From c3c8f96eeb607205927def993c5c409733cba9df Mon Sep 17 00:00:00 2001
From: Javier Aliaga <javier@diagrid.io>
Date: Wed, 28 Oct 2026 11:54:35 +0100
Subject: [PATCH 1/2] fix: bump dependencies to address CVEs on release-1.18

- Netty 4.1.135.Final -> 4.1.139.Final (CVE-2026-75595 and other 4.1.x fixes)
- Jackson 2.21.5 -> 2.21.8 and Jackson 3 BOM 3.1.4 -> 3.1.8
- Spring Boot 4 modules 4.0.5 -> 4.0.9 (Spring Boot, Spring Framework,
  Spring Data, Netty 4.2 and log4j fixes)
- Pin Guava 33.7.2-jre in the parent and sdk-bom; protobuf-java-util
  brings 32.0.1-jre (CVE-2026-102554)

Signed-off-by: Javier Aliaga <javier@diagrid.io>
---
 dapr-spring/dapr-spring-6-data/pom.xml              |  2 +-
 .../dapr-spring-boot-4-autoconfigure/pom.xml        |  4 ++--
 .../dapr-spring-boot-4-starter-test/pom.xml         |  2 +-
 .../dapr-spring-boot-4-starter/pom.xml              |  2 +-
 pom.xml                                             | 13 ++++++++++---
 sdk-bom/pom.xml                                     | 13 ++++++++++---
 spring-boot-4-examples/pom.xml                      |  4 ++--
 spring-boot-4-sdk-tests/pom.xml                     |  2 +-
 8 files changed, 28 insertions(+), 14 deletions(-)

diff --git a/dapr-spring/dapr-spring-6-data/pom.xml b/dapr-spring/dapr-spring-6-data/pom.xml
index 0079ce8c81..5e2a886a69 100644
--- a/dapr-spring/dapr-spring-6-data/pom.xml
+++ b/dapr-spring/dapr-spring-6-data/pom.xml
@@ -17,7 +17,7 @@
   <packaging>jar</packaging>
 
   <properties>
-    <springboot4.version>4.0.5</springboot4.version>
+    <springboot4.version>4.0.9</springboot4.version>
     <!-- Override JUnit version to align with Spring Boot 4.x -->
     <junit-bom.version>6.0.2</junit-bom.version>
   </properties>
diff --git a/dapr-spring/dapr-spring-boot-4-autoconfigure/pom.xml b/dapr-spring/dapr-spring-boot-4-autoconfigure/pom.xml
index 5597f7e84c..79456b684e 100644
--- a/dapr-spring/dapr-spring-boot-4-autoconfigure/pom.xml
+++ b/dapr-spring/dapr-spring-boot-4-autoconfigure/pom.xml
@@ -16,7 +16,7 @@
   <packaging>jar</packaging>
 
   <properties>
-    <springboot4.version>4.0.5</springboot4.version>
+    <springboot4.version>4.0.9</springboot4.version>
     <!-- Override JUnit version to align with Spring Boot 4.0.x -->
     <junit-bom.version>6.0.2</junit-bom.version>
   </properties>
@@ -27,7 +27,7 @@
       <dependency>
         <groupId>tools.jackson</groupId>
         <artifactId>jackson-bom</artifactId>
-        <version>3.1.4</version>
+        <version>3.1.8</version>
         <type>pom</type>
         <scope>import</scope>
       </dependency>
diff --git a/dapr-spring/dapr-spring-boot-starters/dapr-spring-boot-4-starter-test/pom.xml b/dapr-spring/dapr-spring-boot-starters/dapr-spring-boot-4-starter-test/pom.xml
index 6c5af24143..b1c2353ffe 100644
--- a/dapr-spring/dapr-spring-boot-starters/dapr-spring-boot-4-starter-test/pom.xml
+++ b/dapr-spring/dapr-spring-boot-starters/dapr-spring-boot-4-starter-test/pom.xml
@@ -16,7 +16,7 @@
     <packaging>jar</packaging>
 
     <properties>
-      <springboot4.version>4.0.5</springboot4.version>
+      <springboot4.version>4.0.9</springboot4.version>
       <!-- Override JUnit version to align with Spring Boot 4.x -->
       <junit-bom.version>6.0.2</junit-bom.version>
     </properties>
diff --git a/dapr-spring/dapr-spring-boot-starters/dapr-spring-boot-4-starter/pom.xml b/dapr-spring/dapr-spring-boot-starters/dapr-spring-boot-4-starter/pom.xml
index 731b01f788..4476336ee1 100644
--- a/dapr-spring/dapr-spring-boot-starters/dapr-spring-boot-4-starter/pom.xml
+++ b/dapr-spring/dapr-spring-boot-starters/dapr-spring-boot-4-starter/pom.xml
@@ -16,7 +16,7 @@
   <packaging>jar</packaging>
 
   <properties>
-    <springboot4.version>4.0.5</springboot4.version>
+    <springboot4.version>4.0.9</springboot4.version>
     <!-- Override JUnit version to align with Spring Boot 4.x -->
     <junit-bom.version>6.0.2</junit-bom.version>
   </properties>
diff --git a/pom.xml b/pom.xml
index d814346e7e..defcbd910f 100644
--- a/pom.xml
+++ b/pom.xml
@@ -42,7 +42,7 @@
     <maven.compiler.target>17</maven.compiler.target>
     <maven.compiler.release>17</maven.compiler.release>
     <maven.deploy.skip>true</maven.deploy.skip>
-    <jackson.version>2.21.5</jackson.version>
+    <jackson.version>2.21.8</jackson.version>
     <gpg.skip>true</gpg.skip>
     <spotbugs.fail>true</spotbugs.fail>
     <spotbugs.exclude.filter.file>${maven.multiModuleProjectDirectory}/spotbugs-exclude.xml</spotbugs.exclude.filter.file>
@@ -79,10 +79,12 @@
     <opentelemetry-bom.version>2.1.0</opentelemetry-bom.version>
     <kotlin.version>2.1.0</kotlin.version>
     <rest-assured.version>5.5.1</rest-assured.version>
-    <!-- TODO: Remove netty-bom override once gRPC ships with Netty >= 4.1.135 (CVE-2026-33871, CVE-2026-33870 and later fixes) -->
-    <netty.version>4.1.135.Final</netty.version>
+    <!-- TODO: Remove netty-bom override once gRPC ships with Netty >= 4.1.139 (CVE-2026-75595 and later fixes) -->
+    <netty.version>4.1.139.Final</netty.version>
     <!-- TODO: Remove commons-compress override once testcontainers ships with >= 1.26.0 -->
     <commons-compress.version>1.26.0</commons-compress.version>
+    <!-- TODO: Remove guava override once protobuf-java-util ships with guava >= 33.7.2 (CVE-2026-102554) -->
+    <guava.version>33.7.2-jre</guava.version>
   </properties>
 
   <distributionManagement>
@@ -172,6 +174,11 @@
         <artifactId>commons-compress</artifactId>
         <version>${commons-compress.version}</version>
       </dependency>
+      <dependency>
+        <groupId>com.google.guava</groupId>
+        <artifactId>guava</artifactId>
+        <version>${guava.version}</version>
+      </dependency>
       <dependency>
         <groupId>commons-codec</groupId>
         <artifactId>commons-codec</artifactId>
diff --git a/sdk-bom/pom.xml b/sdk-bom/pom.xml
index c2b4c9e77a..aecf20b465 100644
--- a/sdk-bom/pom.xml
+++ b/sdk-bom/pom.xml
@@ -47,11 +47,13 @@
   <properties>
     <gpg.skip>true</gpg.skip>
     <dapr.sdk.version>1.18.1</dapr.sdk.version>
-    <!-- TODO: Remove netty-bom override once gRPC ships with Netty >= 4.1.135 (CVE-2026-33871, CVE-2026-33870 and later fixes) -->
-    <netty.version>4.1.135.Final</netty.version>
-    <jackson.version>2.21.5</jackson.version>
+    <!-- TODO: Remove netty-bom override once gRPC ships with Netty >= 4.1.139 (CVE-2026-75595 and later fixes) -->
+    <netty.version>4.1.139.Final</netty.version>
+    <jackson.version>2.21.8</jackson.version>
     <!-- TODO: Remove commons-compress override once testcontainers ships with >= 1.26.0 -->
     <commons-compress.version>1.26.0</commons-compress.version>
+    <!-- TODO: Remove guava override once protobuf-java-util ships with guava >= 33.7.2 (CVE-2026-102554) -->
+    <guava.version>33.7.2-jre</guava.version>
   </properties>
 
   <build>
@@ -157,6 +159,11 @@
         <artifactId>commons-compress</artifactId>
         <version>${commons-compress.version}</version>
       </dependency>
+      <dependency>
+        <groupId>com.google.guava</groupId>
+        <artifactId>guava</artifactId>
+        <version>${guava.version}</version>
+      </dependency>
       <dependency>
         <groupId>commons-codec</groupId>
         <artifactId>commons-codec</artifactId>
diff --git a/spring-boot-4-examples/pom.xml b/spring-boot-4-examples/pom.xml
index 9655d78796..d2dd7375f5 100644
--- a/spring-boot-4-examples/pom.xml
+++ b/spring-boot-4-examples/pom.xml
@@ -15,7 +15,7 @@
 
   <properties>
     <maven.deploy.skip>true</maven.deploy.skip>
-    <springboot4.version>4.0.5</springboot4.version>
+    <springboot4.version>4.0.9</springboot4.version>
     <!-- Override JUnit version to align with Spring Boot 4.x -->
     <junit-bom.version>6.0.2</junit-bom.version>
   </properties>
@@ -32,7 +32,7 @@
       <dependency>
         <groupId>tools.jackson</groupId>
         <artifactId>jackson-bom</artifactId>
-        <version>3.1.4</version>
+        <version>3.1.8</version>
         <type>pom</type>
         <scope>import</scope>
       </dependency>
diff --git a/spring-boot-4-sdk-tests/pom.xml b/spring-boot-4-sdk-tests/pom.xml
index 4786f4b5d9..28fe1ff8c9 100644
--- a/spring-boot-4-sdk-tests/pom.xml
+++ b/spring-boot-4-sdk-tests/pom.xml
@@ -19,7 +19,7 @@
     <maven.deploy.skip>true</maven.deploy.skip>
     <protobuf.output.directory>${project.build.directory}/generated-sources</protobuf.output.directory>
     <protobuf.input.directory>${project.basedir}/proto</protobuf.input.directory>
-    <springboot4.version>4.0.5</springboot4.version>
+    <springboot4.version>4.0.9</springboot4.version>
     <!-- Override JUnit version to align with Spring Boot 4.x -->
     <junit-bom.version>6.0.2</junit-bom.version>
     <!-- The JaCoCo plugin was expecting coverage for this module, but since it's a test module

From 20c98378f3086a77f2996b5ac70587130d482487 Mon Sep 17 00:00:00 2001
From: Javier Aliaga <javier@diagrid.io>
Date: Wed, 28 Oct 2026 12:46:35 +0100
Subject: [PATCH 2/2] fix: remove unused checkerframework import from
 versioning example

The import only compiled because Guava 32 brought checker-qual
transitively. Guava 33.7.2 no longer depends on it.

Signed-off-by: Javier Aliaga <javier@diagrid.io>
---
 .../dapr/springboot/examples/workerone/RegisterV1Components.java | 1 -
 1 file changed, 1 deletion(-)

diff --git a/spring-boot-examples/workflows/versioning/full-version-worker-one/src/main/java/io/dapr/springboot/examples/workerone/RegisterV1Components.java b/spring-boot-examples/workflows/versioning/full-version-worker-one/src/main/java/io/dapr/springboot/examples/workerone/RegisterV1Components.java
index 6343cc6056..c46c379277 100644
--- a/spring-boot-examples/workflows/versioning/full-version-worker-one/src/main/java/io/dapr/springboot/examples/workerone/RegisterV1Components.java
+++ b/spring-boot-examples/workflows/versioning/full-version-worker-one/src/main/java/io/dapr/springboot/examples/workerone/RegisterV1Components.java
@@ -21,7 +21,6 @@
 import io.dapr.workflows.WorkflowStub;
 import io.dapr.spring.workflows.config.annotations.ActivityMetadata;
 import io.dapr.spring.workflows.config.annotations.WorkflowMetadata;
-import org.checkerframework.checker.units.qual.C;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.stereotype.Component;