[aikido-autofix]

Thank you for submitting a pull request to the WebGoat!

---

Summary / Description

Upgrade dependencies to fix critical RCE and arbitrary code execution vulnerabilities in XStream, Spring, and Tomcat. This update includes breaking changes that require manual migration.

---

Security Impact — CVE vulnerabilities fixed by this PR

✅ 67 CVEs resolved by this upgrade, including 18 critical 🚨 CVEs

This PR will resolve the following CVEs:

Issue	Severity	Description
CVE-2021-21345	🚨 CRITICAL	[xstream] A deserialization vulnerability allows remote attackers with sufficient rights to execute arbitrary commands by manipulating input streams. This impacts users relying on the default blacklist security framework rather than implementing a whitelist.
CVE-2013-7285	🚨 CRITICAL	[xstream] API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.
CVE-2021-21344	🚨 CRITICAL	[xstream] A remote code execution vulnerability allows attackers to execute arbitrary code by manipulating input streams, bypassing the default blacklist security framework. Users relying on default security settings must upgrade to mitigate this risk.
CVE-2021-21346	🚨 CRITICAL	[xstream] A remote code execution vulnerability allows attackers to execute arbitrary code by manipulating input streams, bypassing the default blacklist security framework. Users relying on default security settings must upgrade to mitigate this risk.
CVE-2021-21347	🚨 CRITICAL	[xstream] A remote code execution vulnerability allows attackers to execute arbitrary code by manipulating input streams, bypassing the default blacklist security framework. Users relying on default security settings must upgrade to mitigate this risk.
CVE-2021-21350	🚨 CRITICAL	[xstream] Deserialization vulnerability allowing remote code execution through malicious XML input when using default blacklist security settings instead of a whitelist configuration.
CVE-2021-21342	🚨 CRITICAL	[xstream] Deserialization vulnerability allowing attackers to manipulate XML input streams to inject malicious objects, potentially causing server-side request forgery (SSRF) attacks during unmarshalling operations. Default blacklist configurations are vulnerable; whitelist-based security frameworks are unaffected.
CVE-2021-21351	🚨 CRITICAL	[xstream] Deserialization vulnerability allowing remote code execution through malicious XML input when using default blacklist security settings instead of a whitelist configuration.
CVE-2021-39144	🚨 CRITICAL	[xstream] A deserialization vulnerability allows remote attackers with sufficient rights to execute arbitrary commands by manipulating input streams. Users not using XStream's security framework with a whitelist are at risk.
CVE-2020-26217	HIGH	[xstream] A remote code execution vulnerability allows attackers to execute arbitrary shell commands by manipulating input streams when using blocklists. Users relying on allowlists are unaffected.
CVE-2021-29505	HIGH	[xstream] A deserialization vulnerability allows remote attackers to execute arbitrary commands on the host by manipulating input streams when security restrictions are not properly configured. Users with whitelisted type restrictions are not affected.
CVE-2021-21349	HIGH	[xstream] A vulnerability allows remote attackers to access internal resources by manipulating input streams, bypassing the default blacklist security framework. This enables information disclosure of non-public data when using default security settings.
CVE-2021-39141	HIGH	[xstream] Remote attackers can execute arbitrary code by manipulating input streams through unsafe deserialization. This vulnerability allows RCE unless XStream's security framework is configured with a strict whitelist of allowed types.
CVE-2021-39146	HIGH	[xstream] Remote attackers can execute arbitrary code by manipulating input streams through unsafe deserialization. This vulnerability allows RCE unless XStream's security framework is configured with a strict whitelist of allowed types.
CVE-2021-39152	HIGH	[xstream] A deserialization vulnerability allows remote attackers to access internal resources by manipulating input streams on Java 14-8 runtimes. This information disclosure issue bypasses the default blacklist security framework.
CVE-2021-39139	HIGH	[xstream] Deserialization vulnerability allowing remote code execution through malicious XML input when using default settings without security framework restrictions.
CVE-2020-26258	HIGH	[xstream] A Server-Side Request Forgery (SSRF) vulnerability in XStream's unmarshalling process allows remote attackers to access internal resources by manipulating input streams when using the default blacklist security configuration.
CVE-2017-7957	HIGH	[xstream] through 1.4.9, when a certain denyTypes workaround is not used, mishandles attempts to create an instance of the primitive type 'void' during unmarshalling, leading to a remote application crash, as demonstrated by an xstream.fromXML("") call.
CVE-2021-21341	HIGH	[xstream] A vulnerability allows remote attackers to cause denial of service by manipulating input streams to consume 100% CPU resources. This affects systems using default blacklist security settings; whitelist-based configurations are unaffected.
CVE-2022-41966	HIGH	[xstream] A remote attacker can manipulate input streams to trigger recursive hash calculations in collections, causing stack overflow and denial of service. The vulnerability exploits hash code implementations in maps and collections to crash the application.
CVE-2016-3674	HIGH	[xstream] Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files via a crafted XML document.
CVE-2021-39145	HIGH	[xstream] Remote attackers can execute arbitrary code by manipulating input streams through unsafe deserialization. This vulnerability allows RCE unless XStream's security framework is configured with a strict whitelist of allowed types.
CVE-2021-39147	HIGH	[xstream] Remote attackers can execute arbitrary code by manipulating input streams through unsafe deserialization. This vulnerability allows RCE unless XStream's security framework is configured with a strict whitelist of allowed types.
CVE-2021-39148	HIGH	[xstream] Remote attackers can execute arbitrary code by manipulating input streams through unsafe deserialization. This vulnerability allows RCE unless XStream's security framework is configured with a strict whitelist of allowed types.
CVE-2021-39149	HIGH	[xstream] Remote attackers can execute arbitrary code by manipulating input streams through unsafe deserialization. This vulnerability allows RCE unless XStream's security framework is configured with a strict whitelist of allowed types.
CVE-2021-39150	HIGH	[xstream] A deserialization vulnerability allows remote attackers to access internal resources by manipulating input streams on Java 14-8 runtimes. This information disclosure issue bypasses the default blacklist security framework.
CVE-2021-39151	HIGH	[xstream] Remote attackers can execute arbitrary code by manipulating input streams through unsafe deserialization. This vulnerability allows RCE unless XStream's security framework is configured with a strict whitelist of allowed types.
CVE-2021-39153	HIGH	[xstream] A deserialization vulnerability allows remote attackers to execute arbitrary code by manipulating input streams when using Java 14-8 or with JavaFX installed, unless XStream's security whitelist is properly configured.
CVE-2021-39154	HIGH	[xstream] Remote attackers can execute arbitrary code by manipulating input streams through unsafe deserialization. This vulnerability allows RCE unless XStream's security framework is configured with a strict whitelist of allowed types.
CVE-2021-21343	HIGH	[xstream] Deserialization vulnerability allowing arbitrary object instantiation during unmarshalling, enabling attackers to manipulate input streams and delete files on the local system through malicious type information injection.
CVE-2021-21348	HIGH	[xstream] Denial of Service vulnerability allowing remote attackers to consume maximum CPU resources through a malicious serialized object, causing thread hang. Affects systems using default blacklist security configuration.
CVE-2020-26259	MEDIUM	[xstream] XStream is vulnerable to arbitrary file deletion on the local host during unmarshalling when using default blacklist security settings. A remote attacker can delete arbitrary files if the executing process has sufficient permissions.
CVE-2022-40151	MEDIUM	[xstream] Those using Xstream to seralize XML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.
CVE-2021-39140	MEDIUM	[xstream] A vulnerability allows remote attackers to cause denial of service by manipulating input streams to consume 100% CPU resources. This affects systems not using XStream's security framework with a whitelist of minimal required types.
CVE-2021-43859	LOW	[xstream] Deserialization vulnerability allowing remote attackers to cause denial of service by consuming 100% CPU through malicious input stream manipulation. Fixed by implementing time-based threshold monitoring for collection operations.
CVE-2026-41293	🚨 CRITICAL	[tomcat-embed-core] Improper input validation vulnerability allows attackers to bypass security controls or trigger unexpected behavior. Potential impacts include remote code execution, denial of service, or information disclosure depending on exploitation context.
CVE-2026-43512	🚨 CRITICAL	[tomcat-embed-core] Digest authentication bypass vulnerability allowing attackers to bypass authentication mechanisms and gain unauthorized access to protected resources.
CVE-2026-43515	🚨 CRITICAL	[tomcat-embed-core] Improper authorization in method constraints allows attackers to bypass HTTP method restrictions on specific file extensions, potentially enabling unauthorized access to protected resources.
AIKIDO-2026-116174	HIGH	[tomcat-embed-core] DataSourceRealm authentication bypass allows non-existent users to be treated as authenticated when using CLIENT-CERT or SPNEGO authenticators, granting unauthorized access. The vulnerability occurs because authentication fails open instead of rejecting users not found in the configured database.
CVE-2026-24880	HIGH	[tomcat-embed-core] HTTP request smuggling vulnerability via invalid chunk extensions allows attackers to bypass security controls and potentially execute arbitrary code or manipulate request handling.
AIKIDO-2026-388833	HIGH	[tomcat-embed-core] An off-by-one error in RewriteValve causes rewrite processing to skip the first rule, allowing requests to bypass access-control or deny rules and reach blocked resources.
AIKIDO-2026-280397	MEDIUM	[tomcat-embed-core] WebSocket sessions remain open after HTTP session invalidation if the session ID changed after the WebSocket was opened, leaving an authenticated channel accessible past logout. This allows attackers to maintain unauthorized access to authenticated WebSocket connections.
CVE-2026-25854	MEDIUM	[tomcat-embed-core] Open redirect vulnerability in LoadBalancerDrainingValve allows attackers to redirect users to untrusted sites. This could enable phishing attacks or malicious redirects to compromise user security.
AIKIDO-2026-189764	MEDIUM	[tomcat-embed-core] A vulnerability allows users with only a referenced role name to bypass declarative role constraints in web.xml, weakening security checks. The issue stems from incorrectly treating security-role-ref entries as Realm role aliases instead of only Request.isUserInRole() mappings.
AIKIDO-2026-262210	MEDIUM	[tomcat-embed-core] A time-of-check time-of-use race condition in Unix domain socket creation allows unauthorized local users to access the Tomcat connector during a permission setup window. This enables local privilege escalation and unauthorized access to the connector.
CVE-2025-61795	MEDIUM	[tomcat-embed-core] Temporary files from multipart uploads aren't cleaned up immediately during errors, allowing disk space to fill faster than garbage collection clears it, causing denial of service.
AIKIDO-2026-915093	LOW	[tomcat-embed-core] tomcat-embed-core leaks allocations in HTTP/2 backlog tracking when a stream is reset. A remote client can reset streams to consume tracking resources. Repeated resets can exhaust the server and deny service. The fix releases backlog tracking state when a stream is reset.
CVE-2026-47884	🚨 CRITICAL	[spring-core] XsltView in Spring MVC with "/**" mapping and unspecified view names allows attackers to perform SSRF and RCE attacks through view rendering exploitation.
AIKIDO-2026-11158	HIGH	[spring-core] Due to incorrect escaping, the use of JavaScriptUtils.javaScriptEscape() may lead to JavaScript code injection in the browser, potentially resulting in a cross-site scripting (XSS) vulnerability.
AIKIDO-2026-620042	LOW	[spring-core] A vulnerability allows CR/LF characters from untrusted file names to be embedded in HTTP response headers or multipart content, potentially enabling HTTP response splitting attacks. The patch sanitizes file names used in Content-Disposition headers to prevent this injection.
CVE-2026-22732	🚨 CRITICAL	[spring-security-core] HTTP response security headers may not be written to responses in servlet applications using lazy header writing, potentially allowing security headers to be bypassed and exposing applications to attacks that these headers would normally prevent.
CVE-2026-40477	🚨 CRITICAL	[thymeleaf-spring5] Server-Side Template Injection (SSTI) vulnerability allowing attackers to bypass expression restrictions and access sensitive objects through unvalidated user input. An unauthenticated remote attacker can execute arbitrary code on the server.
CVE-2026-41901	🚨 CRITICAL	[thymeleaf-spring5] Server-Side Template Injection (SSTI) vulnerability in sandboxed expression contexts allows attackers to execute arbitrary code when unsanitized user input is processed in restricted template contexts.
AIKIDO-2026-10651	🚨 CRITICAL	[thymeleaf-spring5] Expression execution bypass in sandboxed contexts allows Server-Side Template Injection (SSTI) when unsanitized variables containing dangerous expressions are processed in restricted template contexts.
AIKIDO-2026-10649	🚨 CRITICAL	[thymeleaf-spring5] Expression execution bypass in sandboxed contexts allows Server-Side Template Injection (SSTI) when unsanitized variables containing dangerous expressions are processed in restricted template contexts.
CVE-2026-40478	HIGH	[thymeleaf-spring5] Server-Side Template Injection (SSTI) vulnerability allowing attackers to bypass expression execution protections and execute unauthorized code through unvalidated user input. Remote code execution is possible when user input is passed directly to the template engine.
AIKIDO-2026-665392	HIGH	[jackson-core] A non-blocking parser fails to validate integer length limits when running out of input, allowing attackers to exhaust heap memory by sending a stream of digits without terminators on a single connection.
CVE-2026-54512	HIGH	[jackson-databind] Polymorphic type validator bypass allows attackers to deserialize denied classes by hiding them as generic type parameters within allowed container types. This enables remote code execution through instantiation and property population of malicious gadget classes.
CVE-2026-54513	HIGH	[jackson-databind] BasicPolymorphicTypeValidator's allowIfSubTypeIsArray() method fails to validate array component types against the allowlist, allowing deserialization of non-allowlisted types as array elements. This bypasses type validation and enables remote code execution through malicious object instantiation.
AIKIDO-2026-11184	HIGH	[spring-data-commons] A property-lookup cache accepts attacker-supplied strings as permanent cache keys, enabling heap exhaustion denial-of-service attacks through repeated requests. Vulnerable applications use Querydsl web bindings or @ProjectedPayload form-parameter binding that forward unfiltered HTTP-supplied strings to PropertyPath.from.
AIKIDO-2026-11186	LOW	[spring-data-commons] Spring Data Commons applications may be vulnerable to denial of service through resource exhaustion when attacker-controlled property path strings are passed to MappingContext property path resolution.
AIKIDO-2026-11185	LOW	[spring-data-commons] Malicious Sort parameters can cause a StackOverflowException, leading to Denial of Service when endpoints accept untrusted Sort input or use @ProjectedPayload/@QuerydslPredicate annotations without sanitization.
AIKIDO-2026-11183	LOW	[spring-data-commons] A vulnerability in Spring Data Web Support with @ProjectedPayload allows attackers to trigger excessive memory allocation through specially crafted HTTP requests, causing Denial of Service.
AIKIDO-2026-61483	HIGH	[spring-security-oauth2-jose] A bounded cache used for DPoP proof replay protection can be flooded by an attacker, causing legitimate proof values to be evicted and allowing replay attacks to impersonate users. This vulnerability enables authentication bypass and account takeover through proof interception and replay.
AIKIDO-2026-10660	HIGH	[spring-boot] Insecure temporary directory handling allows a local attacker to predict and take control of temp directories without ownership verification. This enables session hijacking or remote code execution when persistent sessions are enabled.
AIKIDO-2026-10583	MEDIUM	[spring-boot] A weak pseudo-random number generator is used for ${random.value}, generating predictable values unsuitable for secrets. This can weaken tokens, passwords, and other security-sensitive data derived from these properties.
AIKIDO-2026-10581	MEDIUM	[spring-boot] ApplicationPidFileWriter improperly follows symlinks when writing PID files at predictable paths, allowing local attackers with write access to cause arbitrary file corruption on application startup.

---

Breaking Changes & Upgrade Impact — prefer Warnings / Cautions / ⚠️ sections over implementation sections (upgrade risks, breaking changes, manual migration steps)

⚠️ Incomplete breaking changes analysis (22/25 analyzed)

⚠️ Breaking changes analysis not available for: com.thoughtworks.xstream:xstream, com.fasterxml.jackson.core:jackson-databind, org.springframework.security:spring-security-oauth2-jose

⚠️ The Spring Framework upgrade from 6.2.11 to 7.0.9 introduces a breaking change that affects this codebase:

WebJars support removal

• Where your code is affected:

  • pom.xml lines 103, 217-219: Dependency on org.webjars:webjars-locator-core version 0.59

  • src/main/resources/webwolf/templates/fragments/header.html lines 6-9: Thymeleaf templates using @{/webjars/...} paths for Bootstrap and jQuery resources

  • src/main/java/org/owasp/webgoat/webwolf/WebSecurityConfig.java line 15: Security configuration permitting access to /webjars/** paths

  • src/main/java/org/owasp/webgoat/webwolf/requests/WebWolfTraceRepository.java line 8: Trace repository filtering /webjars/ paths

• Impact: Spring Framework 7.0 removes built-in WebJars support with org.webjars:webjars-locator-core. The automatic version resolution for WebJars resources will no longer work, causing 404 errors when loading Bootstrap and jQuery assets in the WebWolf application.

• Remediation: Replace WebJars resource paths with explicit versioned paths (e.g., /webjars/bootstrap/5.3.5/css/bootstrap.min.css) or migrate to serving static assets directly from the classpath without WebJars dependency. Remove the webjars-locator-core dependency from pom.xml and update all template references accordingly.

All breaking changes by upgrading org.springframework:spring-core from version 6.2.11 to 7.0.9 (CHANGELOG)

Version	Description
7.0.0-M1	Spring JCL module (spring-jcl) has been removed in favor of Apache Commons Logging 1.3.0
7.0.0-M1	Support for javax.annotation and javax.inject annotations removed; must migrate to jakarta.annotation and jakarta.inject packages
7.0.0-M1	Deprecated path mapping options removed: suffixPatternMatch, registeredSuffixPatternMatch, trailingSlashMatch, favorPathExtension, ignoreUnknownPathExtensions, and matchOptionalTrailingSeparator
7.0.0-M1	Undertow support removed (WebSocket and WebFlux HTTP support classes)
7.0.0-M1	ListenableFuture removed in favor of CompletableFuture
7.0.0-M1	WebJars support with org.webjars:webjars-locator-core removed
7.0.0-M1	OkHttp3 support removed
7.0.0-M1	Theme support removed
7.0.0-M1	HttpComponentsClientHttpRequestFactory#setConnectTimeout methods removed
7.0.0-M1	JdbcOperations Kotlin extensions with Array parameters replaced by vararg variants
7.0.0-M1	HttpHeaders no longer extends MultiValueMap contract; several methods removed
7.0.0-M1	SpEL expressions now limited to 10,000 operations by default (as of 7.0.8); evaluation halts if exceeded
7.0.0-M1	SpringExtension now uses test-method scoped ExtensionContext instead of test-class scope; may break custom TestExecutionListener implementations in @nested test hierarchies
7.0.0-M1	MutablePersistenceUnitInfo no longer implements jakarta.persistence.spi.PersistenceUnitInfo interface directly
7.0.0-M1	Default DestinationResolver changed to SimpleDestinationResolver which caches Session-resolved Queue and Topic instances
7.0.0-M1	Kotlin Serialization converters/codecs now perform additional check via KotlinDetector#hasSerializableAnnotation by default
7.0.0-M1	GraalVM reachability metadata format changed: resource hints syntax changed from java.util.regex.Pattern to glob pattern format; registration of "excludes" removed; reflection hint registration behavior changed
7.0.0-M1	CORS Pre-Flight requests no longer rejected when CORS configuration is empty
7.0.0-M1	WebClient with Reactor client automatically opts-in for system properties for proxy configuration (https.proxyHost and https.proxyPort)
7.0.0-M1	Baseline requirements raised: Servlet 6.1, JPA 3.2, Bean Validation 3.1, GraalVM 25, Netty 4.2, Kotlin 2.2, JUnit 6
7.0.0-M1	Spring nullness annotations with JSR 305 semantics replaced with JSpecify annotations; nullability of array/vararg elements and generic types now specified
7.0.0-M1	MethodParameter#isOptional behavior changed; now only checks local annotations, not inherited ones

All breaking changes by upgrading org.springframework:spring-webmvc from version 6.2.11 to 7.0.9 (CHANGELOG)

Version	Description
7.0.0-M1	Spring JCL module (spring-jcl) has been removed in favor of Apache Commons Logging 1.3.0
7.0.0-M1	Support for javax.annotation and javax.inject annotations removed; must migrate to jakarta.annotation and jakarta.inject packages
7.0.0-M1	Deprecated path mapping options removed: suffixPatternMatch, registeredSuffixPatternMatch, trailingSlashMatch, favorPathExtension, ignoreUnknownPathExtensions, and matchOptionalTrailingSeparator
7.0.0-M1	Undertow support removed (WebSocket and WebFlux HTTP support classes)
7.0.0-M1	ListenableFuture removed in favor of CompletableFuture
7.0.0-M1	WebJars support with org.webjars:webjars-locator-core removed
7.0.0-M1	OkHttp3 support removed
7.0.0-M1	Theme support removed
7.0.0-M1	HttpComponentsClientHttpRequestFactory#setConnectTimeout methods removed
7.0.0-M1	JdbcOperations Kotlin extensions with Array parameters replaced by vararg variants
7.0.0-M1	HttpHeaders no longer extends MultiValueMap contract; several methods removed
7.0.0-M1	SpEL expressions now limited to 10,000 operations by default (as of 7.0.8); evaluation halts if exceeded
7.0.0-M1	SpringExtension now uses test-method scoped ExtensionContext instead of test-class scope; may break custom TestExecutionListener implementations in @nested test hierarchies
7.0.0-M1	MutablePersistenceUnitInfo no longer implements jakarta.persistence.spi.PersistenceUnitInfo interface directly
7.0.0-M1	Default DestinationResolver changed to SimpleDestinationResolver which caches Session-resolved Queue and Topic instances
7.0.0-M1	Kotlin Serialization converters/codecs now perform additional check via KotlinDetector#hasSerializableAnnotation by default
7.0.0-M1	GraalVM reachability metadata format changed: resource hints syntax changed from java.util.regex.Pattern to glob pattern format; registration of "excludes" removed; reflection hint registration behavior changed
7.0.0-M1	CORS Pre-Flight requests no longer rejected when CORS configuration is empty
7.0.0-M1	WebClient with Reactor client automatically opts-in for system properties for proxy configuration (https.proxyHost and https.proxyPort)
7.0.0-M1	Baseline requirements raised: Servlet 6.1, JPA 3.2, Bean Validation 3.1, GraalVM 25, Netty 4.2, Kotlin 2.2, JUnit 6
7.0.0-M1	Spring nullness annotations with JSR 305 semantics replaced with JSpecify annotations; nullability of array/vararg elements and generic types now specified
7.0.0-M1	MethodParameter#isOptional behavior changed; now only checks local annotations, not inherited ones

All breaking changes by upgrading org.springframework:spring-web from version 6.2.11 to 7.0.9 (CHANGELOG)

Version	Description
7.0.0-M1	Spring JCL module (spring-jcl) has been removed in favor of Apache Commons Logging 1.3.0
7.0.0-M1	Support for javax.annotation and javax.inject annotations removed; must migrate to jakarta.annotation and jakarta.inject packages
7.0.0-M1	Deprecated path mapping options removed: suffixPatternMatch, registeredSuffixPatternMatch, trailingSlashMatch, favorPathExtension, ignoreUnknownPathExtensions, and matchOptionalTrailingSeparator
7.0.0-M1	Undertow support removed (WebSocket and WebFlux HTTP support classes)
7.0.0-M1	ListenableFuture removed in favor of CompletableFuture
7.0.0-M1	WebJars support with org.webjars:webjars-locator-core removed
7.0.0-M1	OkHttp3 support removed
7.0.0-M1	Theme support removed
7.0.0-M1	HttpComponentsClientHttpRequestFactory#setConnectTimeout methods removed
7.0.0-M1	JdbcOperations Kotlin extensions with Array parameters replaced by vararg variants
7.0.0-M1	HttpHeaders no longer extends MultiValueMap contract; several methods removed
7.0.0-M1	SpEL expressions now limited to 10,000 operations by default (as of 7.0.8); evaluation halts if exceeded
7.0.0-M1	SpringExtension now uses test-method scoped ExtensionContext instead of test-class scope; may break custom TestExecutionListener implementations in @nested test hierarchies
7.0.0-M1	MutablePersistenceUnitInfo no longer implements jakarta.persistence.spi.PersistenceUnitInfo interface directly
7.0.0-M1	Default DestinationResolver changed to SimpleDestinationResolver which caches Session-resolved Queue and Topic instances
7.0.0-M1	Kotlin Serialization converters/codecs now perform additional check via KotlinDetector#hasSerializableAnnotation by default
7.0.0-M1	GraalVM reachability metadata format changed: resource hints syntax changed from java.util.regex.Pattern to glob pattern format; registration of "excludes" removed; reflection hint registration behavior changed
7.0.0-M1	CORS Pre-Flight requests no longer rejected when CORS configuration is empty
7.0.0-M1	WebClient with Reactor client automatically opts-in for system properties for proxy configuration (https.proxyHost and https.proxyPort)
7.0.0-M1	Baseline requirements raised: Servlet 6.1, JPA 3.2, Bean Validation 3.1, GraalVM 25, Netty 4.2, Kotlin 2.2, JUnit 6
7.0.0-M1	Spring nullness annotations with JSR 305 semantics replaced with JSpecify annotations; nullability of array/vararg elements and generic types now specified
7.0.0-M1	MethodParameter#isOptional behavior changed; now only checks local annotations, not inherited ones

All breaking changes by upgrading org.springframework:spring-beans from version 6.2.11 to 7.0.9 (CHANGELOG)

Version	Description
7.0.0-M1	Spring JCL module (spring-jcl) has been removed in favor of Apache Commons Logging 1.3.0
7.0.0-M1	Support for javax.annotation and javax.inject annotations removed; must migrate to jakarta.annotation and jakarta.inject packages
7.0.0-M1	Deprecated path mapping options removed: suffixPatternMatch, registeredSuffixPatternMatch, trailingSlashMatch, favorPathExtension, ignoreUnknownPathExtensions, and matchOptionalTrailingSeparator
7.0.0-M1	Undertow support removed (WebSocket and WebFlux HTTP support classes)
7.0.0-M1	ListenableFuture removed in favor of CompletableFuture
7.0.0-M1	WebJars support with org.webjars:webjars-locator-core removed
7.0.0-M1	OkHttp3 support removed
7.0.0-M1	Theme support removed
7.0.0-M1	HttpComponentsClientHttpRequestFactory#setConnectTimeout methods removed
7.0.0-M1	JdbcOperations Kotlin extensions with Array parameters replaced by vararg variants
7.0.0-M1	HttpHeaders no longer extends MultiValueMap contract; several methods removed
7.0.0-M1	SpEL expressions now limited to 10,000 operations by default (as of 7.0.8); evaluation halts if exceeded
7.0.0-M1	SpringExtension now uses test-method scoped ExtensionContext instead of test-class scope; may break custom TestExecutionListener implementations in @nested test hierarchies
7.0.0-M1	MutablePersistenceUnitInfo no longer implements jakarta.persistence.spi.PersistenceUnitInfo interface directly
7.0.0-M1	Default DestinationResolver changed to SimpleDestinationResolver which caches Session-resolved Queue and Topic instances
7.0.0-M1	Kotlin Serialization converters/codecs now perform additional check via KotlinDetector#hasSerializableAnnotation by default
7.0.0-M1	GraalVM reachability metadata format changed: resource hints syntax changed from java.util.regex.Pattern to glob pattern format; registration of "excludes" removed; reflection hint registration behavior changed
7.0.0-M1	CORS Pre-Flight requests no longer rejected when CORS configuration is empty
7.0.0-M1	WebClient with Reactor client automatically opts-in for system properties for proxy configuration (https.proxyHost and https.proxyPort)
7.0.0-M1	Baseline requirements raised: Servlet 6.1, JPA 3.2, Bean Validation 3.1, GraalVM 25, Netty 4.2, Kotlin 2.2, JUnit 6
7.0.0-M1	Spring nullness annotations with JSR 305 semantics replaced with JSpecify annotations; nullability of array/vararg elements and generic types now specified
7.0.0-M1	MethodParameter#isOptional behavior changed; now only checks local annotations, not inherited ones

All breaking changes by upgrading org.springframework:spring-expression from version 6.2.11 to 7.0.9 (CHANGELOG)

Version	Description
7.0.0-M1	Spring JCL module (spring-jcl) has been removed in favor of Apache Commons Logging 1.3.0
7.0.0-M1	Support for javax.annotation and javax.inject annotations removed; must migrate to jakarta.annotation and jakarta.inject packages
7.0.0-M1	Deprecated path mapping options removed: suffixPatternMatch, registeredSuffixPatternMatch, trailingSlashMatch, favorPathExtension, ignoreUnknownPathExtensions, and matchOptionalTrailingSeparator
7.0.0-M1	Undertow support removed (WebSocket and WebFlux HTTP support classes)
7.0.0-M1	ListenableFuture removed in favor of CompletableFuture
7.0.0-M1	WebJars support with org.webjars:webjars-locator-core removed
7.0.0-M1	OkHttp3 support removed
7.0.0-M1	Theme support removed
7.0.0-M1	HttpComponentsClientHttpRequestFactory#setConnectTimeout methods removed
7.0.0-M1	JdbcOperations Kotlin extensions with Array parameters replaced by vararg variants
7.0.0-M1	HttpHeaders no longer extends MultiValueMap contract; several methods removed
7.0.0-M1	SpEL expressions now limited to 10,000 operations by default (as of 7.0.8); evaluation halts if exceeded
7.0.0-M1	SpringExtension now uses test-method scoped ExtensionContext instead of test-class scope; may break custom TestExecutionListener implementations in @nested test hierarchies
7.0.0-M1	MutablePersistenceUnitInfo no longer implements jakarta.persistence.spi.PersistenceUnitInfo interface directly
7.0.0-M1	Default DestinationResolver changed to SimpleDestinationResolver which caches Session-resolved Queue and Topic instances
7.0.0-M1	Kotlin Serialization converters/codecs now perform additional check via KotlinDetector#hasSerializableAnnotation by default
7.0.0-M1	GraalVM reachability metadata format changed: resource hints syntax changed from java.util.regex.Pattern to glob pattern format; registration of "excludes" removed; reflection hint registration behavior changed
7.0.0-M1	CORS Pre-Flight requests no longer rejected when CORS configuration is empty
7.0.0-M1	WebClient with Reactor client automatically opts-in for system properties for proxy configuration (https.proxyHost and https.proxyPort)
7.0.0-M1	Baseline requirements raised: Servlet 6.1, JPA 3.2, Bean Validation 3.1, GraalVM 25, Netty 4.2, Kotlin 2.2, JUnit 6
7.0.0-M1	Spring nullness annotations with JSR 305 semantics replaced with JSpecify annotations; nullability of array/vararg elements and generic types now specified
7.0.0-M1	MethodParameter#isOptional behavior changed; now only checks local annotations, not inherited ones

All breaking changes by upgrading org.springframework:spring-context from version 6.2.11 to 7.0.9 (CHANGELOG)

Version	Description
7.0.0-M1	Spring JCL module (spring-jcl) has been removed in favor of Apache Commons Logging 1.3.0
7.0.0-M1	Support for javax.annotation and javax.inject annotations removed; must migrate to jakarta.annotation and jakarta.inject packages
7.0.0-M1	Deprecated path mapping options removed: suffixPatternMatch, registeredSuffixPatternMatch, trailingSlashMatch, favorPathExtension, ignoreUnknownPathExtensions, and matchOptionalTrailingSeparator
7.0.0-M1	Undertow support removed (WebSocket and WebFlux HTTP support classes)
7.0.0-M1	ListenableFuture removed in favor of CompletableFuture
7.0.0-M1	WebJars support with org.webjars:webjars-locator-core removed
7.0.0-M1	OkHttp3 support removed
7.0.0-M1	Theme support removed
7.0.0-M1	HttpComponentsClientHttpRequestFactory#setConnectTimeout methods removed
7.0.0-M1	JdbcOperations Kotlin extensions with Array parameters replaced by vararg variants
7.0.0-M1	HttpHeaders no longer extends MultiValueMap contract; several methods removed
7.0.0-M1	SpEL expressions now limited to 10,000 operations by default (as of 7.0.8); evaluation halts if exceeded
7.0.0-M1	SpringExtension now uses test-method scoped ExtensionContext instead of test-class scope; may break custom TestExecutionListener implementations in @nested test hierarchies
7.0.0-M1	MutablePersistenceUnitInfo no longer implements jakarta.persistence.spi.PersistenceUnitInfo interface directly
7.0.0-M1	Default DestinationResolver changed to SimpleDestinationResolver which caches Session-resolved Queue and Topic instances
7.0.0-M1	Kotlin Serialization converters/codecs now perform additional check via KotlinDetector#hasSerializableAnnotation by default
7.0.0-M1	GraalVM reachability metadata format changed: resource hints syntax changed from java.util.regex.Pattern to glob pattern format; registration of "excludes" removed; reflection hint registration behavior changed
7.0.0-M1	CORS Pre-Flight requests no longer rejected when CORS configuration is empty
7.0.0-M1	WebClient with Reactor client automatically opts-in for system properties for proxy configuration (https.proxyHost and https.proxyPort)
7.0.0-M1	Baseline requirements raised: Servlet 6.1, JPA 3.2, Bean Validation 3.1, GraalVM 25, Netty 4.2, Kotlin 2.2, JUnit 6
7.0.0-M1	Spring nullness annotations with JSR 305 semantics replaced with JSpecify annotations; nullability of array/vararg elements and generic types now specified
7.0.0-M1	MethodParameter#isOptional behavior changed; now only checks local annotations, not inherited ones

---

Fix Details / Technical Implementation (detailed write-up of what was changed and why)

🤖 Remediation details

Remediate multiple critical and high CVEs in pom.xml across XStream, Apache Tomcat, Spring Boot, Spring Security, Thymeleaf, and Jackson

Short summary

This PR fixes security vulnerabilities in the following packages declared or transitively resolved in the root pom.xml: com.thoughtworks.xstream:xstream, org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat.embed:tomcat-embed-websocket, org.apache.tomcat.embed:tomcat-embed-el, org.springframework.boot:spring-boot (and its managed ecosystem), org.springframework.security:spring-security-core/config/web, org.thymeleaf:thymeleaf / thymeleaf-spring6, com.fasterxml.jackson.core:jackson-core / jackson-databind, org.springframework.data:spring-data-commons, and org.springframework.security:spring-security-oauth2-jose. The fixes are applied entirely in the root pom.xml via a parent POM bump, two property changes, and targeted dependencyManagement overrides.

---

com.thoughtworks.xstream:xstream

Declared directly in pom.xml via the <xstream.version> property and a dependencyManagement entry. The property was bumped from 1.4.5 to 1.4.20, which is the minimum version that clears the full set of deserialization and remote-code-execution vulnerabilities spanning CVEs from 2013 through 2022. No parent or BOM manages this artifact, so the property update is the sole required change.

org.springframework.boot:spring-boot (and spring-boot-loader, spring-boot-dependencies)

The Spring Boot parent POM was bumped from 3.5.6 to 3.5.16 in the <parent> block. This is the primary lever for the majority of the ecosystem fixes: Spring Boot 3.5.16 is the smallest 3.5.x release that brings spring-boot itself to 3.5.16 (≥ 3.5.14 required), resolves the Spring Security BOM to 6.5.11, the Thymeleaf version to 3.1.5.RELEASE, the Spring Data BOM to a release managing spring-data-commons at 3.5.13, and the Jackson BOM to 2.21.4 — all within the same major line and without breaking API compatibility.

org.springframework.security:spring-security-core

org.springframework.security:spring-security-config

org.springframework.security:spring-security-web

These three artifacts are managed transitively through the spring-security-bom imported by the Spring Boot parent BOM. Bumping the parent from 3.5.6 to 3.5.16 advances the managed Spring Security version from 6.5.5 to 6.5.11, satisfying the ≥ 6.5.9 requirement. No direct declaration or override is needed.

org.springframework.security:spring-security-oauth2-jose

Also managed through the spring-security-bom imported by the Spring Boot parent; the parent bump to 3.5.16 advances this artifact from 6.5.5 to 6.5.11. The advisory AIKIDO-2026-61483 requires version 7.0.7 or 7.1.1, which belong to Spring Security 7.x — a generation that requires Spring Framework 7.x and Spring Boot 4.x. Upgrading the parent to Spring Boot 4.x would be a prohibited major-version bump, and forcing spring-security-oauth2-jose:7.0.7 via dependencyManagement alone would pull in incompatible Spring Security 7.x and Spring Framework 7.x transitive dependencies, breaking the application. This advisory therefore remains unresolved within the constraints of the current major line.

org.thymeleaf:thymeleaf

org.thymeleaf:thymeleaf-spring6

Previously the <thymeleaf.version> property in pom.xml was set to 3.1.2.RELEASE, overriding the parent BOM and pinning Thymeleaf below the patched version. The property was removed entirely; Spring Boot 3.5.16 now manages Thymeleaf at 3.1.5.RELEASE natively, satisfying the requirement for both thymeleaf and thymeleaf-spring6 without any local override.

org.apache.tomcat.embed:tomcat-embed-core

org.apache.tomcat.embed:tomcat-embed-websocket

org.apache.tomcat.embed:tomcat-embed-el

Spring Boot 3.5.16 manages Tomcat at 10.1.55, which is below the 10.1.59 floor required by the Tomcat advisories. No 3.5.x Spring Boot release manages Tomcat at ≥ 10.1.59 (that requires Spring Boot 4.x). Explicit dependencyManagement entries were added for tomcat-embed-core, tomcat-embed-websocket, and tomcat-embed-el all pinned to 10.1.59, overriding the parent BOM value for all three embed artifacts consistently.

com.fasterxml.jackson.core:jackson-core

com.fasterxml.jackson.core:jackson-databind

The parent bump to Spring Boot 3.5.16 advances the managed jackson-bom from 2.21.4 (as of 3.5.6) to 2.21.4 — the same patch level — which is insufficient for the new advisories CVE-2026-59889 and GHSA-mhm7-754m-9p8w, both requiring ≥ 2.21.5. No 3.5.x Spring Boot release manages jackson-bom at 2.21.5. A dependencyManagement BOM import of com.fasterxml.jackson:jackson-bom:2.21.5 was added at the top of the <dependencyManagement> block so it takes first-declaration precedence over the Spring Boot BOM's import, advancing jackson-core, jackson-databind, and all sibling Jackson 2.x artifacts to 2.21.5.

org.springframework.data:spring-data-commons

Managed transitively via the spring-data-bom imported by the Spring Boot parent. The parent bump to 3.5.16 advances the Spring Data BOM to 2025.0.13, which manages spring-data-commons at 3.5.13 (≥ 3.5.12 required). No additional override is needed.

org.springframework:spring-web

org.springframework:spring-webmvc

org.springframework:spring-core

org.springframework:spring-beans

org.springframework:spring-expression

org.springframework:spring-context

Managed via the spring-framework-bom imported by the Spring Boot parent. The parent bump to 3.5.16 advances Spring Framework from 6.2.11 to 6.2.19, satisfying AIKIDO-2026-11158 (requires ≥ 6.2.19). CVE-2026-47884 requires Spring Framework 7.0.9, which exists only in the 7.x generation. Spring Framework 7.x is exclusively supported by Spring Boot 4.x; forcing it via dependencyManagement into a Spring Boot 3.x project would cause binary-incompatible runtime failures across all Spring Boot autoconfiguration. Upgrading the parent to Spring Boot 4.x is a prohibited major-version bump. CVE-2026-47884 cannot be remediated within the Spring Boot 3.x major line.

---

Version changes

Package	From	To	Why updated
org.springframework.boot:spring-boot-starter-parent (parent POM)	3.5.6	3.5.16	Direct parent bump — primary fix vehicle for Spring Boot, Security, Thymeleaf, Spring Data, Spring Framework, Jackson
com.thoughtworks.xstream:xstream	1.4.5	1.4.20	Direct CVE fix via xstream.version property
org.thymeleaf:thymeleaf	3.1.2.RELEASE (property override)	3.1.5.RELEASE (parent-managed)	Removed pinning property; parent now manages patched version
org.thymeleaf:thymeleaf-spring6	3.1.2.RELEASE (property override)	3.1.5.RELEASE (parent-managed)	Removed pinning property; parent now manages patched version
org.springframework.boot:spring-boot	3.5.6	3.5.16	Transitive after parent bump
org.springframework.boot:spring-boot-loader	3.5.6	3.5.16	Transitive after parent bump
org.springframework.security:spring-security-core	6.5.5	6.5.11	Transitive after parent bump (spring-security-bom)
org.springframework.security:spring-security-config	6.5.5	6.5.11	Transitive after parent bump (spring-security-bom)
org.springframework.security:spring-security-web	6.5.5	6.5.11	Transitive after parent bump (spring-security-bom)
org.springframework.security:spring-security-oauth2-jose	6.5.5	6.5.11	Transitive after parent bump (spring-security-bom)
org.springframework:spring-web	6.2.11	6.2.19	Transitive after parent bump (spring-framework-bom)
org.springframework:spring-webmvc	6.2.11	6.2.19	Transitive after parent bump (spring-framework-bom)
org.springframework:spring-core	6.2.11	6.2.19	Transitive after parent bump (spring-framework-bom)
org.springframework:spring-beans	6.2.11	6.2.19	Transitive after parent bump (spring-framework-bom)
org.springframework:spring-expression	6.2.11	6.2.19	Transitive after parent bump (spring-framework-bom)
org.springframework:spring-context	6.2.11	6.2.19	Transitive after parent bump (spring-framework-bom)
org.springframework.data:spring-data-commons	3.5.4	3.5.13	Transitive after parent bump (spring-data-bom)
org.apache.tomcat.embed:tomcat-embed-core	10.1.46	10.1.59	Direct CVE fix via dependencyManagement override (parent only provides 10.1.55)
org.apache.tomcat.embed:tomcat-embed-websocket	10.1.46	10.1.59	Direct CVE fix via dependencyManagement override (parent only provides 10.1.55)
org.apache.tomcat.embed:tomcat-embed-el	10.1.46	10.1.59	Sibling override aligned with tomcat-embed-core/websocket fix
com.fasterxml.jackson.core:jackson-core	2.19.2	2.21.5	Direct CVE fix via jackson-bom:2.21.5 dependencyManagement import override
com.fasterxml.jackson.core:jackson-databind	2.19.2	2.21.5	Direct CVE fix via jackson-bom:2.21.5 dependencyManagement import override

[aikido-autofix]

Aikido's automated cron job opened a newer AutoFix. It fixes the same vulnerabilities and more: [Aikido] Fix 2 critical issues in spring-core, spring-webmvc, spring-web and 6 more and 46 other issues