From 3fb0a7b7f6f7377ea48f5a979ef37534eaa8e3a7 Mon Sep 17 00:00:00 2001
From: Javier Aliaga <javier@diagrid.io>
Date: Thu, 8 Oct 2026 08:40:55 +0200
Subject: [PATCH] fix: Upgrade dependencies with known CVEs (#1821)

* fix: Upgrade dependencies with known CVEs

Jackson 2.21.7, Jackson 3 3.1.7, Netty 4.2.17.Final, Spring Boot 4.0.8,
OpenTelemetry 1.62.0 and Tomcat 11.0.25. The OpenTelemetry and Jackson
BOMs are imported before the Spring Boot BOM, including in the modules
that import the Spring Boot 4 BOM locally, so they are not overridden.

Signed-off-by: Javier Aliaga <javier@diagrid.io>

* fix: Manage OpenTelemetry in dapr-sdk-bom

durabletask-client and dapr-sdk-workflows expose opentelemetry-api, and
Spring Boot 4.0.8 manages OpenTelemetry 1.55.0. Import opentelemetry-bom
1.62.0 in dapr-sdk-bom so consumers that import it before the Spring Boot
BOM get the patched version.

Signed-off-by: Javier Aliaga <javier@diagrid.io>

---------

Signed-off-by: Javier Aliaga <javier@diagrid.io>
(cherry picked from commit b5c4d2fe21af9e672fcd751b09922136d4c46a82)
---
 .../dapr-spring-boot-autoconfigure/pom.xml    | 19 +++++++++-
 .../dapr-spring-boot-starter-test/pom.xml     | 17 ++++++++-
 .../dapr-spring-boot-starter/pom.xml          | 17 ++++++++-
 dapr-spring/dapr-spring-data/pom.xml          | 17 ++++++++-
 pom.xml                                       | 37 +++++++++++++------
 sdk-bom/pom.xml                               | 12 +++++-
 sdk-tests/pom.xml                             | 17 ++++++++-
 spring-boot-examples/pom.xml                  | 19 +++++++++-
 spring-boot-sdk-tests/pom.xml                 | 17 ++++++++-
 9 files changed, 150 insertions(+), 22 deletions(-)

diff --git a/dapr-spring/dapr-spring-boot-autoconfigure/pom.xml b/dapr-spring/dapr-spring-boot-autoconfigure/pom.xml
index 42774d208d..f9c0019771 100644
--- a/dapr-spring/dapr-spring-boot-autoconfigure/pom.xml
+++ b/dapr-spring/dapr-spring-boot-autoconfigure/pom.xml
@@ -16,7 +16,7 @@
   <packaging>jar</packaging>
 
   <properties>
-    <springboot4.version>4.0.5</springboot4.version>
+    <springboot4.version>4.0.8</springboot4.version>
     <!-- Override JUnit version to align with Spring Boot 4.0.x -->
     <junit-bom.version>6.0.2</junit-bom.version>
   </properties>
@@ -27,7 +27,7 @@
       <dependency>
         <groupId>tools.jackson</groupId>
         <artifactId>jackson-bom</artifactId>
-        <version>3.1.1</version>
+        <version>3.1.7</version>
         <type>pom</type>
         <scope>import</scope>
       </dependency>
@@ -40,6 +40,21 @@
         <type>pom</type>
         <scope>import</scope>
       </dependency>
+      <!-- Root-managed Jackson 2 and OpenTelemetry versions; MUST precede the Spring Boot BOM, which manages older, vulnerable versions. -->
+      <dependency>
+        <groupId>com.fasterxml.jackson</groupId>
+        <artifactId>jackson-bom</artifactId>
+        <version>${jackson.version}</version>
+        <type>pom</type>
+        <scope>import</scope>
+      </dependency>
+      <dependency>
+        <groupId>io.opentelemetry</groupId>
+        <artifactId>opentelemetry-bom</artifactId>
+        <version>${opentelemetry.version}</version>
+        <type>pom</type>
+        <scope>import</scope>
+      </dependency>
       <dependency>
         <groupId>org.springframework.boot</groupId>
         <artifactId>spring-boot-dependencies</artifactId>
diff --git a/dapr-spring/dapr-spring-boot-starters/dapr-spring-boot-starter-test/pom.xml b/dapr-spring/dapr-spring-boot-starters/dapr-spring-boot-starter-test/pom.xml
index d066446690..11933697fb 100644
--- a/dapr-spring/dapr-spring-boot-starters/dapr-spring-boot-starter-test/pom.xml
+++ b/dapr-spring/dapr-spring-boot-starters/dapr-spring-boot-starter-test/pom.xml
@@ -16,12 +16,27 @@
     <packaging>jar</packaging>
 
     <properties>
-      <springboot4.version>4.0.5</springboot4.version>
+      <springboot4.version>4.0.8</springboot4.version>
       <!-- Override JUnit version to align with Spring Boot 4.x -->
       <junit-bom.version>6.0.2</junit-bom.version>
     </properties>
     <dependencyManagement>
       <dependencies>
+        <!-- Root-managed Jackson 2 and OpenTelemetry versions; MUST precede the Spring Boot BOM, which manages older, vulnerable versions. -->
+        <dependency>
+          <groupId>com.fasterxml.jackson</groupId>
+          <artifactId>jackson-bom</artifactId>
+          <version>${jackson.version}</version>
+          <type>pom</type>
+          <scope>import</scope>
+        </dependency>
+        <dependency>
+          <groupId>io.opentelemetry</groupId>
+          <artifactId>opentelemetry-bom</artifactId>
+          <version>${opentelemetry.version}</version>
+          <type>pom</type>
+          <scope>import</scope>
+        </dependency>
         <dependency>
           <groupId>org.springframework.boot</groupId>
           <artifactId>spring-boot-dependencies</artifactId>
diff --git a/dapr-spring/dapr-spring-boot-starters/dapr-spring-boot-starter/pom.xml b/dapr-spring/dapr-spring-boot-starters/dapr-spring-boot-starter/pom.xml
index bda7313ed8..a51229001f 100644
--- a/dapr-spring/dapr-spring-boot-starters/dapr-spring-boot-starter/pom.xml
+++ b/dapr-spring/dapr-spring-boot-starters/dapr-spring-boot-starter/pom.xml
@@ -16,7 +16,7 @@
   <packaging>jar</packaging>
 
   <properties>
-    <springboot4.version>4.0.5</springboot4.version>
+    <springboot4.version>4.0.8</springboot4.version>
     <!-- Override JUnit version to align with Spring Boot 4.x -->
     <junit-bom.version>6.0.2</junit-bom.version>
   </properties>
@@ -32,6 +32,21 @@
         <type>pom</type>
         <scope>import</scope>
       </dependency>
+      <!-- Root-managed Jackson 2 and OpenTelemetry versions; MUST precede the Spring Boot BOM, which manages older, vulnerable versions. -->
+      <dependency>
+        <groupId>com.fasterxml.jackson</groupId>
+        <artifactId>jackson-bom</artifactId>
+        <version>${jackson.version}</version>
+        <type>pom</type>
+        <scope>import</scope>
+      </dependency>
+      <dependency>
+        <groupId>io.opentelemetry</groupId>
+        <artifactId>opentelemetry-bom</artifactId>
+        <version>${opentelemetry.version}</version>
+        <type>pom</type>
+        <scope>import</scope>
+      </dependency>
       <dependency>
         <groupId>org.springframework.boot</groupId>
         <artifactId>spring-boot-dependencies</artifactId>
diff --git a/dapr-spring/dapr-spring-data/pom.xml b/dapr-spring/dapr-spring-data/pom.xml
index 75b95f8a7b..4452333090 100644
--- a/dapr-spring/dapr-spring-data/pom.xml
+++ b/dapr-spring/dapr-spring-data/pom.xml
@@ -17,7 +17,7 @@
   <packaging>jar</packaging>
 
   <properties>
-    <springboot4.version>4.0.5</springboot4.version>
+    <springboot4.version>4.0.8</springboot4.version>
     <!-- Override JUnit version to align with Spring Boot 4.x -->
     <junit-bom.version>6.0.2</junit-bom.version>
   </properties>
@@ -33,6 +33,21 @@
         <type>pom</type>
         <scope>import</scope>
       </dependency>
+      <!-- Root-managed Jackson 2 and OpenTelemetry versions; MUST precede the Spring Boot BOM, which manages older, vulnerable versions. -->
+      <dependency>
+        <groupId>com.fasterxml.jackson</groupId>
+        <artifactId>jackson-bom</artifactId>
+        <version>${jackson.version}</version>
+        <type>pom</type>
+        <scope>import</scope>
+      </dependency>
+      <dependency>
+        <groupId>io.opentelemetry</groupId>
+        <artifactId>opentelemetry-bom</artifactId>
+        <version>${opentelemetry.version}</version>
+        <type>pom</type>
+        <scope>import</scope>
+      </dependency>
       <dependency>
         <groupId>org.springframework.boot</groupId>
         <artifactId>spring-boot-dependencies</artifactId>
diff --git a/pom.xml b/pom.xml
index 6d36216bba..d920c43316 100644
--- a/pom.xml
+++ b/pom.xml
@@ -42,7 +42,7 @@
     <maven.compiler.target>17</maven.compiler.target>
     <maven.compiler.release>17</maven.compiler.release>
     <maven.deploy.skip>true</maven.deploy.skip>
-    <jackson.version>2.21.2</jackson.version>
+    <jackson.version>2.21.7</jackson.version>
     <gpg.skip>true</gpg.skip>
     <spotbugs.fail>true</spotbugs.fail>
     <spotbugs.exclude.filter.file>${maven.multiModuleProjectDirectory}/spotbugs-exclude.xml</spotbugs.exclude.filter.file>
@@ -52,10 +52,10 @@
     <junit-bom.version>5.11.4</junit-bom.version>
     <snakeyaml.version>2.0</snakeyaml.version>
     <testcontainers.version>2.0.5</testcontainers.version>
-    <springboot.version>4.0.5</springboot.version>
+    <springboot.version>4.0.8</springboot.version>
     <nexus-staging-maven-plugin.version>1.7.0</nexus-staging-maven-plugin.version>
     <assertj.version>3.27.7</assertj.version>
-    <opentelemetry.version>1.41.0</opentelemetry.version>
+    <opentelemetry.version>1.62.0</opentelemetry.version>
     <wiremock.version>3.9.1</wiremock.version>
     <jakarta.annotation.version>2.1.1</jakarta.annotation.version>
     <javax.annotation.version>1.3.2</javax.annotation.version>
@@ -80,7 +80,7 @@
     <kotlin.version>2.1.0</kotlin.version>
     <rest-assured.version>5.5.1</rest-assured.version>
     <!-- Keep in sync with the Netty version grpc-netty ${grpc.version} is built against (grpc-java SECURITY.md) -->
-    <netty.version>4.2.16.Final</netty.version>
+    <netty.version>4.2.17.Final</netty.version>
     <!-- TODO: Remove commons-compress override once testcontainers ships with >= 1.26.0 -->
     <commons-compress.version>1.26.0</commons-compress.version>
   </properties>
@@ -138,6 +138,22 @@
         <scope>import</scope>
         <type>pom</type>
       </dependency>
+      <!-- OpenTelemetry and Jackson 3 BOMs imported BEFORE spring-boot-dependencies so they win over the
+           older, vulnerable versions Spring Boot manages. -->
+      <dependency>
+        <groupId>io.opentelemetry</groupId>
+        <artifactId>opentelemetry-bom</artifactId>
+        <version>${opentelemetry.version}</version>
+        <type>pom</type>
+        <scope>import</scope>
+      </dependency>
+      <dependency>
+        <groupId>tools.jackson</groupId>
+        <artifactId>jackson-bom</artifactId>
+        <version>3.1.7</version>
+        <type>pom</type>
+        <scope>import</scope>
+      </dependency>
       <dependency>
         <groupId>org.springframework.boot</groupId>
         <artifactId>spring-boot-dependencies</artifactId>
@@ -159,13 +175,6 @@
         <type>pom</type>
         <scope>import</scope>
       </dependency>
-      <dependency>
-        <groupId>io.opentelemetry</groupId>
-        <artifactId>opentelemetry-bom</artifactId>
-        <version>${opentelemetry.version}</version>
-        <type>pom</type>
-        <scope>import</scope>
-      </dependency>
 
       <!-- ====================================================================== -->
       <!-- Security overrides - Transitive dependency version fixes for CVEs   -->
@@ -180,6 +189,12 @@
         <artifactId>commons-codec</artifactId>
         <version>1.17.2</version>
       </dependency>
+      <!-- Spring Boot 4.0.8 still manages a vulnerable Tomcat 11.0.24 -->
+      <dependency>
+        <groupId>org.apache.tomcat.embed</groupId>
+        <artifactId>tomcat-embed-core</artifactId>
+        <version>11.0.25</version>
+      </dependency>
 
       <!-- ====================================================================== -->
       <!-- Direct dependencies - Only versions not managed by BOMs above         -->
diff --git a/sdk-bom/pom.xml b/sdk-bom/pom.xml
index f5b1942c41..523178d1d1 100644
--- a/sdk-bom/pom.xml
+++ b/sdk-bom/pom.xml
@@ -48,8 +48,9 @@
     <gpg.skip>true</gpg.skip>
     <dapr.sdk.version>1.19.0-rc-1</dapr.sdk.version>
     <!-- Keep in sync with the Netty version grpc-netty ${grpc.version} is built against (grpc-java SECURITY.md) -->
-    <netty.version>4.2.16.Final</netty.version>
-    <jackson.version>2.21.2</jackson.version>
+    <netty.version>4.2.17.Final</netty.version>
+    <jackson.version>2.21.7</jackson.version>
+    <opentelemetry.version>1.62.0</opentelemetry.version>
     <!-- TODO: Remove commons-compress override once testcontainers ships with >= 1.26.0 -->
     <commons-compress.version>1.26.0</commons-compress.version>
   </properties>
@@ -152,6 +153,13 @@
         <type>pom</type>
         <scope>import</scope>
       </dependency>
+      <dependency>
+        <groupId>io.opentelemetry</groupId>
+        <artifactId>opentelemetry-bom</artifactId>
+        <version>${opentelemetry.version}</version>
+        <type>pom</type>
+        <scope>import</scope>
+      </dependency>
       <dependency>
         <groupId>org.apache.commons</groupId>
         <artifactId>commons-compress</artifactId>
diff --git a/sdk-tests/pom.xml b/sdk-tests/pom.xml
index 552968e6ee..93097728f2 100644
--- a/sdk-tests/pom.xml
+++ b/sdk-tests/pom.xml
@@ -26,7 +26,7 @@
     <!-- The JaCoCo plugin was expecting coverage for this module, but since it's a test module
     and code coverage typically doesn't apply to tests, the coverage is set to 0. -->
     <jacoco-maven-plugin.coverage-ratio>0%</jacoco-maven-plugin.coverage-ratio>
-    <springboot4.version>4.0.5</springboot4.version>
+    <springboot4.version>4.0.8</springboot4.version>
     <!-- Spring Boot 4 ITs (Testcontainers/@SpringBootTest) require JUnit 6; align this test module to it. -->
     <junit-bom.version>6.0.2</junit-bom.version>
   </properties>
@@ -44,6 +44,21 @@
         <type>pom</type>
         <scope>import</scope>
       </dependency>
+      <!-- Root-managed Jackson 2 and OpenTelemetry versions; MUST precede the Spring Boot BOM, which manages older, vulnerable versions. -->
+      <dependency>
+        <groupId>com.fasterxml.jackson</groupId>
+        <artifactId>jackson-bom</artifactId>
+        <version>${jackson.version}</version>
+        <type>pom</type>
+        <scope>import</scope>
+      </dependency>
+      <dependency>
+        <groupId>io.opentelemetry</groupId>
+        <artifactId>opentelemetry-bom</artifactId>
+        <version>${opentelemetry.version}</version>
+        <type>pom</type>
+        <scope>import</scope>
+      </dependency>
       <dependency>
         <groupId>org.springframework.boot</groupId>
         <artifactId>spring-boot-dependencies</artifactId>
diff --git a/spring-boot-examples/pom.xml b/spring-boot-examples/pom.xml
index 9a3535e53c..249ebb96e7 100644
--- a/spring-boot-examples/pom.xml
+++ b/spring-boot-examples/pom.xml
@@ -15,7 +15,7 @@
 
   <properties>
     <maven.deploy.skip>true</maven.deploy.skip>
-    <springboot4.version>4.0.5</springboot4.version>
+    <springboot4.version>4.0.8</springboot4.version>
     <!-- Override JUnit version to align with Spring Boot 4.x -->
     <junit-bom.version>6.0.2</junit-bom.version>
   </properties>
@@ -31,7 +31,7 @@
       <dependency>
         <groupId>tools.jackson</groupId>
         <artifactId>jackson-bom</artifactId>
-        <version>3.1.1</version>
+        <version>3.1.7</version>
         <type>pom</type>
         <scope>import</scope>
       </dependency>
@@ -44,6 +44,21 @@
         <type>pom</type>
         <scope>import</scope>
       </dependency>
+      <!-- Root-managed Jackson 2 and OpenTelemetry versions; MUST precede the Spring Boot BOM, which manages older, vulnerable versions. -->
+      <dependency>
+        <groupId>com.fasterxml.jackson</groupId>
+        <artifactId>jackson-bom</artifactId>
+        <version>${jackson.version}</version>
+        <type>pom</type>
+        <scope>import</scope>
+      </dependency>
+      <dependency>
+        <groupId>io.opentelemetry</groupId>
+        <artifactId>opentelemetry-bom</artifactId>
+        <version>${opentelemetry.version}</version>
+        <type>pom</type>
+        <scope>import</scope>
+      </dependency>
       <dependency>
         <groupId>org.springframework.boot</groupId>
         <artifactId>spring-boot-dependencies</artifactId>
diff --git a/spring-boot-sdk-tests/pom.xml b/spring-boot-sdk-tests/pom.xml
index 62a0500222..5813164807 100644
--- a/spring-boot-sdk-tests/pom.xml
+++ b/spring-boot-sdk-tests/pom.xml
@@ -19,7 +19,7 @@
     <maven.deploy.skip>true</maven.deploy.skip>
     <protobuf.output.directory>${project.build.directory}/generated-sources</protobuf.output.directory>
     <protobuf.input.directory>${project.basedir}/proto</protobuf.input.directory>
-    <springboot4.version>4.0.5</springboot4.version>
+    <springboot4.version>4.0.8</springboot4.version>
     <!-- Override JUnit version to align with Spring Boot 4.x -->
     <junit-bom.version>6.0.2</junit-bom.version>
     <!-- The JaCoCo plugin was expecting coverage for this module, but since it's a test module
@@ -38,6 +38,21 @@
         <type>pom</type>
         <scope>import</scope>
       </dependency>
+      <!-- Root-managed Jackson 2 and OpenTelemetry versions; MUST precede the Spring Boot BOM, which manages older, vulnerable versions. -->
+      <dependency>
+        <groupId>com.fasterxml.jackson</groupId>
+        <artifactId>jackson-bom</artifactId>
+        <version>${jackson.version}</version>
+        <type>pom</type>
+        <scope>import</scope>
+      </dependency>
+      <dependency>
+        <groupId>io.opentelemetry</groupId>
+        <artifactId>opentelemetry-bom</artifactId>
+        <version>${opentelemetry.version}</version>
+        <type>pom</type>
+        <scope>import</scope>
+      </dependency>
       <dependency>
         <groupId>org.springframework.boot</groupId>
         <artifactId>spring-boot-dependencies</artifactId>