Upgrade Spring Boot to 3.4/3.5 and Jackson to 2.18.x #102

Summary

The conductor-client-spring module currently pins Spring Boot to 3.3.0. Spring Boot 3.3.x reached end-of-OSS-support in November 2024 and has known CVEs. Jackson is pinned to 2.17.1 across the project.

This issue tracks upgrading both to currently-supported versions.

Scope

• Bump spring-boot-starter in conductor-client-spring/build.gradle from 3.3.0 → 3.4.x or 3.5.x (latest supported)
• Bump jackson version in versions.gradle from 2.17.1 → 2.18.x (latest stable)
• Verify all modules build and tests pass after the upgrade
• Check for any API compatibility breaks between Spring Boot 3.3 → 3.4/3.5 affecting the SDK

Context

• Spring Boot 3.3.x is EOL; open CVEs [CVE-2025-22235] HIGH: spring-boot 3.3.7 - EndpointRequest.to() wrong matcher #84 and [CVE-2025-41249] HIGH: spring-core 6.1.16 - Annotation Detection Vulnerability #85 are filed against it
• PR Bump spring-boot-starter from 3.3.0 to 3.3.11 #86 bumps Spring Boot only to 3.3.11 (latest 3.3.x patch) — that is a stopgap, not the long-term fix
• Jackson 2.18.x is the current stable 2.x line; upgrading Spring Boot will also pull in a compatible Jackson via the BOM
• jackson-module-afterburner (currently used) was deprecated in Jackson 2.17 and removed in 2.18 — migration to jackson-module-blackbird will be required as part of this upgrade

Migration note

jackson-module-afterburner → jackson-module-blackbird swap required in build.gradle:

-implementation "com.fasterxml.jackson.module:jackson-module-afterburner:${versions.jackson}"
+implementation "com.fasterxml.jackson.module:jackson-module-blackbird:${versions.jackson}"