bug: upgrade Spring Framework to 5.3.39 (CVE-2022-22965 and related)

[devin-ai-integration]

Summary

The Spring Boot 2.6.3 BOM resolves Spring Framework to 5.3.15, which is affected by CVE-2022-22965 (Spring4Shell, fixed 5.3.18), CVE-2022-22968 (fixed 5.3.19), CVE-2022-22950 / CVE-2023-20863 (SpEL DoS, fixed 5.3.27) and CVE-2024-22243 / CVE-2024-22262 (UriComponentsBuilder host parsing, fixed 5.3.34).

This pins the BOM-managed framework version to the last 5.3.x release, which covers all of the above:

 }
+// Overrides the Spring Framework version managed by the Spring Boot 2.6.3 BOM (5.3.15).
+ext['spring-framework.version'] = '5.3.39'
+
 version = '0.0.1-SNAPSHOT'

spring-framework.version is the property the Spring Boot BOM uses for spring-core/spring-web/spring-beans/etc., so this bumps every Spring Framework artifact at once; 5.3.x patch releases are binary-compatible, so no source changes are needed.

Why not bump Spring Boot to 2.7.x, as the finding suggests: the project depends on graphql-dgs-spring-boot-starter:4.9.21, and DGS only supports Spring Boot 2.7 from 5.5.x onwards (and drops Boot 2 entirely in 6.x). Boot 2.7's own framework version is 5.3.31 — older than what is pinned here — so a Boot bump would pull in a DGS/Spring Security major upgrade without closing any additional CVE from this finding. Keeping the change scoped to the framework version is the smaller, fully-covering fix.

Verification: Maven Central and the Gradle plugin portal are outside this session's network allowlist and there is no Gradle offline cache for this project, so ./gradlew compileJava / ./gradlew test could not be run here (the repo also has no CI workflow). The change is a single BOM property override with no API surface change.

Written by Devin

Devin-Org: engineering

---

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.