Wiretap
All releases

v4.1.2

dependency-hygiene

Current dependencies and a clean vulnerability scan for the Spring Boot 4.1 line.

Highlights

  • 01

    Current stable dependencies

    Java build, test, publishing, and documentation dependencies have moved to their latest compatible stable releases.

  • 02

    Clean OSV and Trivy scans

    OSV Scanner 2.4.0 and Trivy 0.72.0 report zero vulnerabilities across the resolved Java SBOM and npm lockfile.

  • 03

    Patched site toolchain

    The documentation lockfile uses patched Next.js, Sharp, and brace-expansion releases with a modern ESLint 10 toolchain.

Full notes

Changed

  • Bumped the project development version to 4.1.2-SNAPSHOT and updated public installation snippets and AI skill packs to target io.gitlab.guisseppe:spring-kafka-test-utils:4.1.2.
  • Updated the Jackson 2 BOM to 2.22.1, imported the complete Jackson 3 BOM at 3.2.1 ahead of Spring Boot dependency management, and updated json-schema-validator to 3.0.6, Confluent Kafka Avro Serializer to 8.3.0, Maven Javadoc Plugin to 3.12.0, and Maven GPG Plugin to 3.2.8.
  • Updated the documentation site to its latest compatible stable dependency set, including Next.js 16.2.12, React 19.2.8, Radix UI patches, lucide-react 1.25.0, Shiki 4.3.1, Tailwind CSS 4.3.3, PostCSS 8.5.21, ESLint 10.8.0, and Node.js type definitions 26.1.1.
  • Replaced eslint-config-next and its vulnerable legacy minimatch plugin chain with ESLint 10 flat configuration using the maintained Next.js, TypeScript, and React Hooks plugins directly.

Fixed

  • Applied the CI Maven mirror settings to the release version lookup without including --show-version, allowing Central publishing to resolve the project and capture only the snapshot version.
  • Preserved the original JSON parse exception as the cause when a documentation release file is invalid.

Security

  • Removed vulnerable transitive brace-expansion 1.1.15 from the documentation lockfile, resolving CVE-2026-13149 / GHSA-3jxr-9vmj-r5cp.
  • Upgraded Next.js to 16.2.12 and pinned Sharp 0.35.3 and brace-expansion 5.0.8, resolving the July 2026 Next.js advisories, GHSA-f88m-g3jw-g9cj, and GHSA-mh99-v99m-4gvg.
  • Overrode Kafka's transitive at.yawk.lz4:lz4-java dependency to 1.11.1, resolving CVE-2026-59949 / GHSA-xx22-p4ch-683r.
  • Scanned the resolved Java CycloneDX SBOM and npm lockfile with OSV Scanner 2.4.0 and Trivy 0.72.0; both scanners reported zero vulnerabilities.