Skip to content

fix: upgrade org.springframework.boot:spring-boot to 4.0.6, 3.5.14 (CVE-2026-40973) #3514

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
orbisai0security wants to merge 8 commits into
base: master
Choose a base branch
from
Open

fix: upgrade org.springframework.boot:spring-boot to 4.0.6, 3.5.14 (CVE-2026-40973) #3514

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
5c38bd8
fix: CVE-2026-40973 security vulnerability
orbisai0security Jun 8, 2026
a330d82
fix: migrate javax to jakarta namespaces for Spring Boot 3.5.14
orbisai0security Jun 9, 2026
a76f885
Apply code changes: It's not going to work without software changes @…
orbisai0security Jun 9, 2026
4929b68
Apply code changes: @orbisai0security can you address code review com…
orbisai0security Jun 9, 2026
7e4d545
fix: correct Spotless formatting violations in CQRS module
orbisai0security Jun 11, 2026
d545dbd
fix: revert jakarta.sql to javax.sql — jakarta.sql does not exist
orbisai0security Jun 11, 2026
24ca501
fix: bump JUnit to 5.12.2 to match Spring Boot 3.5.x
orbisai0security Jun 11, 2026
32c3b2d
fix: pin junit-jupiter-api in dependencyManagement to 5.12.2
orbisai0security Jun 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 2 additions & 7 deletions command-query-responsibility-segregation/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,17 +54,12 @@
<dependency>
<groupId>org.hibernate</groupId>
<artifactId>hibernate-core</artifactId>
<version>5.6.15.Final</version>
<version>6.4.4.Final</version>
</dependency>
<dependency>
<groupId>org.glassfish.jaxb</groupId>
<artifactId>jaxb-runtime</artifactId>
<version>2.3.3</version>
</dependency>
<dependency>
<groupId>javax.xml.bind</groupId>
<artifactId>jaxb-api</artifactId>
<version>2.3.1</version>
<version>4.0.5</version>
</dependency>
</dependencies>
<build>
Expand Down
22 changes: 11 additions & 11 deletions ...ponsibility-segregation/src/main/java/com/iluwatar/cqrs/commandes/CommandServiceImpl.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,9 +40,9 @@ public class CommandServiceImpl implements CommandService {
private Author getAuthorByUsername(String username) {
Author author;
try (var session = sessionFactory.openSession()) {
var query = session.createQuery("from Author where username=:username");
var query = session.createQuery("from Author where username=:username", Author.class);

@github-actions github-actions Bot Jun 9, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Potential NonUniqueResultException if username is not unique; consider enforcing a unique constraint on the username column and/or handling NonUniqueResultException to avoid runtime failures.

@anupamme anupamme Jun 9, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@orbisai0security can you address code review comments?

query.setParameter("username", username);
author = (Author) query.uniqueResult();
author = query.uniqueResult();

@github-actions github-actions Bot Jun 9, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If the username is not unique, uniqueResult may throw NonUniqueResultException. Ensure username is unique at the DB level or switch to a safe retrieval strategy (e.g., getResultList and enforce single element).

Comment on lines +43 to +45

@github-actions github-actions Bot Jun 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In Hibernate 6, uniqueResult() is deprecated/removed. This pattern can throw NonUniqueResultException or be removed in future. Prefer getSingleResult() wrapped in a try/catch for NoResultException, or switch to getResultList() and enforce a single element.

@anupamme anupamme Jun 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@orbisai0security can you address code review comments?

}
Comment on lines +43 to 46

@github-actions github-actions Bot Jun 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

When creating a typed query, use getSingleResult instead of uniqueResult() in Hibernate 6 to avoid deprecation/removal. If you must keep uniqueResult(), wrap in try/catch to handle NonUniqueResultException.

if (author == null) {
HibernateUtil.getSessionFactory().close();
Expand All @@ -54,9 +54,9 @@ private Author getAuthorByUsername(String username) {
private Book getBookByTitle(String title) {
Book book;
try (var session = sessionFactory.openSession()) {
var query = session.createQuery("from Book where title=:title");
var query = session.createQuery("from Book where title=:title", Book.class);

@github-actions github-actions Bot Jun 9, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Similar risk as above for fetching a Book by title. Ensure title column is unique or handle multiple results gracefully.

query.setParameter("title", title);
book = (Book) query.uniqueResult();
book = query.uniqueResult();

@github-actions github-actions Bot Jun 9, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Retrieving a single Book with uniqueResult can throw NonUniqueResultException if multiple books share the same title. Consider DB-level constraints or safer retrieval.

}
Comment on lines +57 to 60

@github-actions github-actions Bot Jun 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Similarly, this uses uniqueResult() on a typed query for Book. Apply the same migration strategy as above to avoid runtime issues with Hibernate 6.

if (book == null) {
HibernateUtil.getSessionFactory().close();
Expand All @@ -70,7 +70,7 @@ public void authorCreated(String username, String name, String email) {
var author = new Author(username, name, email);
try (var session = sessionFactory.openSession()) {
session.beginTransaction();
session.save(author);
session.persist(author);
session.getTransaction().commit();
}
}
Expand All @@ -81,7 +81,7 @@ public void bookAddedToAuthor(String title, double price, String username) {
var book = new Book(title, price, author);
try (var session = sessionFactory.openSession()) {
session.beginTransaction();
session.save(book);
session.persist(book);
session.getTransaction().commit();
}
}
Expand All @@ -92,7 +92,7 @@ public void authorNameUpdated(String username, String name) {
author.setName(name);
try (var session = sessionFactory.openSession()) {
session.beginTransaction();
session.update(author);
session.merge(author);
session.getTransaction().commit();
}
}
Expand All @@ -103,7 +103,7 @@ public void authorUsernameUpdated(String oldUsername, String newUsername) {
author.setUsername(newUsername);
try (var session = sessionFactory.openSession()) {
session.beginTransaction();
session.update(author);
session.merge(author);
session.getTransaction().commit();
}
}
Expand All @@ -114,7 +114,7 @@ public void authorEmailUpdated(String username, String email) {
author.setEmail(email);
try (var session = sessionFactory.openSession()) {
session.beginTransaction();
session.update(author);
session.merge(author);
session.getTransaction().commit();
}
}
Expand All @@ -125,7 +125,7 @@ public void bookTitleUpdated(String oldTitle, String newTitle) {
book.setTitle(newTitle);
try (var session = sessionFactory.openSession()) {
session.beginTransaction();
session.update(book);
session.merge(book);
session.getTransaction().commit();
}
}
Expand All @@ -136,7 +136,7 @@ public void bookPriceUpdated(String title, double price) {
book.setPrice(price);
try (var session = sessionFactory.openSession()) {
session.beginTransaction();
session.update(book);
session.merge(book);
session.getTransaction().commit();
}
}
Expand Down
11 changes: 7 additions & 4 deletions ...query-responsibility-segregation/src/main/java/com/iluwatar/cqrs/domain/model/Author.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,10 +24,11 @@
*/
package com.iluwatar.cqrs.domain.model;

import javax.persistence.Entity;
import javax.persistence.GeneratedValue;
import javax.persistence.GenerationType;
import javax.persistence.Id;
import jakarta.persistence.Column;
import jakarta.persistence.Entity;
import jakarta.persistence.GeneratedValue;
import jakarta.persistence.GenerationType;
import jakarta.persistence.Id;
import lombok.Getter;
import lombok.Setter;
import lombok.ToString;
Expand All @@ -42,7 +43,9 @@ public class Author {
@GeneratedValue(strategy = GenerationType.IDENTITY)
private long id;

@Column(unique = true)
private String username;

private String name;
private String email;

Expand Down
13 changes: 8 additions & 5 deletions ...d-query-responsibility-segregation/src/main/java/com/iluwatar/cqrs/domain/model/Book.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,11 +24,12 @@
*/
package com.iluwatar.cqrs.domain.model;

import javax.persistence.Entity;
import javax.persistence.GeneratedValue;
import javax.persistence.GenerationType;
import javax.persistence.Id;
import javax.persistence.ManyToOne;
import jakarta.persistence.Column;
import jakarta.persistence.Entity;
import jakarta.persistence.GeneratedValue;
import jakarta.persistence.GenerationType;
import jakarta.persistence.Id;
import jakarta.persistence.ManyToOne;
import lombok.Getter;
import lombok.Setter;
import lombok.ToString;
Expand All @@ -46,7 +47,9 @@ public class Book {
@GeneratedValue(strategy = GenerationType.IDENTITY)
private long id;

@Column(unique = true)
private String title;

private double price;
@ManyToOne private Author author;

Expand Down
18 changes: 11 additions & 7 deletions ...-responsibility-segregation/src/main/java/com/iluwatar/cqrs/queries/QueryServiceImpl.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,7 +48,8 @@ public Author getAuthorByUsername(String username) {
Query<Author> sqlQuery =
session.createQuery(
"select new com.iluwatar.cqrs.dto.Author(a.name, a.email, a.username)"
+ " from com.iluwatar.cqrs.domain.model.Author a where a.username=:username");
+ " from com.iluwatar.cqrs.domain.model.Author a where a.username=:username",
Author.class);
sqlQuery.setParameter(AppConstants.USER_NAME, username);
authorDto = sqlQuery.uniqueResult();
}
Expand All @@ -62,7 +63,8 @@ public Book getBook(String title) {
Query<Book> sqlQuery =
session.createQuery(
"select new com.iluwatar.cqrs.dto.Book(b.title, b.price)"
+ " from com.iluwatar.cqrs.domain.model.Book b where b.title=:title");
+ " from com.iluwatar.cqrs.domain.model.Book b where b.title=:title",
Book.class);
sqlQuery.setParameter("title", title);
bookDto = sqlQuery.uniqueResult();
}
Expand All @@ -77,7 +79,8 @@ public List<Book> getAuthorBooks(String username) {
session.createQuery(
"select new com.iluwatar.cqrs.dto.Book(b.title, b.price)"
+ " from com.iluwatar.cqrs.domain.model.Author a, com.iluwatar.cqrs.domain.model.Book b "
+ "where b.author.id = a.id and a.username=:username");
+ "where b.author.id = a.id and a.username=:username",
Book.class);
sqlQuery.setParameter(AppConstants.USER_NAME, username);
bookDtos = sqlQuery.list();
}
Expand All @@ -92,9 +95,10 @@ public BigInteger getAuthorBooksCount(String username) {
session.createNativeQuery(
"SELECT count(b.title)"
+ " FROM Book b, Author a"
+ " where b.author_id = a.id and a.username=:username");
+ " where b.author_id = a.id and a.username=:username",
Long.class);
sqlQuery.setParameter(AppConstants.USER_NAME, username);
bookcount = (BigInteger) sqlQuery.uniqueResult();
bookcount = BigInteger.valueOf(sqlQuery.uniqueResult());
}
return bookcount;
}
Expand All @@ -103,8 +107,8 @@ public BigInteger getAuthorBooksCount(String username) {
public BigInteger getAuthorsCount() {
BigInteger authorcount;
try (var session = sessionFactory.openSession()) {
var sqlQuery = session.createNativeQuery("SELECT count(id) from Author");
authorcount = (BigInteger) sqlQuery.uniqueResult();
var sqlQuery = session.createNativeQuery("SELECT count(id) from Author", Long.class);
authorcount = BigInteger.valueOf(sqlQuery.uniqueResult());
}
return authorcount;
}
Expand Down
2 changes: 1 addition & 1 deletion dependency-injection/src/main/java/com/iluwatar/dependency/injection/GuiceWizard.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@
*/
package com.iluwatar.dependency.injection;

import javax.inject.Inject;
import jakarta.inject.Inject;

/**
* GuiceWizard implements inversion of control. Its dependencies are injected through its
Expand Down
5 changes: 0 additions & 5 deletions metadata-mapping/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,11 +55,6 @@
<artifactId>hibernate-core</artifactId>
<version>6.6.11.Final</version>
</dependency>
<dependency>
<groupId>javax.xml.bind</groupId>
<artifactId>jaxb-api</artifactId>
<version>2.4.0-b180830.0359</version>
</dependency>
<dependency>
<groupId>org.glassfish.jaxb</groupId>
<artifactId>jaxb-runtime</artifactId>
Expand Down
2 changes: 1 addition & 1 deletion polling-publisher/polling-service/src/main/java/com/iluwatar/polling/DataRepository.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@

import java.util.HashMap;
import java.util.Map;
import javax.annotation.PostConstruct;
import jakarta.annotation.PostConstruct;
import org.springframework.stereotype.Repository;

/** Data repository to keep or store data. */
Expand Down
8 changes: 4 additions & 4 deletions polling-publisher/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -83,11 +83,11 @@
<version>${spring-boot.version}</version>
</dependency>

<!-- https://mvnrepository.com/artifact/javax.annotation/javax.annotation-api -->
<!-- https://mvnrepository.com/artifact/jakarta.annotation/jakarta.annotation-api -->
<dependency>
<groupId>javax.annotation</groupId>
<artifactId>javax.annotation-api</artifactId>
<version>1.3.2</version>
<groupId>jakarta.annotation</groupId>
<artifactId>jakarta.annotation-api</artifactId>
<version>3.0.0</version>
</dependency>

<dependency>
Expand Down
10 changes: 8 additions & 2 deletions pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,8 +39,8 @@
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>

<!-- Spring Boot related dependencies. Keep these in sync! -->
<spring-boot.version>3.4.5</spring-boot.version>
<junit.version>5.11.4</junit.version>
<spring-boot.version>3.5.14</spring-boot.version>
<junit.version>5.12.2</junit.version>
<mockito.version>5.14.2</mockito.version>
<logback.version>1.5.18</logback.version>
<slf4j.version>2.0.17</slf4j.version>
Expand Down Expand Up @@ -313,6 +313,12 @@
<version>${system-lambda.version}</version>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.junit.jupiter</groupId>
<artifactId>junit-jupiter-api</artifactId>
<version>${junit.version}</version>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.junit.jupiter</groupId>
<artifactId>junit-jupiter-engine</artifactId>
Expand Down
5 changes: 0 additions & 5 deletions service-layer/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,11 +56,6 @@
<artifactId>jaxb-runtime</artifactId>
<version>4.0.5</version>
</dependency>
<dependency>
<groupId>javax.xml.bind</groupId>
<artifactId>jaxb-api</artifactId>
<version>2.4.0-b180830.0359</version>
</dependency>
<dependency>
<groupId>jakarta.persistence</groupId>
<artifactId>jakarta.persistence-api</artifactId>
Expand Down
Loading