fix(deps): update dependency org.springframework:spring-web to v6.1.6 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
org.springframework:spring-web	6.1.5 -> 6.1.6

GitHub Vulnerability Alerts

CVE-2024-22262

Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html  attack or to a SSRF attack if the URL is used after passing validation checks.

This is the same as CVE-2024-22259 https://spring.io/security/cve-2024-22259  and CVE-2024-22243 https://spring.io/security/cve-2024-22243 , but with different input.

---

Release Notes

spring-projects/spring-framework (org.springframework:spring-web)

v6.1.6

⭐ New Features

• Log column type for limited support message in JdbcUtils.getResultSetValue #​32601
• Consistent support for generic FactoryBean type matching when using getBeanProvider #​32590
• @RequestParam binding does not support params with an empty array "[]" suffix #​32577
• Maximum Request Size handling support for Undertow in StandardMultipartHttpServletRequest #​32549
• Introduce common support for is-null-safe checks in SpEL nodes #​32516
• Avoid additional unnecessary Annotation array cloning in TypeDescriptor #​32476
• Avoid cloning empty Annotation array in TypeDescriptor #​32405

🐞 Bug Fixes

• Refine scheme, userinfo, host and port parsing in UriComponentsBuilder #​32616
• "GET must not have a request body" exception with OkhttpClient and BufferingClientHttpRequestFactory #​32612
• JMSTemplate.sendAndReceive does not propagate tracer over the wire #​32606
• Calling Kotlin suspend functions in non-reactive application crashes due to unresolvable class #​32599
• MethodIntrospector.selectMethods() fails to detect bridge methods across ApplicationContexts #​32586
• Fix handling value class with private constructor on proxy #​32536
• ReactorNettyClientResponse should not dispose connection #​32528
• CompoundExpression omits null-safe syntax in AST string representation of null-safe selection/projection in SpEL #​32515
• Generic Kotlin controllers got broken in 6.1.5 #​32510
• WebFlux Blocking controller runs on non-blocking thread when request input data present #​32502
• Generic interface on FactoryBean class not autowired in case of targetType mismatch #​32489
• HeaderContentNegotiationStrategy.resolveMediaTypes() throws unexpected InvalidMimeTypeException #​32483
• JmsUtils.commitIfNecessary catches and ignores JMS IllegalStateException, losing message with ActiveMQ Artemis #​32473
• Missing bean class in native image with a Kotlin nested class #​32472
• Spring MVC re-creates form data from request params and re-encoding can change the content-length #​32471
• Unhandled JMS exceptions are not always recorded as observation errors #​32458
• Consistently apply TaskDecorator to ManagedExecutorService as well #​32455

📔 Documentation

• SimpleAsyncTaskScheduler: Returned ScheduledFuture does not track provided task execution #​32589
• Remove link to unrelated method in javadoc of AnnotatedBeanDefinitionReader #​32560
• Fix typos and improve wording in reference documentation #​32557
• Document that active profiles are set at build time with AOT #​32543
• Fix broken link to vavr in the reference guide #​32494
• Document AOT limitations related to Kotlin identifiers with backticks #​32487
• Add Javadoc since to AbstractClientHttpRequestFactoryWrapper.getDelegate() #​32474
• Default strategy for ProblemDetail error codes wrongly document how "detail" is supported #​32446

🔨 Dependency Upgrades

• Upgrade to Micrometer 1.12.5 #​32596
• Upgrade to Reactor 2023.0.5 #​32592

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​Banuelorigni, @​LinorDolev, @​T45K, @​izeye, @​kilink, @​quaff, and @​qww1552

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.

[github-actions]

Overall Project	99.48%	🍏

There is no coverage information present for the Files changed

[github-actions]

Your Pull Request code is being promoted! Please follow the link below.
Main Merge Workflow