fix(deps): update dependency org.springframework:spring-webmvc to v6 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
org.springframework:spring-webmvc	5.3.39 -> 6.0.0

GitHub Vulnerability Alerts

CVE-2024-38816

Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running.

Specifically, an application is vulnerable when both of the following are true:

• the web application uses RouterFunctions to serve static resources
• resource handling is explicitly configured with a FileSystemResource location

However, malicious requests are blocked and rejected when any of the following is true:

• the Spring Security HTTP Firewall https://docs.spring.io/spring-security/reference/servlet/exploits/firewall.html  is in use
• the application runs on Tomcat or Jetty

---

Release Notes

spring-projects/spring-framework (org.springframework:spring-webmvc)

v6.0.0

Compare Source

See What's New in Spring Framework 6.x and Upgrading to Spring Framework 6.x for upgrade instructions and details of new features.

⭐ New Features

• Avoid direct URL construction and URL equality checks #​29486
• Simplify creating RFC 7807 responses from functional endpoints #​29462
• Allow test classes to provide runtime hints via declarative mechanisms #​29455

📔 Documentation

• Align javadoc of DefaultParameterNameDiscoverer with its behavior #​29494
• Document AOT support in the TestContext framework #​29482
• Document Ahead of Time processing in the reference guide #​29350

🔨 Dependency Upgrades

• Upgrade to Reactor 2022.0.0 #​29465

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​ophiuhus and @​wilkinsona

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[socket-security]

New and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package	New capabilities	Transitives	Size	Publisher
maven/org.springframework/[email protected]	environment, eval, filesystem, network, unsafe	0	1.9 MB
maven/org.springframework/[email protected]	eval, filesystem, network, unsafe	0	366 kB
maven/org.springframework/[email protected]	eval, filesystem, network, unsafe	+2	3.96 MB
maven/org.springframework/[email protected]	environment, eval, filesystem, network, unsafe	+1	3.89 MB
maven/org.springframework/[email protected]	environment, eval, filesystem, network, unsafe Transitive: shell	+24	13.5 MB
maven/org.springframework/[email protected]	eval, filesystem, network Transitive: unsafe	+2	3.89 MB

🚮 Removed packages: maven/org.springframework/[email protected], maven/org.springframework/[email protected], maven/org.springframework/[email protected], maven/org.springframework/[email protected], maven/org.springframework/[email protected], maven/org.springframework/[email protected]

View full report↗︎

[renovate]

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update. You will not get PRs for any future 6.x releases. But if you manually upgrade to 6.x then Renovate will re-enable minor and patch updates automatically.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.