[javier-aliaga]

Description

Bumps dependencies on release-1.17 to fix known CVEs in the resolved runtime dependency tree. The tree was scanned against OSV across all modules, including the integration-tests and integration-sb4-tests profiles. Only CVE fixes are included.

Dependency	Before	After
Netty	4.1.135.Final	4.1.139.Final
Jackson 2 / Jackson 3	2.21.5 / 3.1.4	2.21.8 / 3.1.8
Spring Boot 4 (SB4 modules)	4.0.6	4.0.9
Tomcat	10.1.55	10.1.61
Spring Framework	6.2.18	6.2.19
Spring Data (new override)	2024.1.x (SB 3.4.13)	2025.0.13
Micrometer (new override)	1.14.14 (SB 3.4.13)	1.15.12
Guava (new override)	32.0.1-jre	33.7.2-jre

• spring-boot-4-examples now imports the OpenTelemetry BOM before the Spring Boot BOM. Without it, it resolved opentelemetry-api 1.55.0.
• An unused org.checkerframework import was removed from the versioning example. Guava 33.7.2 no longer brings checker-qual, so that import fails to compile.
• Spring Boot 3 stays on 3.4.13, which no longer gets OSS releases. Spring Data and Micrometer have no fix on the 3.4 line, so they are overridden to the next minor.

OSV findings went from 132 to 7. The 7 that remain have no OSS fix on the 3.4.x and 6.2.x lines:

• spring-webmvc 6.2.19: CVE-2026-47884, CVE-2026-47890. These are only in the examples.
• spring-boot and spring-boot-starter-actuator 3.4.13: CVE-2026-40973, CVE-2026-22731, CVE-2026-22733.
• spring-boot-autoconfigure 3.4.13: CVE-2026-41001.
• log4j-api 2.24.3: CVE-2026-49844. Its version is managed by Spring Boot 3.4.13.

Checklist

• Code compiles correctly
• Extended the documentation (not applicable)

Test plan

• mvn install -DskipITs passes under JDK 17 (1015 unit tests, 0 failures)
• -Pintegration-tests,integration-sb4-tests modules compile
• OSV rescan of the runtime dependency tree
• CI integration tests

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 73.04%. Comparing base (afc0d27) to head (a2854c8).

Additional details and impacted files

@@                Coverage Diff                 @@
##             release-1.17    #1881      +/-   ##
==================================================
- Coverage           73.06%   73.04%   -0.03%     
+ Complexity           2285     2284       -1     
==================================================
  Files                 244      244              
  Lines                7463     7463              
  Branches              747      747              
==================================================
- Hits                 5453     5451       -2     
- Misses               1649     1650       +1     
- Partials              361      362       +1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.