Bump the guide-dependencies-maven group across 2 directories with 3 updates by dependabot[bot] · Pull Request #110 · spring-guides/gs-securing-web

dependabot · 2026-09-01T09:07:04Z

Bumps the guide-dependencies-maven group with 3 updates in the /complete directory: org.springframework.boot:spring-boot-starter-parent, org.apache.maven:apache-maven and org.apache.maven.wrapper:maven-wrapper.
Bumps the guide-dependencies-maven group with 3 updates in the /initial directory: org.springframework.boot:spring-boot-starter-parent, org.apache.maven:apache-maven and org.apache.maven.wrapper:maven-wrapper.

Updates org.springframework.boot:spring-boot-starter-parent from 4.0.7 to 4.0.8

Release notes

Sourced from org.springframework.boot:spring-boot-starter-parent's releases.

v4.0.8

🐞 Bug Fixes

Kafka consumer-specific security protocol is not taken into account #51365

Temporary file is not deleted when ExportedImageTar construction fails #51117

spring-boot-h2-console pulls servlet-api as transitive dependency #51094

Methods that return the result of Map#remove are not declared with a @Nullable return type #50972

PropertiesLauncher does not log nested archive paths #50968

JarFile is not closed when finding main class from archive #50949

CloudFoundry reactive auto-configuration should not require a WebClient.Builder bean to be defined #50928

Resources are not cleaned up when resolving an image that is not yet present in the builder #50919

Context refresh fails on reactive Cloud Foundry when using Actuator without spring-boot-health #50916

GraphQlWebMvcAutoConfiguration should apply customizers in order #50908

Micrometer registries pin the application context #50886

Context refresh fails when using Actuator on Jersey without spring-boot-health #50858

Context refresh fails on Cloud Foundry when using Actuator without spring-boot-health #50857

IllegalStateException when binding properties to a @Validated class that contains a map whose value type is a wildcard #50798

Setting 'server.servlet.session.cookie.partitioned' to false still emits the 'Partitioned' cookie attribute #50781

Application-managed JUL bridge handler should only be removed if installed #50779

Inconsistent handling of empty string values of spring.security.oauth2.resourceserver.jwt issuer-uri and jwk-set-uri #50755

PropertiesWebClientHttpServiceGroupConfigurer has highest precedence, preventing other configurers from being ordered ahead of it #50737

High number of connections due to Mongo health indicator #50734

Return type nullability of ApplicationContextAssert's getBean methods does not indicate that bean may be null #50701

NativeImageResourceProvider flattens Flyway migration paths in subdirectories #50433

Fix ordering of Kotlinx Serialization CodecCustomizer #50428

Metadata annotation processor ignores getter-level @NestedConfigurationProperty for records #50096

📔 Documentation

spring.profiles.group should have a 'spring-profile-name' hint provider #51273

Remove reference to removed InfluxDB auto-configuration #51172

Use JacksonJsonSerde in Kafka Streams documentation #51152

Document alternatives to HttpMessageConverters #51124

Caching documentation refers to AutoConfigureCache by its pre-4.0 package #51111

Metadata for spring.test.mockmvc.htmlunit.url declares the wrong type #51110

Fix examples in Metadata Format documentation chapter #51097

Improve discoverability of the AOT Cache How-to guides #50996

Table of auto-configured HealthIndicators lists the wrong key for MongoHealthIndicator #50931

Update OpenTelemetryResourceAttributes documentation #50867

Fix @Value placeholder syntax in external config docs #50859

Refer to spring-boot-starter-webmvc, not deprecated spring-boot-starter-web #50842

Fix forwarded headers property in cloud deployment docs #50841

Fix duplicate word typos in documentation #50738

🔨 Dependency Upgrades

Upgrade to CycloneDX Maven Plugin 2.9.3 #51178

Upgrade to DB2 JDBC 12.1.5.0 #50977

Upgrade to Elasticsearch Client 9.2.9 #51366

Upgrade to Groovy 5.0.8 #51179

... (truncated)

Commits

847f742 Release 4.0.8
2c92717 Upgrade to Spring Pulsar 2.0.7
365e687 Upgrade to Spring HATEOAS 3.0.5
aab9b6b Upgrade to Spring Data Bom 2025.1.7
3a096d5 Upgrade to Spring Session 4.0.5
bb99dda Upgrade to Spring Security 7.0.7
3f1c4ac Upgrade to Spring LDAP 4.0.5
19139ac Upgrade to Spring Kafka 4.0.7
b70535b Upgrade to Spring Integration 7.0.6
b90a00f Upgrade to Spring GraphQL 2.0.5
Additional commits viewable in compare view

Updates org.apache.maven:apache-maven from 3.9.11 to 3.9.16

Updates org.apache.maven.wrapper:maven-wrapper from 3.3.3 to 3.3.4

Release notes

Sourced from org.apache.maven.wrapper:maven-wrapper's releases.

3.3.4

🐛 Bug Fixes

Revert wrapper version removal (#365) @breun

👻 Maintenance

Ensure Path Traversal is fully addressed in MavenWrapperDownloader (#363) @hazendaz

Commits

524486a [maven-release-plugin] prepare release maven-wrapper-3.3.4
17c1ec9 Revert wrapper version removal (#365)
366207f Ensure Path Traversal is fully addressed in MavenWrapperDownloader
086b1c9 [maven-release-plugin] prepare for next development iteration
See full diff in compare view

Updates org.springframework.boot:spring-boot-starter-parent from 4.0.7 to 4.0.8

Release notes

Sourced from org.springframework.boot:spring-boot-starter-parent's releases.

v4.0.8

🐞 Bug Fixes

Kafka consumer-specific security protocol is not taken into account #51365

Temporary file is not deleted when ExportedImageTar construction fails #51117

spring-boot-h2-console pulls servlet-api as transitive dependency #51094

Methods that return the result of Map#remove are not declared with a @Nullable return type #50972

PropertiesLauncher does not log nested archive paths #50968

JarFile is not closed when finding main class from archive #50949

CloudFoundry reactive auto-configuration should not require a WebClient.Builder bean to be defined #50928

Resources are not cleaned up when resolving an image that is not yet present in the builder #50919

Context refresh fails on reactive Cloud Foundry when using Actuator without spring-boot-health #50916

GraphQlWebMvcAutoConfiguration should apply customizers in order #50908

Micrometer registries pin the application context #50886

Context refresh fails when using Actuator on Jersey without spring-boot-health #50858

Context refresh fails on Cloud Foundry when using Actuator without spring-boot-health #50857

IllegalStateException when binding properties to a @Validated class that contains a map whose value type is a wildcard #50798

Setting 'server.servlet.session.cookie.partitioned' to false still emits the 'Partitioned' cookie attribute #50781

Application-managed JUL bridge handler should only be removed if installed #50779

Inconsistent handling of empty string values of spring.security.oauth2.resourceserver.jwt issuer-uri and jwk-set-uri #50755

PropertiesWebClientHttpServiceGroupConfigurer has highest precedence, preventing other configurers from being ordered ahead of it #50737

High number of connections due to Mongo health indicator #50734

Return type nullability of ApplicationContextAssert's getBean methods does not indicate that bean may be null #50701

NativeImageResourceProvider flattens Flyway migration paths in subdirectories #50433

Fix ordering of Kotlinx Serialization CodecCustomizer #50428

Metadata annotation processor ignores getter-level @NestedConfigurationProperty for records #50096

📔 Documentation

spring.profiles.group should have a 'spring-profile-name' hint provider #51273

Remove reference to removed InfluxDB auto-configuration #51172

Use JacksonJsonSerde in Kafka Streams documentation #51152

Document alternatives to HttpMessageConverters #51124

Caching documentation refers to AutoConfigureCache by its pre-4.0 package #51111

Metadata for spring.test.mockmvc.htmlunit.url declares the wrong type #51110

Fix examples in Metadata Format documentation chapter #51097

Improve discoverability of the AOT Cache How-to guides #50996

Table of auto-configured HealthIndicators lists the wrong key for MongoHealthIndicator #50931

Update OpenTelemetryResourceAttributes documentation #50867

Fix @Value placeholder syntax in external config docs #50859

Refer to spring-boot-starter-webmvc, not deprecated spring-boot-starter-web #50842

Fix forwarded headers property in cloud deployment docs #50841

Fix duplicate word typos in documentation #50738

🔨 Dependency Upgrades

Upgrade to CycloneDX Maven Plugin 2.9.3 #51178

Upgrade to DB2 JDBC 12.1.5.0 #50977

Upgrade to Elasticsearch Client 9.2.9 #51366

Upgrade to Groovy 5.0.8 #51179

... (truncated)

Commits

847f742 Release 4.0.8
2c92717 Upgrade to Spring Pulsar 2.0.7
365e687 Upgrade to Spring HATEOAS 3.0.5
aab9b6b Upgrade to Spring Data Bom 2025.1.7
3a096d5 Upgrade to Spring Session 4.0.5
bb99dda Upgrade to Spring Security 7.0.7
3f1c4ac Upgrade to Spring LDAP 4.0.5
19139ac Upgrade to Spring Kafka 4.0.7
b70535b Upgrade to Spring Integration 7.0.6
b90a00f Upgrade to Spring GraphQL 2.0.5
Additional commits viewable in compare view

Updates org.apache.maven:apache-maven from 3.9.11 to 3.9.16

Updates org.apache.maven.wrapper:maven-wrapper from 3.3.3 to 3.3.4

Release notes

Sourced from org.apache.maven.wrapper:maven-wrapper's releases.

3.3.4

🐛 Bug Fixes

Revert wrapper version removal (#365) @breun

👻 Maintenance

Ensure Path Traversal is fully addressed in MavenWrapperDownloader (#363) @hazendaz

Commits

524486a [maven-release-plugin] prepare release maven-wrapper-3.3.4
17c1ec9 Revert wrapper version removal (#365)
366207f Ensure Path Traversal is fully addressed in MavenWrapperDownloader
086b1c9 [maven-release-plugin] prepare for next development iteration
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…pdates Bumps the guide-dependencies-maven group with 3 updates in the /complete directory: [org.springframework.boot:spring-boot-starter-parent](https://github.com/spring-projects/spring-boot), org.apache.maven:apache-maven and [org.apache.maven.wrapper:maven-wrapper](https://github.com/apache/maven-wrapper). Bumps the guide-dependencies-maven group with 3 updates in the /initial directory: [org.springframework.boot:spring-boot-starter-parent](https://github.com/spring-projects/spring-boot), org.apache.maven:apache-maven and [org.apache.maven.wrapper:maven-wrapper](https://github.com/apache/maven-wrapper). Updates `org.springframework.boot:spring-boot-starter-parent` from 4.0.7 to 4.0.8 - [Release notes](https://github.com/spring-projects/spring-boot/releases) - [Commits](spring-projects/spring-boot@v4.0.7...v4.0.8) Updates `org.apache.maven:apache-maven` from 3.9.11 to 3.9.16 Updates `org.apache.maven.wrapper:maven-wrapper` from 3.3.3 to 3.3.4 - [Release notes](https://github.com/apache/maven-wrapper/releases) - [Commits](apache/maven-wrapper@maven-wrapper-3.3.3...maven-wrapper-3.3.4) Updates `org.springframework.boot:spring-boot-starter-parent` from 4.0.7 to 4.0.8 - [Release notes](https://github.com/spring-projects/spring-boot/releases) - [Commits](spring-projects/spring-boot@v4.0.7...v4.0.8) Updates `org.apache.maven:apache-maven` from 3.9.11 to 3.9.16 Updates `org.apache.maven.wrapper:maven-wrapper` from 3.3.3 to 3.3.4 - [Release notes](https://github.com/apache/maven-wrapper/releases) - [Commits](apache/maven-wrapper@maven-wrapper-3.3.3...maven-wrapper-3.3.4) --- updated-dependencies: - dependency-name: org.springframework.boot:spring-boot-starter-parent dependency-version: 4.0.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: guide-dependencies-maven - dependency-name: org.apache.maven:apache-maven dependency-version: 3.9.16 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: guide-dependencies-maven - dependency-name: org.apache.maven.wrapper:maven-wrapper dependency-version: 3.3.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: guide-dependencies-maven - dependency-name: org.springframework.boot:spring-boot-starter-parent dependency-version: 4.0.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: guide-dependencies-maven - dependency-name: org.apache.maven:apache-maven dependency-version: 3.9.16 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: guide-dependencies-maven - dependency-name: org.apache.maven.wrapper:maven-wrapper dependency-version: 3.3.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: guide-dependencies-maven ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update Java code labels Sep 1, 2026

github-actions Bot enabled auto-merge (rebase) September 1, 2026 09:07

github-actions Bot merged commit 38b43f1 into main Sep 1, 2026
6 checks passed

dependabot Bot deleted the dependabot/maven/complete/main/guide-dependencies-maven-f20cf16dd6 branch September 1, 2026 09:09

Navigation Menu

Repository navigation

Bump the guide-dependencies-maven group across 2 directories with 3 updates - #110

Bump the guide-dependencies-maven group across 2 directories with 3 updates#110
github-actions[bot] merged 1 commit into
mainfrom
dependabot/maven/complete/main/guide-dependencies-maven-f20cf16dd6

dependabot Bot commented on behalf of github Sep 1, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Sep 1, 2026

v4.0.8

🐞 Bug Fixes

📔 Documentation

🔨 Dependency Upgrades

3.3.4

🐛 Bug Fixes

👻 Maintenance

v4.0.8

🐞 Bug Fixes

📔 Documentation

🔨 Dependency Upgrades

3.3.4

🐛 Bug Fixes

👻 Maintenance

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants