* fix: bump jackson to 2.21.2 to address CVE (SNYK-JAVA-COMFASTERXMLJACKSONCORE-15907551)

Upgrade jackson-bom from 2.18.6 to 2.21.2 to fix the remaining
high-severity Allocation of Resources Without Limits or Throttling
vulnerability in jackson-core reported in #1714.

Signed-off-by: Javier Aliaga <[email protected]>

* fix(deps): upgrade Spring Boot to 3.5.12 and address remaining CVEs

- Spring Boot 3.4.10 → 3.5.12 (fixes actuator auth bypass, logback,
  tomcat, spring-web/webmvc CVEs)
- Jackson 3.x BOM 3.1.0 → 3.1.1 in SB4 modules
  (SNYK-JAVA-TOOLSJACKSONCORE-15907550)
- Commons Compress 1.24.0 → 1.26.0 override
  (SNYK-JAVA-ORGAPACHECOMMONS-6254296, -6254297)
- Removed springframework.version property (managed by SB 3.5.12)

Signed-off-by: Javier Aliaga <[email protected]>

* fix(deps): add commons-codec dependency for commons-compress 1.26.0

Commons-compress 1.26.0 declares commons-codec as optional, but
testcontainers uses it at runtime causing ClassNotFoundException
for org.apache.commons.codec.Charsets.

Signed-off-by: Javier Aliaga <[email protected]>

* fix(deps): add commons-codec as direct dependency in testcontainers-dapr

The dependencyManagement entry alone doesn't pull in optional transitive
deps. commons-codec must be declared as a direct dependency so it's
available at runtime for commons-compress/testcontainers.

Signed-off-by: Javier Aliaga <[email protected]>

* fix(deps): revert to Spring Boot 3.4.10 with explicit security overrides

Keep Spring Boot 3.4.10 for backward compatibility with users on 3.4.x.
Patch CVEs via explicit dependency overrides instead of SB version bump:
- Spring Framework 6.2.17 (spring-web, spring-webmvc)
- Logback 1.5.25
- Tomcat Embed 10.1.52
- Commons Compress 1.26.0 + Commons Codec 1.17.2

Note: spring-boot-actuator auth bypass CVEs remain (requires SB 3.5.x).
Signed-off-by: Javier Aliaga <[email protected]>

* fix(deps): use Spring Framework BOM to avoid version mismatches

Replace individual spring-web/spring-webmvc overrides with
spring-framework-bom 6.2.17 imported before Spring Boot BOM.
This ensures all Spring Framework modules are upgraded consistently,
fixing NoClassDefFoundError for ThemeSource caused by partial upgrades.

Signed-off-by: Javier Aliaga <[email protected]>

* fix(deps): bump Spring Boot to 3.4.13, drop Spring Framework override

Keep Spring Boot and Spring Framework aligned (SB 3.4.13 → SF 6.2.15).
Removes spring-framework-bom override to 6.2.17 which caused version
mismatches (ThemeSource NoClassDefFoundError).

Spring webmvc/web CVEs (6.2.15) remain — only fixable with SB 3.5.x.

Signed-off-by: Javier Aliaga <[email protected]>

---------

Signed-off-by: Javier Aliaga <[email protected]>

Signed-off-by: Dapr Bot <[email protected]>

Parent pom dependencyManagement does not propagate to consumers.
grpc-netty's transitive netty was resolving to 4.1.130 for anyone
depending on dapr-sdk from Maven Central, leaving them exposed to
CVE-2026-33870 (HTTP Request Smuggling).

Add explicit netty dependencies in sdk/pom.xml so the pinned version
(4.1.132.Final) is published in the module pom and overrides the
transitive versions for consumers.

Signed-off-by: Javier Aliaga <[email protected]>

Signed-off-by: Dapr Bot <[email protected]>

Signed-off-by: Dapr Bot <[email protected]>

Signed-off-by: Dapr Bot <[email protected]>