fix(deps): update maven all non-major dependencies - autoclosed

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
org.apache.maven.plugins:maven-enforcer-plugin (source)	3.6.0 -> 3.6.1
software.amazon.awssdk:s3	2.32.13 -> 2.32.20
org.springframework:spring-webmvc	6.2.8 -> 6.2.10
org.springframework:spring-web	6.2.8 -> 6.2.9
com.nimbusds:nimbus-jose-jwt	10.3.1 -> 10.4.1
org.springframework.boot:spring-boot-starter-oauth2-resource-server (source)	3.5.3 -> 3.5.4
org.springframework.boot:spring-boot-starter-oauth2-client (source)	3.5.3 -> 3.5.4
org.springframework.boot:spring-boot-starter-parent (source)	3.5.3 -> 3.5.4

GitHub Vulnerability Alerts

CVE-2025-41242

Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant Servlet container.

An application can be vulnerable when all the following are true:

• the application is deployed as a WAR or with an embedded Servlet container
• the Servlet container does not reject suspicious sequences https://jakarta.ee/specifications/servlet/6.1/jakarta-servlet-spec-6.1.html#uri-path-canonicalization
• the application serves static resources https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title  with Spring resource handling

We have verified that applications deployed on Apache Tomcat or Eclipse Jetty are not vulnerable, as long as default security features are not disabled in the configuration. Because we cannot check exploits against all Servlet containers and configuration variants, we strongly recommend upgrading your application.

---

Release Notes

spring-projects/spring-framework (org.springframework:spring-webmvc)

v6.2.10

Compare Source

⭐ New Features

• Optimize NIO path resolution in PathEditor #​35304
• Make type in ProblemDetail nullable #​35294
• Refine UriUtils#decode and StringUtils#uriDecode implementation and documentation #​35253
• Provide configurable useCaches option for URLConnection usage in UrlResource (avoiding jar file leak) #​35218

🐞 Bug Fixes

• @Scheduled tasks running in SimpleAsyncTaskScheduler are interrupted immediately on context close #​35254
• ScriptUtils.executeSqlScript() does not support multiple results per statement #​35248
• Successful Autowiring Dependent on Configuration ordering and Primary Bean flag #​35239
• Locale parameter in MessageSource#getMessage methods should be nullable #​35230
• Allow any @Transactional propagation for @TransactionalEventListener with BEFORE_COMMIT phase #​35150
• Catalog name should be handled with the provided case #​35064
• Accept support for generated keys column name array on HSQLDB and Derby as well #​34790
• Handle direct CanncelationException on timeout in JdkClientHttpRequest #​34721

📔 Documentation

• Add documentation of RequestMapping about SpEL #​35232
• Document SqlBinaryValue behaviour with PostgreSQL #​34786

🔨 Dependency Upgrades

• Upgrade to Micrometer 1.14.10 #​35313
• Upgrade to Reactor 2024.0.9 #​35312

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​Allan-QLB, @​carsago, @​cw-dimedis, and @​giampa91

v6.2.9

Compare Source

⭐ New Features

• OncePerRequestFilter cannot be CGLib-proxied #​35198
• Consistently catch InaccessibleObjectException next to IllegalAccessException #​35190
• Introduce Date-to-Instant and Instant-to-Date converters #​35175
• Consistent nullability and exception declarations in AbstractMessagingTemplate hierarchy #​35159
• Register runtime hints for Instant-to-Timestamp conversion #​35156
• Improve handling of ResponseEntity<?> in Spring MVC #​35153
• Support @CacheConfig("myCacheName") declarations for simplified configuration #​35152
• Declare messageSelector parameters in JmsOperations as @Nullable #​35151
• Add getter for OverflowStrategy in ConcurrentWebSocketSessionDecorator #​35132
• Use preset Content-Type for streaming and reactive responses in Spring MVC #​35130
• Leniently tolerate null @Aspect bean #​35074
• DataAccessResourceFailureException thrown when transaction times out on PostgreSQL #​35073
• MethodInvokingFactoryBean fails to invoke publicly exported methods overridden by internal classes when using JPMS #​34028

🐞 Bug Fixes

• Restore preference for interface (most abstract) method in getPubliclyAccessibleMethodIfPossible #​35189
• Make targetBeanName field in AbstractBeanFactoryBasedTargetSource protected to avoid exceptions in logging and toString() #​35172
• Fix inconsistencies in StaticListableBeanFactory #​35119
• Support StreamingHttpOutputMessage in RestClient #​35102
• When building DELETE requests, the request body is not used in JdkClientHttpRequest.buildRequest #​35068
• AOT-generated bean registration file contains "too many constants" when building with many beans #​35044
• Prevent cache pollution by storing only the factories #​34732
• WebFlux decodes wildcard content-types as form-data/multipart #​34660
• AOT-generated CGLib proxies do not contain method overrides #​34642
• 500 response for ResourceHttpRequestHandler when requested range is not satisfied #​34490

📔 Documentation

• Document how to register runtime hints for convention-based conversion #​35178
• Link to @ContextConfiguration Javadoc from reference manual #​35088

🔨 Dependency Upgrades

• Upgrade to JUnit 5.13.3 #​35103
• Upgrade to Micrometer 1.14.9 #​35202
• Upgrade to Reactor 2024.0.8 #​35201

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​Meijuh, @​RazorNd, @​chenggwang, @​izeye, @​mjd507, @​ngocnhan-tran1996, and @​philwebb

connect2id/nimbus-jose-jwt (com.nimbusds:nimbus-jose-jwt)

v10.4.1

Compare Source

v10.4

Compare Source

spring-projects/spring-boot (org.springframework.boot:spring-boot-starter-oauth2-resource-server)

v3.5.4

Compare Source

---

Configuration

📅 Schedule: Branch creation - "before 6am every weekday" in timezone America/Vancouver, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled because a matching PR was automerged previously.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

---

Thanks for the PR!

Deployments, as required, will be available below:

• Backend
• Frontend

Please create PRs in draft mode. Mark as ready to enable:

• Analysis Workflow

After merge, new images are deployed in:

• Merge Workflow