From dd06fce451be7dccb6412121fa5c3b71366fd4a9 Mon Sep 17 00:00:00 2001
From: Javier Aliaga <javier@diagrid.io>
Date: Fri, 2 Oct 2026 12:11:57 +0200
Subject: [PATCH 1/2] fix: Upgrade dependencies with known CVEs

Jackson 2.21.7, Jackson 3 3.1.7, Netty 4.2.17.Final, Spring Boot 4.0.8,
OpenTelemetry 1.62.0 and Tomcat 11.0.25. The OpenTelemetry and Jackson
BOMs are imported before the Spring Boot BOM, including in the modules
that import the Spring Boot 4 BOM locally, so they are not overridden.

Signed-off-by: Javier Aliaga <javier@diagrid.io>
---
 .../dapr-spring-boot-autoconfigure/pom.xml    | 19 +++++++++-
 .../dapr-spring-boot-starter-test/pom.xml     | 17 ++++++++-
 .../dapr-spring-boot-starter/pom.xml          | 17 ++++++++-
 dapr-spring/dapr-spring-data/pom.xml          | 17 ++++++++-
 pom.xml                                       | 37 +++++++++++++------
 sdk-bom/pom.xml                               |  4 +-
 sdk-tests/pom.xml                             | 17 ++++++++-
 spring-boot-examples/pom.xml                  | 19 +++++++++-
 spring-boot-sdk-tests/pom.xml                 | 17 ++++++++-
 9 files changed, 142 insertions(+), 22 deletions(-)

diff --git a/dapr-spring/dapr-spring-boot-autoconfigure/pom.xml b/dapr-spring/dapr-spring-boot-autoconfigure/pom.xml
index bf94d8d5fe..593c8beb29 100644
--- a/dapr-spring/dapr-spring-boot-autoconfigure/pom.xml
+++ b/dapr-spring/dapr-spring-boot-autoconfigure/pom.xml
@@ -16,7 +16,7 @@
   <packaging>jar</packaging>
 
   <properties>
-    <springboot4.version>4.0.5</springboot4.version>
+    <springboot4.version>4.0.8</springboot4.version>
     <!-- Override JUnit version to align with Spring Boot 4.0.x -->
     <junit-bom.version>6.0.2</junit-bom.version>
   </properties>
@@ -27,7 +27,7 @@
       <dependency>
         <groupId>tools.jackson</groupId>
         <artifactId>jackson-bom</artifactId>
-        <version>3.1.1</version>
+        <version>3.1.7</version>
         <type>pom</type>
         <scope>import</scope>
       </dependency>
@@ -40,6 +40,21 @@
         <type>pom</type>
         <scope>import</scope>
       </dependency>
+      <!-- Root-managed Jackson 2 and OpenTelemetry versions; MUST precede the Spring Boot BOM, which manages older, vulnerable versions. -->
+      <dependency>
+        <groupId>com.fasterxml.jackson</groupId>
+        <artifactId>jackson-bom</artifactId>
+        <version>${jackson.version}</version>
+        <type>pom</type>
+        <scope>import</scope>
+      </dependency>
+      <dependency>
+        <groupId>io.opentelemetry</groupId>
+        <artifactId>opentelemetry-bom</artifactId>
+        <version>${opentelemetry.version}</version>
+        <type>pom</type>
+        <scope>import</scope>
+      </dependency>
       <dependency>
         <groupId>org.springframework.boot</groupId>
         <artifactId>spring-boot-dependencies</artifactId>
diff --git a/dapr-spring/dapr-spring-boot-starters/dapr-spring-boot-starter-test/pom.xml b/dapr-spring/dapr-spring-boot-starters/dapr-spring-boot-starter-test/pom.xml
index 0fe42338e5..5e78898f99 100644
--- a/dapr-spring/dapr-spring-boot-starters/dapr-spring-boot-starter-test/pom.xml
+++ b/dapr-spring/dapr-spring-boot-starters/dapr-spring-boot-starter-test/pom.xml
@@ -16,12 +16,27 @@
     <packaging>jar</packaging>
 
     <properties>
-      <springboot4.version>4.0.5</springboot4.version>
+      <springboot4.version>4.0.8</springboot4.version>
       <!-- Override JUnit version to align with Spring Boot 4.x -->
       <junit-bom.version>6.0.2</junit-bom.version>
     </properties>
     <dependencyManagement>
       <dependencies>
+        <!-- Root-managed Jackson 2 and OpenTelemetry versions; MUST precede the Spring Boot BOM, which manages older, vulnerable versions. -->
+        <dependency>
+          <groupId>com.fasterxml.jackson</groupId>
+          <artifactId>jackson-bom</artifactId>
+          <version>${jackson.version}</version>
+          <type>pom</type>
+          <scope>import</scope>
+        </dependency>
+        <dependency>
+          <groupId>io.opentelemetry</groupId>
+          <artifactId>opentelemetry-bom</artifactId>
+          <version>${opentelemetry.version}</version>
+          <type>pom</type>
+          <scope>import</scope>
+        </dependency>
         <dependency>
           <groupId>org.springframework.boot</groupId>
           <artifactId>spring-boot-dependencies</artifactId>
diff --git a/dapr-spring/dapr-spring-boot-starters/dapr-spring-boot-starter/pom.xml b/dapr-spring/dapr-spring-boot-starters/dapr-spring-boot-starter/pom.xml
index 43cfa50c67..350cffc660 100644
--- a/dapr-spring/dapr-spring-boot-starters/dapr-spring-boot-starter/pom.xml
+++ b/dapr-spring/dapr-spring-boot-starters/dapr-spring-boot-starter/pom.xml
@@ -16,7 +16,7 @@
   <packaging>jar</packaging>
 
   <properties>
-    <springboot4.version>4.0.5</springboot4.version>
+    <springboot4.version>4.0.8</springboot4.version>
     <!-- Override JUnit version to align with Spring Boot 4.x -->
     <junit-bom.version>6.0.2</junit-bom.version>
   </properties>
@@ -32,6 +32,21 @@
         <type>pom</type>
         <scope>import</scope>
       </dependency>
+      <!-- Root-managed Jackson 2 and OpenTelemetry versions; MUST precede the Spring Boot BOM, which manages older, vulnerable versions. -->
+      <dependency>
+        <groupId>com.fasterxml.jackson</groupId>
+        <artifactId>jackson-bom</artifactId>
+        <version>${jackson.version}</version>
+        <type>pom</type>
+        <scope>import</scope>
+      </dependency>
+      <dependency>
+        <groupId>io.opentelemetry</groupId>
+        <artifactId>opentelemetry-bom</artifactId>
+        <version>${opentelemetry.version}</version>
+        <type>pom</type>
+        <scope>import</scope>
+      </dependency>
       <dependency>
         <groupId>org.springframework.boot</groupId>
         <artifactId>spring-boot-dependencies</artifactId>
diff --git a/dapr-spring/dapr-spring-data/pom.xml b/dapr-spring/dapr-spring-data/pom.xml
index 42414b5ea9..c4750c4f99 100644
--- a/dapr-spring/dapr-spring-data/pom.xml
+++ b/dapr-spring/dapr-spring-data/pom.xml
@@ -17,7 +17,7 @@
   <packaging>jar</packaging>
 
   <properties>
-    <springboot4.version>4.0.5</springboot4.version>
+    <springboot4.version>4.0.8</springboot4.version>
     <!-- Override JUnit version to align with Spring Boot 4.x -->
     <junit-bom.version>6.0.2</junit-bom.version>
   </properties>
@@ -33,6 +33,21 @@
         <type>pom</type>
         <scope>import</scope>
       </dependency>
+      <!-- Root-managed Jackson 2 and OpenTelemetry versions; MUST precede the Spring Boot BOM, which manages older, vulnerable versions. -->
+      <dependency>
+        <groupId>com.fasterxml.jackson</groupId>
+        <artifactId>jackson-bom</artifactId>
+        <version>${jackson.version}</version>
+        <type>pom</type>
+        <scope>import</scope>
+      </dependency>
+      <dependency>
+        <groupId>io.opentelemetry</groupId>
+        <artifactId>opentelemetry-bom</artifactId>
+        <version>${opentelemetry.version}</version>
+        <type>pom</type>
+        <scope>import</scope>
+      </dependency>
       <dependency>
         <groupId>org.springframework.boot</groupId>
         <artifactId>spring-boot-dependencies</artifactId>
diff --git a/pom.xml b/pom.xml
index b8852a96ae..0e904c177e 100644
--- a/pom.xml
+++ b/pom.xml
@@ -42,7 +42,7 @@
     <maven.compiler.target>17</maven.compiler.target>
     <maven.compiler.release>17</maven.compiler.release>
     <maven.deploy.skip>true</maven.deploy.skip>
-    <jackson.version>2.21.2</jackson.version>
+    <jackson.version>2.21.7</jackson.version>
     <gpg.skip>true</gpg.skip>
     <spotbugs.fail>true</spotbugs.fail>
     <spotbugs.exclude.filter.file>${maven.multiModuleProjectDirectory}/spotbugs-exclude.xml</spotbugs.exclude.filter.file>
@@ -52,10 +52,10 @@
     <junit-bom.version>5.11.4</junit-bom.version>
     <snakeyaml.version>2.0</snakeyaml.version>
     <testcontainers.version>2.0.5</testcontainers.version>
-    <springboot.version>4.0.5</springboot.version>
+    <springboot.version>4.0.8</springboot.version>
     <nexus-staging-maven-plugin.version>1.7.0</nexus-staging-maven-plugin.version>
     <assertj.version>3.27.7</assertj.version>
-    <opentelemetry.version>1.41.0</opentelemetry.version>
+    <opentelemetry.version>1.62.0</opentelemetry.version>
     <wiremock.version>3.9.1</wiremock.version>
     <jakarta.annotation.version>2.1.1</jakarta.annotation.version>
     <javax.annotation.version>1.3.2</javax.annotation.version>
@@ -80,7 +80,7 @@
     <kotlin.version>2.1.0</kotlin.version>
     <rest-assured.version>5.5.1</rest-assured.version>
     <!-- Keep in sync with the Netty version grpc-netty ${grpc.version} is built against (grpc-java SECURITY.md) -->
-    <netty.version>4.2.16.Final</netty.version>
+    <netty.version>4.2.17.Final</netty.version>
     <!-- TODO: Remove commons-compress override once testcontainers ships with >= 1.26.0 -->
     <commons-compress.version>1.26.0</commons-compress.version>
   </properties>
@@ -138,6 +138,22 @@
         <scope>import</scope>
         <type>pom</type>
       </dependency>
+      <!-- OpenTelemetry and Jackson 3 BOMs imported BEFORE spring-boot-dependencies so they win over the
+           older, vulnerable versions Spring Boot manages. -->
+      <dependency>
+        <groupId>io.opentelemetry</groupId>
+        <artifactId>opentelemetry-bom</artifactId>
+        <version>${opentelemetry.version}</version>
+        <type>pom</type>
+        <scope>import</scope>
+      </dependency>
+      <dependency>
+        <groupId>tools.jackson</groupId>
+        <artifactId>jackson-bom</artifactId>
+        <version>3.1.7</version>
+        <type>pom</type>
+        <scope>import</scope>
+      </dependency>
       <dependency>
         <groupId>org.springframework.boot</groupId>
         <artifactId>spring-boot-dependencies</artifactId>
@@ -159,13 +175,6 @@
         <type>pom</type>
         <scope>import</scope>
       </dependency>
-      <dependency>
-        <groupId>io.opentelemetry</groupId>
-        <artifactId>opentelemetry-bom</artifactId>
-        <version>${opentelemetry.version}</version>
-        <type>pom</type>
-        <scope>import</scope>
-      </dependency>
 
       <!-- ====================================================================== -->
       <!-- Security overrides - Transitive dependency version fixes for CVEs   -->
@@ -180,6 +189,12 @@
         <artifactId>commons-codec</artifactId>
         <version>1.17.2</version>
       </dependency>
+      <!-- Spring Boot 4.0.8 still manages a vulnerable Tomcat 11.0.24 -->
+      <dependency>
+        <groupId>org.apache.tomcat.embed</groupId>
+        <artifactId>tomcat-embed-core</artifactId>
+        <version>11.0.25</version>
+      </dependency>
 
       <!-- ====================================================================== -->
       <!-- Direct dependencies - Only versions not managed by BOMs above         -->
diff --git a/sdk-bom/pom.xml b/sdk-bom/pom.xml
index 55f03317fa..e9975e31d1 100644
--- a/sdk-bom/pom.xml
+++ b/sdk-bom/pom.xml
@@ -48,8 +48,8 @@
     <gpg.skip>true</gpg.skip>
     <dapr.sdk.version>1.19.0-SNAPSHOT</dapr.sdk.version>
     <!-- Keep in sync with the Netty version grpc-netty ${grpc.version} is built against (grpc-java SECURITY.md) -->
-    <netty.version>4.2.16.Final</netty.version>
-    <jackson.version>2.21.2</jackson.version>
+    <netty.version>4.2.17.Final</netty.version>
+    <jackson.version>2.21.7</jackson.version>
     <!-- TODO: Remove commons-compress override once testcontainers ships with >= 1.26.0 -->
     <commons-compress.version>1.26.0</commons-compress.version>
   </properties>
diff --git a/sdk-tests/pom.xml b/sdk-tests/pom.xml
index 843a78d00e..dc6dc5c703 100644
--- a/sdk-tests/pom.xml
+++ b/sdk-tests/pom.xml
@@ -26,7 +26,7 @@
     <!-- The JaCoCo plugin was expecting coverage for this module, but since it's a test module
     and code coverage typically doesn't apply to tests, the coverage is set to 0. -->
     <jacoco-maven-plugin.coverage-ratio>0%</jacoco-maven-plugin.coverage-ratio>
-    <springboot4.version>4.0.5</springboot4.version>
+    <springboot4.version>4.0.8</springboot4.version>
     <!-- Spring Boot 4 ITs (Testcontainers/@SpringBootTest) require JUnit 6; align this test module to it. -->
     <junit-bom.version>6.0.2</junit-bom.version>
   </properties>
@@ -44,6 +44,21 @@
         <type>pom</type>
         <scope>import</scope>
       </dependency>
+      <!-- Root-managed Jackson 2 and OpenTelemetry versions; MUST precede the Spring Boot BOM, which manages older, vulnerable versions. -->
+      <dependency>
+        <groupId>com.fasterxml.jackson</groupId>
+        <artifactId>jackson-bom</artifactId>
+        <version>${jackson.version}</version>
+        <type>pom</type>
+        <scope>import</scope>
+      </dependency>
+      <dependency>
+        <groupId>io.opentelemetry</groupId>
+        <artifactId>opentelemetry-bom</artifactId>
+        <version>${opentelemetry.version}</version>
+        <type>pom</type>
+        <scope>import</scope>
+      </dependency>
       <dependency>
         <groupId>org.springframework.boot</groupId>
         <artifactId>spring-boot-dependencies</artifactId>
diff --git a/spring-boot-examples/pom.xml b/spring-boot-examples/pom.xml
index 3234bc6527..c4f70df5ee 100644
--- a/spring-boot-examples/pom.xml
+++ b/spring-boot-examples/pom.xml
@@ -15,7 +15,7 @@
 
   <properties>
     <maven.deploy.skip>true</maven.deploy.skip>
-    <springboot4.version>4.0.5</springboot4.version>
+    <springboot4.version>4.0.8</springboot4.version>
     <!-- Override JUnit version to align with Spring Boot 4.x -->
     <junit-bom.version>6.0.2</junit-bom.version>
   </properties>
@@ -32,7 +32,7 @@
       <dependency>
         <groupId>tools.jackson</groupId>
         <artifactId>jackson-bom</artifactId>
-        <version>3.1.1</version>
+        <version>3.1.7</version>
         <type>pom</type>
         <scope>import</scope>
       </dependency>
@@ -45,6 +45,21 @@
         <type>pom</type>
         <scope>import</scope>
       </dependency>
+      <!-- Root-managed Jackson 2 and OpenTelemetry versions; MUST precede the Spring Boot BOM, which manages older, vulnerable versions. -->
+      <dependency>
+        <groupId>com.fasterxml.jackson</groupId>
+        <artifactId>jackson-bom</artifactId>
+        <version>${jackson.version}</version>
+        <type>pom</type>
+        <scope>import</scope>
+      </dependency>
+      <dependency>
+        <groupId>io.opentelemetry</groupId>
+        <artifactId>opentelemetry-bom</artifactId>
+        <version>${opentelemetry.version}</version>
+        <type>pom</type>
+        <scope>import</scope>
+      </dependency>
       <dependency>
         <groupId>org.springframework.boot</groupId>
         <artifactId>spring-boot-dependencies</artifactId>
diff --git a/spring-boot-sdk-tests/pom.xml b/spring-boot-sdk-tests/pom.xml
index 2d9ca52328..8c76161d91 100644
--- a/spring-boot-sdk-tests/pom.xml
+++ b/spring-boot-sdk-tests/pom.xml
@@ -19,7 +19,7 @@
     <maven.deploy.skip>true</maven.deploy.skip>
     <protobuf.output.directory>${project.build.directory}/generated-sources</protobuf.output.directory>
     <protobuf.input.directory>${project.basedir}/proto</protobuf.input.directory>
-    <springboot4.version>4.0.5</springboot4.version>
+    <springboot4.version>4.0.8</springboot4.version>
     <!-- Override JUnit version to align with Spring Boot 4.x -->
     <junit-bom.version>6.0.2</junit-bom.version>
     <!-- The JaCoCo plugin was expecting coverage for this module, but since it's a test module
@@ -38,6 +38,21 @@
         <type>pom</type>
         <scope>import</scope>
       </dependency>
+      <!-- Root-managed Jackson 2 and OpenTelemetry versions; MUST precede the Spring Boot BOM, which manages older, vulnerable versions. -->
+      <dependency>
+        <groupId>com.fasterxml.jackson</groupId>
+        <artifactId>jackson-bom</artifactId>
+        <version>${jackson.version}</version>
+        <type>pom</type>
+        <scope>import</scope>
+      </dependency>
+      <dependency>
+        <groupId>io.opentelemetry</groupId>
+        <artifactId>opentelemetry-bom</artifactId>
+        <version>${opentelemetry.version}</version>
+        <type>pom</type>
+        <scope>import</scope>
+      </dependency>
       <dependency>
         <groupId>org.springframework.boot</groupId>
         <artifactId>spring-boot-dependencies</artifactId>

From 4a18f66ad616c81207a67a08ea957ea34c3e10b4 Mon Sep 17 00:00:00 2001
From: Javier Aliaga <javier@diagrid.io>
Date: Tue, 6 Oct 2026 10:20:55 +0200
Subject: [PATCH 2/2] fix: Manage OpenTelemetry in dapr-sdk-bom

durabletask-client and dapr-sdk-workflows expose opentelemetry-api, and
Spring Boot 4.0.8 manages OpenTelemetry 1.55.0. Import opentelemetry-bom
1.62.0 in dapr-sdk-bom so consumers that import it before the Spring Boot
BOM get the patched version.

Signed-off-by: Javier Aliaga <javier@diagrid.io>
---
 sdk-bom/pom.xml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/sdk-bom/pom.xml b/sdk-bom/pom.xml
index e9975e31d1..2d33318382 100644
--- a/sdk-bom/pom.xml
+++ b/sdk-bom/pom.xml
@@ -50,6 +50,7 @@
     <!-- Keep in sync with the Netty version grpc-netty ${grpc.version} is built against (grpc-java SECURITY.md) -->
     <netty.version>4.2.17.Final</netty.version>
     <jackson.version>2.21.7</jackson.version>
+    <opentelemetry.version>1.62.0</opentelemetry.version>
     <!-- TODO: Remove commons-compress override once testcontainers ships with >= 1.26.0 -->
     <commons-compress.version>1.26.0</commons-compress.version>
   </properties>
@@ -152,6 +153,13 @@
         <type>pom</type>
         <scope>import</scope>
       </dependency>
+      <dependency>
+        <groupId>io.opentelemetry</groupId>
+        <artifactId>opentelemetry-bom</artifactId>
+        <version>${opentelemetry.version}</version>
+        <type>pom</type>
+        <scope>import</scope>
+      </dependency>
       <dependency>
         <groupId>org.apache.commons</groupId>
         <artifactId>commons-compress</artifactId>