From a2854c878d400ab00c64b42c465d214e9ee3c400 Mon Sep 17 00:00:00 2001
From: Javier Aliaga <javier@diagrid.io>
Date: Wed, 28 Oct 2026 13:46:42 +0100
Subject: [PATCH] fix: bump dependencies to address CVEs on release-1.17

- netty 4.1.135.Final -> 4.1.139.Final (CVE-2026-75595 and others)
- jackson 2.21.5 -> 2.21.8, tools.jackson 3.1.4 -> 3.1.8
- Spring Boot 4 modules 4.0.6 -> 4.0.9
- tomcat 10.1.55 -> 10.1.61
- spring-framework 6.2.18 -> 6.2.19
- override spring-data-bom 2025.0.13 (CVE-2026-41695, CVE-2026-41716)
- override micrometer-bom 1.15.12 (CVE-2026-40983, CVE-2026-40984)
- override guava 33.7.2-jre (CVE-2026-102554)
- import opentelemetry-bom in spring-boot-4-examples (CVE-2026-45292)
- remove unused checkerframework import that breaks with guava 33.7.2

Signed-off-by: Javier Aliaga <javier@diagrid.io>
---
 dapr-spring/dapr-spring-6-data/pom.xml        |  2 +-
 .../dapr-spring-boot-4-autoconfigure/pom.xml  |  4 +-
 .../dapr-spring-boot-4-starter-test/pom.xml   |  2 +-
 .../dapr-spring-boot-4-starter/pom.xml        |  2 +-
 pom.xml                                       | 43 +++++++++++++++----
 spring-boot-4-examples/pom.xml                | 12 +++++-
 spring-boot-4-sdk-tests/pom.xml               |  2 +-
 .../workerone/RegisterV1Components.java       |  1 -
 8 files changed, 51 insertions(+), 17 deletions(-)

diff --git a/dapr-spring/dapr-spring-6-data/pom.xml b/dapr-spring/dapr-spring-6-data/pom.xml
index 34f0090d89..53e3d06103 100644
--- a/dapr-spring/dapr-spring-6-data/pom.xml
+++ b/dapr-spring/dapr-spring-6-data/pom.xml
@@ -18,7 +18,7 @@
 
   <properties>
     <!-- Must be >= 4.0.6 for CVE-2026-40973 -->
-    <springboot4.version>4.0.6</springboot4.version>
+    <springboot4.version>4.0.9</springboot4.version>
     <!-- Override JUnit version to align with Spring Boot 4.x -->
     <junit-bom.version>6.0.2</junit-bom.version>
   </properties>
diff --git a/dapr-spring/dapr-spring-boot-4-autoconfigure/pom.xml b/dapr-spring/dapr-spring-boot-4-autoconfigure/pom.xml
index 2e3c5a182d..6ec9aced32 100644
--- a/dapr-spring/dapr-spring-boot-4-autoconfigure/pom.xml
+++ b/dapr-spring/dapr-spring-boot-4-autoconfigure/pom.xml
@@ -17,7 +17,7 @@
 
   <properties>
     <!-- Must be >= 4.0.6 for CVE-2026-40973 -->
-    <springboot4.version>4.0.6</springboot4.version>
+    <springboot4.version>4.0.9</springboot4.version>
     <!-- Override JUnit version to align with Spring Boot 4.0.x -->
     <junit-bom.version>6.0.2</junit-bom.version>
   </properties>
@@ -28,7 +28,7 @@
       <dependency>
         <groupId>tools.jackson</groupId>
         <artifactId>jackson-bom</artifactId>
-        <version>3.1.4</version>
+        <version>3.1.8</version>
         <type>pom</type>
         <scope>import</scope>
       </dependency>
diff --git a/dapr-spring/dapr-spring-boot-starters/dapr-spring-boot-4-starter-test/pom.xml b/dapr-spring/dapr-spring-boot-starters/dapr-spring-boot-4-starter-test/pom.xml
index e43960bcdd..c00e651a37 100644
--- a/dapr-spring/dapr-spring-boot-starters/dapr-spring-boot-4-starter-test/pom.xml
+++ b/dapr-spring/dapr-spring-boot-starters/dapr-spring-boot-4-starter-test/pom.xml
@@ -17,7 +17,7 @@
 
     <properties>
       <!-- Must be >= 4.0.6 for CVE-2026-40973 -->
-      <springboot4.version>4.0.6</springboot4.version>
+      <springboot4.version>4.0.9</springboot4.version>
       <!-- Override JUnit version to align with Spring Boot 4.x -->
       <junit-bom.version>6.0.2</junit-bom.version>
     </properties>
diff --git a/dapr-spring/dapr-spring-boot-starters/dapr-spring-boot-4-starter/pom.xml b/dapr-spring/dapr-spring-boot-starters/dapr-spring-boot-4-starter/pom.xml
index b64b003e17..f7d395c8a6 100644
--- a/dapr-spring/dapr-spring-boot-starters/dapr-spring-boot-4-starter/pom.xml
+++ b/dapr-spring/dapr-spring-boot-starters/dapr-spring-boot-4-starter/pom.xml
@@ -17,7 +17,7 @@
 
   <properties>
     <!-- Must be >= 4.0.6 for CVE-2026-40973 -->
-    <springboot4.version>4.0.6</springboot4.version>
+    <springboot4.version>4.0.9</springboot4.version>
     <!-- Override JUnit version to align with Spring Boot 4.x -->
     <junit-bom.version>6.0.2</junit-bom.version>
   </properties>
diff --git a/pom.xml b/pom.xml
index c0e963f7a2..2d76e33678 100644
--- a/pom.xml
+++ b/pom.xml
@@ -44,7 +44,7 @@
     <maven.compiler.target>11</maven.compiler.target>
     <maven.compiler.release>11</maven.compiler.release>
     <maven.deploy.skip>true</maven.deploy.skip>
-    <jackson.version>2.21.5</jackson.version>
+    <jackson.version>2.21.8</jackson.version>
     <gpg.skip>true</gpg.skip>
     <spotbugs.fail>true</spotbugs.fail>
     <spotbugs.exclude.filter.file>${maven.multiModuleProjectDirectory}/spotbugs-exclude.xml</spotbugs.exclude.filter.file>
@@ -59,8 +59,12 @@
     <assertj.version>3.27.7</assertj.version>
     <!-- Must be >= 1.62.0 for CVE-2026-45292 -->
     <opentelemetry.version>1.62.0</opentelemetry.version>
-    <!-- Must be >= 6.2.18 for CVE-2026-22735, CVE-2026-22737, CVE-2026-22741, CVE-2026-22745 -->
-    <spring-framework.version>6.2.18</spring-framework.version>
+    <!-- Must be >= 6.2.19 for CVE-2026-41841..41846, CVE-2026-41848, CVE-2026-41850..41854 -->
+    <spring-framework.version>6.2.19</spring-framework.version>
+    <!-- Must be >= 2025.0.12 (spring-data-commons 3.5.12) for CVE-2026-41695, CVE-2026-41716 -->
+    <spring-data.version>2025.0.13</spring-data.version>
+    <!-- Must be >= 1.15.12 for CVE-2026-40983, CVE-2026-40984 -->
+    <micrometer.version>1.15.12</micrometer.version>
     <wiremock.version>3.9.1</wiremock.version>
     <jakarta.annotation.version>2.1.1</jakarta.annotation.version>
     <javax.annotation.version>1.3.2</javax.annotation.version>
@@ -84,14 +88,16 @@
     <opentelemetry-bom.version>2.1.0</opentelemetry-bom.version>
     <kotlin.version>2.1.0</kotlin.version>
     <rest-assured.version>5.5.1</rest-assured.version>
-    <!-- TODO: Remove netty-bom override once gRPC ships with Netty >= 4.1.135 (CVE-2026-33871, CVE-2026-33870 and later fixes) -->
-    <netty.version>4.1.135.Final</netty.version>
+    <!-- TODO: Remove netty-bom override once gRPC ships with Netty >= 4.1.139 (CVE-2026-75595 and later fixes) -->
+    <netty.version>4.1.139.Final</netty.version>
     <!-- TODO: Remove logback override once Spring Boot 3.4.x ships with logback >= 1.5.35 -->
     <logback.version>1.5.35</logback.version>
     <!-- TODO: Remove commons-compress override once testcontainers ships with >= 1.26.0 -->
     <commons-compress.version>1.26.0</commons-compress.version>
-    <!-- TODO: Remove tomcat override once Spring Boot 3.4.x ships with tomcat >= 10.1.55 -->
-    <tomcat.version>10.1.55</tomcat.version>
+    <!-- TODO: Remove tomcat override once Spring Boot 3.4.x ships with tomcat >= 10.1.61 -->
+    <tomcat.version>10.1.61</tomcat.version>
+    <!-- TODO: Remove guava override once protobuf-java-util ships with guava >= 33.7.2 (CVE-2026-102554) -->
+    <guava.version>33.7.2-jre</guava.version>
   </properties>
 
   <distributionManagement>
@@ -144,7 +150,7 @@
         <type>pom</type>
         <scope>import</scope>
       </dependency>
-      <!-- TODO: Remove spring-framework override once Spring Boot ships with spring-framework >= 6.2.18 (CVE-2026-22735, CVE-2026-22737, CVE-2026-22741, CVE-2026-22745) -->
+      <!-- TODO: Remove spring-framework override once Spring Boot ships with spring-framework >= 6.2.19 (CVE-2026-41841..41854) -->
       <dependency>
         <groupId>org.springframework</groupId>
         <artifactId>spring-framework-bom</artifactId>
@@ -152,6 +158,22 @@
         <type>pom</type>
         <scope>import</scope>
       </dependency>
+      <!-- TODO: Remove spring-data override once Spring Boot ships with spring-data >= 2025.0.12 (CVE-2026-41695, CVE-2026-41716) -->
+      <dependency>
+        <groupId>org.springframework.data</groupId>
+        <artifactId>spring-data-bom</artifactId>
+        <version>${spring-data.version}</version>
+        <type>pom</type>
+        <scope>import</scope>
+      </dependency>
+      <!-- TODO: Remove micrometer override once Spring Boot ships with micrometer >= 1.15.12 (CVE-2026-40983, CVE-2026-40984) -->
+      <dependency>
+        <groupId>io.micrometer</groupId>
+        <artifactId>micrometer-bom</artifactId>
+        <version>${micrometer.version}</version>
+        <type>pom</type>
+        <scope>import</scope>
+      </dependency>
       <dependency>
         <groupId>org.springframework.boot</groupId>
         <artifactId>spring-boot-dependencies</artifactId>
@@ -199,6 +221,11 @@
         <artifactId>commons-compress</artifactId>
         <version>${commons-compress.version}</version>
       </dependency>
+      <dependency>
+        <groupId>com.google.guava</groupId>
+        <artifactId>guava</artifactId>
+        <version>${guava.version}</version>
+      </dependency>
       <dependency>
         <groupId>commons-codec</groupId>
         <artifactId>commons-codec</artifactId>
diff --git a/spring-boot-4-examples/pom.xml b/spring-boot-4-examples/pom.xml
index bb50c77e6e..db50385880 100644
--- a/spring-boot-4-examples/pom.xml
+++ b/spring-boot-4-examples/pom.xml
@@ -16,7 +16,7 @@
   <properties>
     <maven.deploy.skip>true</maven.deploy.skip>
     <!-- Must be >= 4.0.6 for CVE-2026-40973 -->
-    <springboot4.version>4.0.6</springboot4.version>
+    <springboot4.version>4.0.9</springboot4.version>
     <!-- Override JUnit version to align with Spring Boot 4.x -->
     <junit-bom.version>6.0.2</junit-bom.version>
   </properties>
@@ -33,7 +33,15 @@
       <dependency>
         <groupId>tools.jackson</groupId>
         <artifactId>jackson-bom</artifactId>
-        <version>3.1.4</version>
+        <version>3.1.8</version>
+        <type>pom</type>
+        <scope>import</scope>
+      </dependency>
+      <!-- Override OTel for CVE-2026-45292 (must precede SB BOM) -->
+      <dependency>
+        <groupId>io.opentelemetry</groupId>
+        <artifactId>opentelemetry-bom</artifactId>
+        <version>${opentelemetry.version}</version>
         <type>pom</type>
         <scope>import</scope>
       </dependency>
diff --git a/spring-boot-4-sdk-tests/pom.xml b/spring-boot-4-sdk-tests/pom.xml
index f65edbc6a2..a24cb8879a 100644
--- a/spring-boot-4-sdk-tests/pom.xml
+++ b/spring-boot-4-sdk-tests/pom.xml
@@ -20,7 +20,7 @@
     <protobuf.output.directory>${project.build.directory}/generated-sources</protobuf.output.directory>
     <protobuf.input.directory>${project.basedir}/proto</protobuf.input.directory>
     <!-- Must be >= 4.0.6 for CVE-2026-40973 -->
-    <springboot4.version>4.0.6</springboot4.version>
+    <springboot4.version>4.0.9</springboot4.version>
     <!-- Override JUnit version to align with Spring Boot 4.x -->
     <junit-bom.version>6.0.2</junit-bom.version>
     <!-- The JaCoCo plugin was expecting coverage for this module, but since it's a test module
diff --git a/spring-boot-examples/workflows/versioning/full-version-worker-one/src/main/java/io/dapr/springboot/examples/workerone/RegisterV1Components.java b/spring-boot-examples/workflows/versioning/full-version-worker-one/src/main/java/io/dapr/springboot/examples/workerone/RegisterV1Components.java
index 6343cc6056..c46c379277 100644
--- a/spring-boot-examples/workflows/versioning/full-version-worker-one/src/main/java/io/dapr/springboot/examples/workerone/RegisterV1Components.java
+++ b/spring-boot-examples/workflows/versioning/full-version-worker-one/src/main/java/io/dapr/springboot/examples/workerone/RegisterV1Components.java
@@ -21,7 +21,6 @@
 import io.dapr.workflows.WorkflowStub;
 import io.dapr.spring.workflows.config.annotations.ActivityMetadata;
 import io.dapr.spring.workflows.config.annotations.WorkflowMetadata;
-import org.checkerframework.checker.units.qual.C;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.stereotype.Component;