Skip to content

Conversation

@guptas6est
Copy link
Contributor

@guptas6est guptas6est commented Oct 28, 2025

Fixes #xyz

Main Issue: #xyz

PIP: #xyz

Motivation

Upgrade Spring Framework to version 6.2.11 to address security vulnerabilities CVE-2025-22233 and CVE-2025-41249, ensuring the project uses a secure and patched version.

Modifications

  • Updated spring.version from 6.1.14 → 6.2.12 in pom.xml.

Verifying this change

  • Make sure that the change passes the CI checks.

(Please pick either of the following options)

This change is a trivial rework / code cleanup without any test coverage.

(or)

This change is already covered by existing tests, such as (please describe tests).

(or)

This change added tests and can be verified as follows:

(example:)

  • Added integration tests for end-to-end deployment with large payloads (10MB)
  • Extended integration test for recovery after broker failure

Does this pull request potentially affect one of the following parts:

If the box was checked, please highlight the changes

  • Dependencies (add or upgrade a dependency)
  • The public API
  • The schema
  • The default values of configurations
  • The threading model
  • The binary protocol
  • The REST endpoints
  • The admin CLI options
  • The metrics
  • Anything that affects deployment

Documentation

  • doc
  • doc-required
  • doc-not-needed
  • doc-complete

Matching PR in forked repository

PR in forked repository:

@github-actions github-actions bot added the doc-not-needed Your PR changes do not impact docs label Oct 28, 2025
@lhotari lhotari changed the title [fix][deps] Upgrade Spring to 6.2.11 to remediate CVE-2025-22233 and CVE-2025-41249 [fix][sec] Upgrade Spring to 6.2.11 to remediate CVE-2025-22233 and CVE-2025-41249 Oct 28, 2025
@guptas6est
Copy link
Contributor Author

Hi @lhotari, thank you for the review!
I’ll update both my PRs and push the suggested changes shortly.

@guptas6est guptas6est changed the title [fix][sec] Upgrade Spring to 6.2.11 to remediate CVE-2025-22233 and CVE-2025-41249 [fix][sec] Upgrade Spring to 6.2.12 to remediate CVE-2025-22233 and CVE-2025-41249 Oct 28, 2025
@codecov-commenter
Copy link

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 74.22%. Comparing base (ebfff58) to head (a748d41).
⚠️ Report is 4 commits behind head on master.

Additional details and impacted files

Impacted file tree graph

@@             Coverage Diff              @@
##             master   #24903      +/-   ##
============================================
- Coverage     74.31%   74.22%   -0.09%     
+ Complexity    33843    33457     -386     
============================================
  Files          1913     1913              
  Lines        149325   149328       +3     
  Branches      17332    17334       +2     
============================================
- Hits         110966   110838     -128     
- Misses        29503    29623     +120     
- Partials       8856     8867      +11     
Flag Coverage Δ
inttests 26.37% <ø> (+0.01%) ⬆️
systests 22.79% <ø> (-0.14%) ⬇️
unittests 73.76% <ø> (-0.06%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.
see 85 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@lhotari lhotari added this to the 4.2.0 milestone Oct 29, 2025
@lhotari lhotari merged commit 38e0fa1 into apache:master Oct 29, 2025
94 of 102 checks passed
lhotari pushed a commit that referenced this pull request Oct 31, 2025
lhotari pushed a commit that referenced this pull request Oct 31, 2025
lhotari pushed a commit that referenced this pull request Oct 31, 2025
ganesh-ctds pushed a commit to datastax/pulsar that referenced this pull request Nov 3, 2025
manas-ctds pushed a commit to datastax/pulsar that referenced this pull request Nov 3, 2025
srinath-ctds pushed a commit to datastax/pulsar that referenced this pull request Nov 4, 2025
srinath-ctds pushed a commit to datastax/pulsar that referenced this pull request Nov 6, 2025
nodece pushed a commit to nodece/pulsar that referenced this pull request Nov 12, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants