Mitigare CVE-2025-41249 (#1119)

Author: tommystendahl

CHANGES.md

@@ -2,6 +2,7 @@
 
 ## Version 6.0.8
 
+* Mitigate CVE-2025-41249
 * Refactor ecchronos-binary Test Infrastructure - Issue #1093
 * Schedule not showing if ecchronos keyspace is not replicated correctly - Issue #1112
 

pom.xml

@@ -89,6 +89,7 @@
         <org.springframework.boot.spring-boot-starter-thymeleaf.version>3.5.5</org.springframework.boot.spring-boot-starter-thymeleaf.version>
         <org.springframework.boot.spring-boot-starter-web.version>3.5.5</org.springframework.boot.spring-boot-starter-web.version>
         <org.springframework.spring-boot-test.version>3.5.5</org.springframework.spring-boot-test.version>
+        <org.springframework.spring-core.version>6.2.11</org.springframework.spring-core.version>
         <org.springframework.spring-test.version>6.2.11</org.springframework.spring-test.version>
         <org.yaml.snakeyaml.version>2.5</org.yaml.snakeyaml.version>
         <slf4j.version>2.0.17</slf4j.version>
@@ -164,6 +165,13 @@
                 <version>${io.prometheus.prometheus-metrics-tracer-common.version}</version>
             </dependency>
 
+            <!-- Used by spring-boot-starter-web, spring-test and spring-boot-test, steped due to CVE-2025-41249 -->
+            <dependency>
+                <groupId>org.springframework</groupId>
+                <artifactId>spring-core</artifactId>
+                <version>${org.springframework.spring-core.version}</version>
+            </dependency>
+
             <!-- End of temporary override section -->
 
             <!-- Netty -->