deps(deps): bump the spring group across 1 directory with 2 updates

[dependabot]

Bumps the spring group with 2 updates in the / directory: org.springframework.boot:spring-boot-dependencies and org.springframework.boot:spring-boot-starter-test.

Updates org.springframework.boot:spring-boot-dependencies from 3.4.1 to 3.5.13

Release notes

Sourced from org.springframework.boot:spring-boot-dependencies's releases.

v3.5.13

⚠️ Attention Required

• Jackson has been upgraded to 2.21.2 in response to the Jackson team ending support for Jackson 2.19.x and 2.20.x. #49365

🐞 Bug Fixes

• WebSocket messaging's task executors are only auto-configured and stompWebSocketHandlerMapping is only forced to be eager when using Jackson #49750
• Metadata annotation processor ignores method-level @NestedConfigurationProperty when using constructor binding #49734
• Override of property in external 'application.properties' or 'application.yaml' is ignored #49724
• Some sliced tests that import TransactionAutoConfiguration do not import TransactionManagerCustomizationAutoConfiguration #49716
• NativeImageResourceProvider does not find Flyway migration scripts in subdirectories #49661
• @GraphQlTest does not include @ControllerAdvice #49660

📔 Documentation

• Fix incorrect indefinite articles in Javadoc #49723
• Add some more Kotlin examples and trivial style fixes #49710

🔨 Dependency Upgrades

• Upgrade to Hibernate 6.6.45.Final #49757
• Upgrade to jOOQ 3.19.31 #49758
• Upgrade to Netty 4.1.132.Final #49759
• Upgrade to Tomcat 10.1.53 #49760
• Upgrade to Undertow 2.3.24.Final #49761
• Upgrade to Zipkin Reporter 3.5.3 #49756

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​Joowon-Seo, @​deejay1, @​dlwldnjs1009, and @​ljrmorgan

v3.5.12

🐞 Bug Fixes

• EndpointRequest request matcher for health groups is too complex #49648
• "/cloudfoundryapplication" web path is not limited to Actuator #49645
• RSocket exposes duplicate endpoint for websocket setups #49592
• Fix EndpointRequest.toLinks() when base-path is '/' #49591
• SpringBootContextLoader mentions class that no longer exists in message for classes or locations assertion #49518
• "spring.main.cloud-platform=none" does not disable cloud features #49478
• Using @AutoConfigureWebTestClient prevents separate configuration of spring.test.webtestclient.timeout from taking effect #49340
• Ordering of 'spring.config.import' is inconsistent when defined in environment or system properties #49324
• RouterFunctions descriptions in Actuator do not support nesting #49289
• Maven plugin does not set '-parameters' option when processing AOT code #49268
• SSL support with Docker Compose does not work as documented #49210
• Docker fails when a 'tcp://' address ends with a slash (for example 'tcp://docker:2375/') #49055

... (truncated)

Commits

• 4a4c79f Release v3.5.13
• 696a60e Full auto-configure transaction management in slice tests
• 4b37ecb Upgrade to Undertow 2.3.24.Final
• 32a51d5 Upgrade to Tomcat 10.1.53
• 0934296 Upgrade to Netty 4.1.132.Final
• 851ddda Upgrade to jOOQ 3.19.31
• ef876fe Upgrade to Hibernate 6.6.45.Final
• 2841d87 Upgrade to Zipkin Reporter 3.5.3
• 025b527 Fix WebSocketMessagingAutoConfiguration in the absence of Jackson
• 3282672 Make DevTools tests more tolerant to wrapped DataSource
• Additional commits viewable in compare view

Updates org.springframework.boot:spring-boot-starter-test from 3.4.1 to 3.5.13

Release notes

Sourced from org.springframework.boot:spring-boot-starter-test's releases.

v3.5.13

⚠️ Attention Required

• Jackson has been upgraded to 2.21.2 in response to the Jackson team ending support for Jackson 2.19.x and 2.20.x. #49365

🐞 Bug Fixes

• WebSocket messaging's task executors are only auto-configured and stompWebSocketHandlerMapping is only forced to be eager when using Jackson #49750
• Metadata annotation processor ignores method-level @NestedConfigurationProperty when using constructor binding #49734
• Override of property in external 'application.properties' or 'application.yaml' is ignored #49724
• Some sliced tests that import TransactionAutoConfiguration do not import TransactionManagerCustomizationAutoConfiguration #49716
• NativeImageResourceProvider does not find Flyway migration scripts in subdirectories #49661
• @GraphQlTest does not include @ControllerAdvice #49660

📔 Documentation

• Fix incorrect indefinite articles in Javadoc #49723
• Add some more Kotlin examples and trivial style fixes #49710

🔨 Dependency Upgrades

• Upgrade to Hibernate 6.6.45.Final #49757
• Upgrade to jOOQ 3.19.31 #49758
• Upgrade to Netty 4.1.132.Final #49759
• Upgrade to Tomcat 10.1.53 #49760
• Upgrade to Undertow 2.3.24.Final #49761
• Upgrade to Zipkin Reporter 3.5.3 #49756

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​Joowon-Seo, @​deejay1, @​dlwldnjs1009, and @​ljrmorgan

v3.5.12

🐞 Bug Fixes

• EndpointRequest request matcher for health groups is too complex #49648
• "/cloudfoundryapplication" web path is not limited to Actuator #49645
• RSocket exposes duplicate endpoint for websocket setups #49592
• Fix EndpointRequest.toLinks() when base-path is '/' #49591
• SpringBootContextLoader mentions class that no longer exists in message for classes or locations assertion #49518
• "spring.main.cloud-platform=none" does not disable cloud features #49478
• Using @AutoConfigureWebTestClient prevents separate configuration of spring.test.webtestclient.timeout from taking effect #49340
• Ordering of 'spring.config.import' is inconsistent when defined in environment or system properties #49324
• RouterFunctions descriptions in Actuator do not support nesting #49289
• Maven plugin does not set '-parameters' option when processing AOT code #49268
• SSL support with Docker Compose does not work as documented #49210
• Docker fails when a 'tcp://' address ends with a slash (for example 'tcp://docker:2375/') #49055

... (truncated)

Commits

• 4a4c79f Release v3.5.13
• 696a60e Full auto-configure transaction management in slice tests
• 4b37ecb Upgrade to Undertow 2.3.24.Final
• 32a51d5 Upgrade to Tomcat 10.1.53
• 0934296 Upgrade to Netty 4.1.132.Final
• 851ddda Upgrade to jOOQ 3.19.31
• ef876fe Upgrade to Hibernate 6.6.45.Final
• 2841d87 Upgrade to Zipkin Reporter 3.5.3
• 025b527 Fix WebSocketMessagingAutoConfiguration in the absence of Jackson
• 3282672 Make DevTools tests more tolerant to wrapped DataSource
• Additional commits viewable in compare view

Most Recent Ignore Conditions Applied to This Pull Request

Dependency Name	Ignore Conditions
org.springframework.boot:spring-boot-dependencies	[>= 4.a0, < 5]
org.springframework.boot:spring-boot-starter-test	[>= 4.a0, < 5]

[dependabot]

Labels

The following labels could not be found: dependencies, java. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 1 package(s) with unknown licenses.

See the Details below.

License Issues

aether-datafixers-spring-boot-starter/pom.xml

Package	Version	License	Issue Type
org.springframework.boot:spring-boot-dependencies	3.5.13	Null	Unknown License

Denied Licenses:

GPL-3.0-only, GPL-3.0-or-later, AGPL-3.0-only, AGPL-3.0-or-later

OpenSSF Scorecard

Package	Version	Score	Details
maven/org.springframework.boot:spring-boot-starter-test	3.5.13	🟢 6.3	Details Check Score Reason Code-Review ⚠️ 0 Found 0/30 approved changesets -- score normalized to 0 Maintained 🟢 10 30 commit(s) and 29 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege License 🟢 10 license file detected Security-Policy 🟢 10 security policy file detected Branch-Protection 🟢 3 branch protection is not maximal on development and all release branches Signed-Releases ⚠️ -1 no releases found SAST ⚠️ 0 no SAST tool detected Binary-Artifacts 🟢 5 binaries present in source code Fuzzing 🟢 10 project is fuzzed Pinned-Dependencies 🟢 4 dependency not pinned by hash detected -- score normalized to 4
maven/org.springframework.boot:spring-boot-dependencies	3.5.13	🟢 6.3	Details Check Score Reason Code-Review ⚠️ 0 Found 0/30 approved changesets -- score normalized to 0 Maintained 🟢 10 30 commit(s) and 29 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege License 🟢 10 license file detected Security-Policy 🟢 10 security policy file detected Branch-Protection 🟢 3 branch protection is not maximal on development and all release branches Signed-Releases ⚠️ -1 no releases found SAST ⚠️ 0 no SAST tool detected Binary-Artifacts 🟢 5 binaries present in source code Fuzzing 🟢 10 project is fuzzed Pinned-Dependencies 🟢 4 dependency not pinned by hash detected -- score normalized to 4

Scanned Files

• aether-datafixers-functional-tests/pom.xml
• aether-datafixers-spring-boot-starter/pom.xml