From 5487efa8529301d5ca3817e2bcd9c5b6183d1087 Mon Sep 17 00:00:00 2001
From: Eric Sognefest <esognefest@bitwarden.com>
Date: Tue, 8 Sep 2026 15:50:21 -0400
Subject: [PATCH 1/2] [PM-42223] - Bump spring-boot-starter-parent to 3.5.16 in
 passwordless-java example

Resolves CVE-2022-1471 (snakeyaml unsafe deserialization) by bringing
snakeyaml to 2.4. This same bump also clears the transitive Apache
Tomcat (10.1.55) and Thymeleaf (3.1.5.RELEASE) advisories tracked on
the same pom.xml, both fixed under this one parent version change.

springdoc-openapi-starter-webmvc-ui is bumped to 2.8.17 alongside it,
since 2.2.0 predates Spring Boot's move to PathPatternParser as the
default in 3.2+ and would break OpenAPI/Swagger UI on the new parent.
---
 examples/spring-boot-3-jdk-17/pom.xml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/examples/spring-boot-3-jdk-17/pom.xml b/examples/spring-boot-3-jdk-17/pom.xml
index 6a8bb34..3433ec6 100644
--- a/examples/spring-boot-3-jdk-17/pom.xml
+++ b/examples/spring-boot-3-jdk-17/pom.xml
@@ -5,7 +5,7 @@
     <parent>
         <groupId>org.springframework.boot</groupId>
         <artifactId>spring-boot-starter-parent</artifactId>
-        <version>3.1.3</version>
+        <version>3.5.16</version>
         <relativePath/> <!-- lookup parent from repository -->
     </parent>
     <groupId>com.bitwarden</groupId>
@@ -39,7 +39,7 @@
         <dependency>
             <groupId>org.springdoc</groupId>
             <artifactId>springdoc-openapi-starter-webmvc-ui</artifactId>
-            <version>2.2.0</version>
+            <version>2.8.17</version>
         </dependency>
         <dependency>
             <groupId>org.springframework.boot</groupId>

From 1f99fb7eddcc3f1efd189db93ba9574caa718a9a Mon Sep 17 00:00:00 2001
From: Eric Sognefest <esognefest@bitwarden.com>
Date: Tue, 8 Sep 2026 16:25:59 -0400
Subject: [PATCH 2/2] Override jackson-bom to 2.22.2 to clear Aikido-flagged
 CVEs in transitive jackson-databind

---
 examples/spring-boot-3-jdk-17/pom.xml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/examples/spring-boot-3-jdk-17/pom.xml b/examples/spring-boot-3-jdk-17/pom.xml
index 3433ec6..fa9bd1c 100644
--- a/examples/spring-boot-3-jdk-17/pom.xml
+++ b/examples/spring-boot-3-jdk-17/pom.xml
@@ -19,6 +19,9 @@
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
 
         <lombok.version>1.18.38</lombok.version>
+        <!-- Override the parent's managed Jackson version: 3.5.16 pins jackson-bom 2.21.4,
+             which carries 2 medium CVEs fixed in 2.21.5. -->
+        <jackson-bom.version>2.22.2</jackson-bom.version>
     </properties>
 
     <dependencies>