Bump Spring Boot to 3.5.16 to remediate app.war CVEs

[rychoo2]

Summary

Remediates all 12 Trivy findings (3 Critical, 9 High) in opt/app/app.war for the apish-converter image. Every finding is a transitive dependency governed by the spring-boot-dependencies BOM, so bumping the BOM fixes them in one move — no manual per-artifact overrides needed.

buildSrc/src/main/kotlin/Versions.kt:

• springBoot 3.4.10 → 3.5.16 — BOM now pins tomcat-embed-core 10.1.55 and jackson-bom 2.21.4, and fixes the Spring Boot temp-file CVE. (3.5.14 is not enough — it still ships Tomcat 10.1.54.)
• openApi (springdoc) 2.3.0 → 2.8.6 — required for Spring Boot 3.5.x compatibility (2.3.0 targets 3.2).
• swagger 2.2.20 → 2.2.31 — aligns with springdoc 2.8.x.

CVEs cleared

tomcat-embed-core 10.1.46 → 10.1.55

• Critical: CVE-2026-41293, CVE-2026-43512, CVE-2026-43515
• High: CVE-2026-24734, CVE-2026-24880, CVE-2026-34483, CVE-2026-41284, CVE-2026-42498, CVE-2026-43513
• Also covers Docker Scout-only: CVE-2026-29145 (Critical), CVE-2026-34487 (High)

jackson-databind 2.18.4 → 2.21.x

• High: CVE-2026-54512, CVE-2026-54513

spring-boot 3.4.10 → 3.5.16

• High: CVE-2026-40973

Notes / scope

• Security-only. The jodconverter 4.4.7 → 4.4.9 bump discussed separately is not included here.
• Verified against the published BOM poms that 3.5.16 manages tomcat 10.1.55 + jackson-bom 2.21.4; both artifacts are in the Spring Boot BOM so the platform() import governs them.

Test plan

• Docker build (jodconverter/Dockerfile → ./gradlew -x test :samples:spring-boot-rest:build) succeeds
• Re-run Trivy on the rebuilt apish-converter image → 0 Critical/High in app.war
• Smoke test POST /lool/convert-to/pdf (docx → pdf) and confirm the OpenAPI/Swagger UI still loads (springdoc bump)

Made with Cursor