Skip to content

build: update Spring Boot to 4.1.2 and Jackson to 3.2.4 - #28

Merged
mosobande merged 5 commits into
orifrom
deps/spring-boot-4.1.2
Nov 8, 2026
Merged

mosobande merged 5 commits into
orifrom
deps/spring-boot-4.1.2

Conversation

@mosobande

@mosobande mosobande commented Nov 8, 2026 •

Copy link
Copy Markdown
Contributor

Updates Spring Boot to 4.1.2 and Jackson to 3.2.4 together.

  • spring-boot.version 4.1.1 → 4.1.2 in the root POM.
  • spring-boot-starter-parent 4.1.1 → 4.1.2 in examples/spring-app.
  • jackson.version (the tools.jackson:jackson-bom import) 3.1.7 → 3.2.4.
  • The docs and sample app now name the new baseline. Boot 4.1.2 ships Tomcat 11.0.27 and Jackson 3.1.7, so the comments that called Boot's defaults vulnerable are updated. The sample's jackson-bom.version and the README snippet move to 3.2.4 to match what Ogiri is built against. The Tomcat 11.0.27 pin stays, so older Boot 4.1.x imports still get a patched Tomcat.

The earlier red CI on the separate update PRs was not caused by these updates. It came from new advisories against two test-only lockfiles, fixed in #26.

Checked locally with mise run check:repo (PASS) and mise run check:java against PostgreSQL (BUILD SUCCESS, no test failures). CI runs the full database and Java version matrix.

Replaces #19, #20 and #21.

Àtúnwò: ✅ No findings · Reviewed b358eb5
Àtúnwò Review: 0 findings; 0 critical; 0 fixed; 0 dismissed

dependabot Bot and others added 4 commits November 8, 2026 08:23
Bumps [org.springframework.boot:spring-boot-starter-parent](https://github.com/spring-projects/spring-boot) from 4.1.1 to 4.1.2.
- [Release notes](https://github.com/spring-projects/spring-boot/releases)
- [Commits](spring-projects/spring-boot@v4.1.1...v4.1.2)

---
updated-dependencies:
- dependency-name: org.springframework.boot:spring-boot-starter-parent
  dependency-version: 4.1.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps `spring-boot.version` from 4.1.1 to 4.1.2.

Updates `org.springframework.boot:spring-boot-dependencies` from 4.1.1 to 4.1.2
- [Release notes](https://github.com/spring-projects/spring-boot/releases)
- [Commits](spring-projects/spring-boot@v4.1.1...v4.1.2)

Updates `org.springframework.boot:spring-boot-configuration-processor` from 4.1.1 to 4.1.2
- [Release notes](https://github.com/spring-projects/spring-boot/releases)
- [Commits](spring-projects/spring-boot@v4.1.1...v4.1.2)

Updates `org.springframework.boot:spring-boot-autoconfigure-processor` from 4.1.1 to 4.1.2
- [Release notes](https://github.com/spring-projects/spring-boot/releases)
- [Commits](spring-projects/spring-boot@v4.1.1...v4.1.2)

---
updated-dependencies:
- dependency-name: org.springframework.boot:spring-boot-dependencies
  dependency-version: 4.1.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: org.springframework.boot:spring-boot-configuration-processor
  dependency-version: 4.1.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: org.springframework.boot:spring-boot-autoconfigure-processor
  dependency-version: 4.1.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [tools.jackson:jackson-bom](https://github.com/FasterXML/jackson-bom) from 3.1.7 to 3.2.4.
- [Commits](FasterXML/jackson-bom@jackson-bom-3.1.7...jackson-bom-3.2.4)

---
updated-dependencies:
- dependency-name: tools.jackson:jackson-bom
  dependency-version: 3.2.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@mosobande

Copy link
Copy Markdown
Contributor Author

@atunwo review

@atunwo atunwo Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Àtúnwò review · ✅ No findings

Reviewed b358eb5

Updates the build and sample application to Spring Boot 4.1.2 and Jackson 3.2.4, with matching documentation and unchanged Tomcat pins. Dependency resolution and runtime compatibility were not independently executed; the supplied Java/database matrix and HTTP conformance checks were still in progress.

@mosobande
mosobande merged commit d0de632 into ori Nov 8, 2026
@mosobande
mosobande deleted the deps/spring-boot-4.1.2 branch November 8, 2026 11:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant