fix(deps): update dependency org.springframework:spring-web to v6 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
org.springframework:spring-web	5.3.24 -> 6.0.0

GitHub Vulnerability Alerts

CVE-2016-1000027

Pivotal Spring Framework before 6.0.0 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required.

Maintainers recommend investigating alternative components or a potential mitigating control. Version 4.2.6 and 3.2.17 contain enhanced documentation advising users to take precautions against unsafe Java deserialization, and version 6.0.0 and above deprecate the impacted classes.

---

Release Notes

spring-projects/spring-framework

v6.0.0

See What's New in Spring Framework 6.x and Upgrading to Spring Framework 6.x for upgrade instructions and details of new features.

⭐ New Features

• Avoid direct URL construction and URL equality checks #​29486
• Simplify creating RFC 7807 responses from functional endpoints #​29462
• Allow test classes to provide runtime hints via declarative mechanisms #​29455

📔 Documentation

• Align javadoc of DefaultParameterNameDiscoverer with its behavior #​29494
• Document AOT support in the TestContext framework #​29482
• Document Ahead of Time processing in the reference guide #​29350

🔨 Dependency Upgrades

• Upgrade to Reactor 2022.0.0 #​29465

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​ophiuhus and @​wilkinsona

v5.3.25

⭐ New Features

• JmsTemplate.convertAndSend throws NullPointerException during shutdown #​29719
• Optimize object creation in RequestMappingHandlerMapping#handleNoMatch #​29667
• Add title to SockJS iFrames for accessibility compliance #​29596

🐞 Bug Fixes

• ResourceHandlers cannot resolve static resources with certain wildcard patterns #​29716
• AnnotatedElementUtils.findMergedRepeatableAnnotations does not fetch results when other attributes exist for container annotation #​29686
• BeanWrapperImpl NPE in setWrappedInstance after invoking getPropertyValue (with SimpleBeanInfoFactory) #​29684
• SpEL ConstructorReference does not generate AST representation of arrays #​29666
• SpEL: Two double quotes are replaced by one double quote in single quoted String literal (and vice versa) #​29653
• SpEL string literal misses single quotation marks in toStringAST() #​29652
• 500 error from WebFlux when parsing Content-Type leads to InvalidMediaTypeException #​29637
• WebMvcConfigurationSupport should not catch Throwable for SourceHttpMessageConverter #​29537

📔 Documentation

• Update Jakarta Mail info in ref docs #​29708
• Improve documentation for literals in SpEL expressions #​29701
• Fix some typos in Kotlin WebClient example code #​29542
• Fix link to Bean Utils Light Library in BeanUtils Javadoc #​29536
• Fix link to WebFlux section in reference manual #​29526
• Link to Spring WebFlux section is broken #​29517

🔨 Dependency Upgrades

• Upgrade to Reactor 2020.0.27 #​29798

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.

[renovate]

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update. You will not get PRs for any future 6.x releases. But if you manually upgrade to 6.x then Renovate will re-enable minor and patch updates automatically.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.