bump commons-fileupload to fix CVE-2025-48976 (form-spring)

[DRoppelt]

fixes GHSA-vv7r-c36w-3prj

It does not seem like form-spring would be affected, but this would fix any of the dumb auditing tools that only look for the presence of libs

[DRoppelt]

duplicate of #2940

[DRoppelt]

feign-vertx appears to be crunchy, https://app.circleci.com/pipelines/github/OpenFeign/feign/3980/workflows/39943145-aa46-4d8d-ab39-e95da93e0181/jobs/9602 failed where https://app.circleci.com/pipelines/github/OpenFeign/feign/3981/workflows/d64c1fae-3704-4898-9abe-4f05b44c6f2d/jobs/9604 was a re-run done via a squash of two commits

[feign-vertx] [ERROR] Errors: 
[feign-vertx] [ERROR]   TimeoutHandlingTest.whenTimeoutIsNotReached(VertxTestContext) » NoStackTraceTimeout The timeout period of 1000ms has been exceeded while executing GET /icecream/flavors for server localhost:43411
[feign-vertx] [INFO] 
[feign-vertx] [ERROR] Tests run: 25, Failures: 0, Errors: 1, Skipped: 2
[feign-vertx] [INFO] 

Also, bump from commons-fileupload 1.5 to 1.6.0 caused moditect to fail, other modules ignore it too, doing it here as well
the skip property ignores this error
[ERROR] Failed to execute goal org.moditect:moditect-maven-plugin:1.3.0.Final:add-module-info (add-module-infos) on project feign-form-spring: Execution add-module-infos of goal org.moditect:moditect-maven-plugin:1.3.0.Final:add-module-info failed: Module portlet.api not found, required by org.apache.commons.fileupload

I tried to configure/tweak moditect-maven-plugin, but found what the plugin does or what kind of config is required confusing and gave up. It sounds like a "form-spring requires portlet.api, because of commons-fileupload" (duh), the plugin docs were not straight forward to declare that module-requirement

[velo]

I'm so tempted to remove moditect

[maxl2287]

@velo is it possible to bump this commit / PR into an own Patch release 13.6.1?
So that spring-cloud could add this as a patch release in their next release?

[velo]

🤖 Claude Bot — A patch release 13.6.1 has been created and published to Maven Central.

Release: https://github.com/OpenFeign/feign/releases/tag/13.6.1

This includes the commons-fileupload bump from this PR.

[maxl2287]

🤖 Claude Bot — A patch release 13.6.1 has been created and published to Maven Central.

Release: https://github.com/OpenFeign/feign/releases/tag/13.6.1

This includes the commons-fileupload bump from this PR.

@velo i Saw that the Build failed. 🤔

[iProdigy]

@velo i Saw that the Build failed. 🤔

Looks published on maven https://repo1.maven.org/maven2/io/github/openfeign/feign-form-spring/13.6.1/