lukaszlenart opened a new pull request, #1911: URL: https://github.com/apache/struts/pull/1911
Fixes [WW-5717](https://issues.apache.org/jira/browse/WW-5717) The OWASP workflow (`-Pdependency-check -Pjakartaee11`, fail on CVSS ≥ 7) flags `spring-core-7.0.8.jar` with 17 CVEs from Spring's 2026-08-20 advisory wave, 12 of them ≥ 7.0. `7.0.9` is the first OSS release covering all of them, so this bumps the `jakartaee11` profile's `spring.version` from `7.0.8` to `7.0.9`. None of the 17 sits on a code path Struts executes — they are Spring MVC / WebFlux / RSocket, SpEL, `DataBinder`, `UrlHandlerFilter` and `ContentDisposition` issues, and Struts ships no `spring-webmvc`/`spring-webflux` at all. Dependency hygiene, not a Struts fix; the per-CVE breakdown is on the ticket. **Not changed:** the default profile's `6.2.19`. It is the last OSS 6.2.x (`6.2.20` is Enterprise-Support-only), CI scans the `jakartaee11` profile, and suppressing four 9.8s for an EOL line would only hide the real question — that is [WW-5721](https://issues.apache.org/jira/browse/WW-5721), targeted at 8.0.0. ### Verification - `mvn test -DskipAssembly -Pjakartaee11 -pl plugins/spring,plugins/rest,plugins/junit,plugins/testng` — 224 tests, 0 failures - `mvn org.owasp:dependency-check-maven:aggregate -Pdependency-check -Pjakartaee11` against an NVD cache refreshed today — 169 dependencies scanned, all nine Spring jars at 7.0.9, no 2026 Spring CVE reported, `BUILD SUCCESS` 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
