</scope> entry placed at the top of the project's own <dependencyManagement> block — was added. This overrides the parent-inherited BOM and resolves both tools.jackson.core:jackson-core and tools.jackson.core:jackson-databind at 3.1.7.

---

Version changes

Package	From	To	Why updated
org.springframework.boot:spring-boot-starter-parent (parent POM)	3.5.6	4.0.8	Direct fix — required to reach Spring Framework 7.0.9 (no 3.x release covers it)
com.thoughtworks.xstream:xstream	1.4.5	1.4.20	Direct CVE fix — xstream.version property bumped in pom.xml
org.thymeleaf:thymeleaf	3.1.2.RELEASE (property override)	3.1.5.RELEASE (parent-managed)	CVE fix — stale thymeleaf.version property removed; parent now manages patched version
org.thymeleaf:thymeleaf-spring6	3.1.2.RELEASE	3.1.5.RELEASE	Transitive after parent bump + property removal (same Thymeleaf CVE fix)
org.thymeleaf.extras:thymeleaf-extras-springsecurity6	3.1.2.RELEASE	3.1.5.RELEASE	Transitive after parent bump + property removal (same Thymeleaf CVE fix)
tools.jackson.core:jackson-core	3.1.5	3.1.7	CVE fix — tools.jackson:jackson-bom:3.1.7 BOM override added to dependencyManagement
tools.jackson.core:jackson-databind	3.1.5	3.1.7	CVE fix — tools.jackson:jackson-bom:3.1.7 BOM override added to dependencyManagement
com.fasterxml.jackson.core:jackson-databind	2.19.2	2.21.5	Transitive after parent bump (spring-boot-starter-parent 4.0.8)
com.fasterxml.jackson.core:jackson-core	2.19.2	2.21.5	Transitive after parent bump (spring-boot-starter-parent 4.0.8)
org.apache.tomcat.embed:tomcat-embed-core	10.1.46	11.0.24	Transitive after parent bump (spring-boot-starter-parent 4.0.8) — CVE fix
org.apache.tomcat.embed:tomcat-embed-websocket	10.1.46	11.0.24	Transitive after parent bump (spring-boot-starter-parent 4.0.8) — CVE fix
org.apache.tomcat:tomcat-coyote	10.1.46	11.0.24	Transitive after parent bump (spring-boot-starter-parent 4.0.8) — CVE fix
org.apache.tomcat:tomcat-catalina	10.1.46	11.0.24	Transitive after parent bump (spring-boot-starter-parent 4.0.8) — CVE fix
org.apache.tomcat:tomcat-util	10.1.46	11.0.24	Transitive after parent bump (spring-boot-starter-parent 4.0.8) — CVE fix
org.springframework:spring-core	6.2.11	7.0.9	Transitive after parent bump (spring-boot-starter-parent 4.0.8) — CVE fix
org.springframework:spring-webmvc	6.2.11	7.0.9	Transitive after parent bump (spring-boot-starter-parent 4.0.8) — CVE fix
org.springframework:spring-web	6.2.11	7.0.9	Transitive after parent bump (spring-boot-starter-parent 4.0.8) — CVE fix
org.springframework:spring-beans	6.2.11	7.0.9	Transitive after parent bump (spring-boot-starter-parent 4.0.8) — CVE fix
org.springframework:spring-expression	6.2.11	7.0.9	Transitive after parent bump (spring-boot-starter-parent 4.0.8) — CVE fix
org.springframework:spring-context	6.2.11	7.0.9	Transitive after parent bump (spring-boot-starter-parent 4.0.8) — CVE fix
org.springframework.security:spring-security-core	6.5.5	7.0.7	Transitive after parent bump (spring-boot-starter-parent 4.0.8) — CVE fix
org.springframework.security:spring-security-config	6.5.5	7.0.7	Transitive after parent bump (spring-boot-starter-parent 4.0.8) — CVE fix
org.springframework.security:spring-security-web	6.5.5	7.0.7	Transitive after parent bump (spring-boot-starter-parent 4.0.8) — CVE fix
io.rest-assured:rest-assured	5.5.6 (parent-managed)	5.5.6 (explicit dependencyManagement entry)	Parent 4.0.8 dropped rest-assured-bom; version pinned explicitly to preserve build