fix(deps): pin org.springframework:spring-expression to 7.0.8 (GHSA-9f52-rjqv-25qv)

claude · catarina-correia · claude · commit 56485556c685 · 2026-07-31T12:31:03.000Z
Co-Authored-By: Catarina Correia &lt;catarina.correia@getyourguide.com&gt;
diff --git a/build.gradle b/build.gradle
@@ -58,6 +58,11 @@ subprojects {
                         'GHSA-mvh2-crg5-v77c: multiple Netty vulnerabilities, including SPDY zlib header block continues decoded expansion ' +
                         'after maxHeaderSize truncation, fixed in 4.2.16.Final')
             }
+            if (requested.group == 'org.springframework' && requested.name == 'spring-expression'
+                    && requested.version != null && requested.version < '7.0.8') {
+                useVersion('7.0.8')
+                because('GHSA-9f52-rjqv-25qv: Spring Framework Arbitrary Method Invocation in SpEL Expressions')
+            }
         }
     }
 

Original file line number	Diff line number	Diff line change
`@@ -58,6 +58,11 @@ subprojects {`
`58`	`58`	`'GHSA-mvh2-crg5-v77c: multiple Netty vulnerabilities, including SPDY zlib header block continues decoded expansion ' +`
`59`	`59`	`'after maxHeaderSize truncation, fixed in 4.2.16.Final')`
`60`	`60`	`}`
	`61`	`+ if (requested.group == 'org.springframework' && requested.name == 'spring-expression'`
	`62`	`+ && requested.version != null && requested.version < '7.0.8') {`
	`63`	`+ useVersion('7.0.8')`
	`64`	`+ because('GHSA-9f52-rjqv-25qv: Spring Framework Arbitrary Method Invocation in SpEL Expressions')`
	`65`	`+ }`
`61`	`66`	`}`
`62`	`67`	`}`
`63`	`68`