Skip to content

Conversation

@RichardSlater
Copy link
Contributor

📲 What

bump spring-web to 6.2.8

🤔 Why

As part of our responsibilities under ISO27001, we are required to manage and mitigate risks associated with software vulnerabilities. By enforcing a secure version of webpack-dev-server, we reduce the risk of known vulnerabilities being exploited in our development environment. This proactive approach to dependency management demonstrates our commitment to maintaining the confidentiality, integrity, and availability of our information assets, as required by ISO27001 controls on software development and vulnerability management.

🛠 How

More in-depth discussion of the change or implementation.

👀 Evidence

>> Line Coverage: 826/1735 (48%)
>> Generated 1226 mutations Killed 288 (23%)
>> Mutations with no coverage 826. Test strength 72%
>> Ran 812 tests (0.66 tests per mutation)

🕵️ How to test

Build broken due to OWASP Dependency Check

✅ Acceptance criteria Checklist

  • Code peer reviewed?
  • Documentation has been updated to reflect the changes?
  • Passing all automated tests, including a successful deployment?
  • Passing any exploratory testing?
  • Rebased/merged with latest changes from development and re-tested?
  • Meeting the Coding Standards?

@RichardSlater RichardSlater requested a review from Copilot June 27, 2025 10:14
@RichardSlater RichardSlater self-assigned this Jun 27, 2025
@RichardSlater RichardSlater added the dependencies Pull requests that update a dependency file label Jun 27, 2025
Copy link

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR updates the spring-web dependency to version 6.2.8 in the api-tests module for improved security and ISO27001 compliance.

  • Bumped spring.web.version from 6.0.23 to 6.2.8
  • Aligns dependency with latest secure Spring Web release

<xerces.version>2.12.2</xerces.version>
<commons.codec.version>1.15</commons.codec.version>
<spring.web.version>6.0.23</spring.web.version>
<spring.web.version>6.2.8</spring.web.version>
Copy link

Copilot AI Jun 27, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[nitpick] Consider moving the spring.web.version property into the parent POM's dependencyManagement section to centralize version control and avoid duplication across modules.

Copilot uses AI. Check for mistakes.
@RichardSlater RichardSlater merged commit ce372e5 into main Jun 27, 2025
@RichardSlater RichardSlater deleted the hotfix/api-tests/2025-06-27 branch August 15, 2025 09:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants