From 203ecf5cfb33eb368632d2f8284b93f51399764e Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 29 Sep 2026 15:34:52 +0000 Subject: [PATCH] chore(deps): bump the backend-dependencies group across 1 directory with 6 updates Bumps the backend-dependencies group with 6 updates in the /backend directory: | Package | From | To | | --- | --- | --- | | [org.springdoc:springdoc-openapi-starter-webmvc-ui](https://github.com/springdoc/springdoc-openapi) | `2.9.0` | `2.9.1` | | [com.github.ben-manes.caffeine:caffeine](https://github.com/ben-manes/caffeine) | `3.2.4` | `3.3.0` | | [com.fasterxml.jackson.core:jackson-databind](https://github.com/FasterXML/jackson-databind) | `2.22.2` | `2.22.3` | | [com.google.protobuf:protobuf-java](https://github.com/protocolbuffers/protobuf) | `4.36.1` | `4.36.2` | | com.google.protobuf:protobuf-java-util | `4.36.1` | `4.36.2` | | com.google.protobuf:protobuf-java-util | `4.36.1` | `4.36.2` | | [com.google.protobuf:protoc](https://github.com/protocolbuffers/protobuf) | `4.36.1` | `4.36.2` | Updates `org.springdoc:springdoc-openapi-starter-webmvc-ui` from 2.9.0 to 2.9.1 - [Release notes](https://github.com/springdoc/springdoc-openapi/releases) - [Changelog](https://github.com/springdoc/springdoc-openapi/blob/v2.9.1/CHANGELOG.md) - [Commits](https://github.com/springdoc/springdoc-openapi/compare/v2.9.0...v2.9.1) Updates `com.github.ben-manes.caffeine:caffeine` from 3.2.4 to 3.3.0 - [Release notes](https://github.com/ben-manes/caffeine/releases) - [Commits](https://github.com/ben-manes/caffeine/compare/v3.2.4...v3.3.0) Updates `com.fasterxml.jackson.core:jackson-databind` from 2.22.2 to 2.22.3 - [Commits](https://github.com/FasterXML/jackson-databind/compare/jackson-databind-2.22.2...jackson-databind-2.22.3) Updates `com.google.protobuf:protobuf-java` from 4.36.1 to 4.36.2 - [Release notes](https://github.com/protocolbuffers/protobuf/releases) - [Commits](https://github.com/protocolbuffers/protobuf/commits) Updates `com.google.protobuf:protobuf-java-util` from 4.36.1 to 4.36.2 Updates `com.google.protobuf:protobuf-java-util` from 4.36.1 to 4.36.2 Updates `com.google.protobuf:protoc` from 4.36.1 to 4.36.2 - [Release notes](https://github.com/protocolbuffers/protobuf/releases) - [Commits](https://github.com/protocolbuffers/protobuf/commits) --- updated-dependencies: - dependency-name: org.springdoc:springdoc-openapi-starter-webmvc-ui dependency-version: 2.9.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: backend-dependencies - dependency-name: com.github.ben-manes.caffeine:caffeine dependency-version: 3.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: backend-dependencies - dependency-name: com.fasterxml.jackson.core:jackson-databind dependency-version: 2.22.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: backend-dependencies - dependency-name: com.google.protobuf:protobuf-java dependency-version: 4.36.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: backend-dependencies - dependency-name: com.google.protobuf:protobuf-java-util dependency-version: 4.36.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: backend-dependencies - dependency-name: com.google.protobuf:protobuf-java-util dependency-version: 4.36.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: backend-dependencies - dependency-name: com.google.protobuf:protoc dependency-version: 4.36.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: backend-dependencies ... Signed-off-by: dependabot[bot] --- backend/build.gradle | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/backend/build.gradle b/backend/build.gradle index d7e960e7..67bf9f52 100644 --- a/backend/build.gradle +++ b/backend/build.gradle @@ -45,12 +45,12 @@ dependencies { implementation 'org.flywaydb:flyway-mysql' implementation 'io.github.cdimascio:dotenv-java:3.2.0' implementation 'org.modelmapper:modelmapper:3.2.6' - implementation 'org.springdoc:springdoc-openapi-starter-webmvc-ui:2.9.0' + implementation 'org.springdoc:springdoc-openapi-starter-webmvc-ui:2.9.1' // springdoc(swagger-core-jakarta)이 끌어오는 commons-lang3 3.17.0이 GHSA-j288-q9x7-2f5v // (3.0~3.17.x 취약, 긴 입력 처리 시 무한 재귀)에 걸려 있어 명시적으로 상향. implementation 'org.apache.commons:commons-lang3:3.20.0' implementation 'org.springframework.boot:spring-boot-starter-cache' - implementation 'com.github.ben-manes.caffeine:caffeine:3.2.4' + implementation 'com.github.ben-manes.caffeine:caffeine:3.3.0' implementation 'org.springframework.boot:spring-boot-starter-actuator' // Micrometer 지표를 Prometheus 가 긁어갈 텍스트 형식으로 내보낸다 (/actuator/prometheus). // runtimeOnly 인 이유: 코드가 이 라이브러리를 import 하지 않는다. SessionMetrics 는 @@ -68,7 +68,7 @@ dependencies { // Boot 3.5.16이 관리하는 jackson-databind(2.21.4)가 GHSA-5jmj-h7xm-6q6v(2.19.0~2.21.4 // 취약)에 걸려 있어 이 모듈만 명시적으로 상향(jackson-bom의 나머지 모듈은 그대로 둠). - implementation 'com.fasterxml.jackson.core:jackson-databind:2.22.2' + implementation 'com.fasterxml.jackson.core:jackson-databind:2.22.3' // spring-boot-starter-logging이 끌어오는 log4j-to-slf4j가 log4j-api(2.24.3)를 물고 오는데, // 이게 GHSA(2.13.1~2.25.4 취약, MapMessage.asJson()의 비정상 부동소수점 JSON 직렬화 결함)에 @@ -91,7 +91,7 @@ dependencies { // --- gRPC & Protobuf (버전 정합성 해결) --- def grpcVersion = '1.84.0' - def protobufVersion = '4.36.1' + def protobufVersion = '4.36.2' // Starter는 API만 제공하고 실제 구현체는 아래에서 버전 고정 implementation 'net.devh:grpc-client-spring-boot-starter:3.1.0.RELEASE' @@ -128,7 +128,7 @@ dependencies { protobuf { protoc { - artifact = "com.google.protobuf:protoc:4.36.1" + artifact = "com.google.protobuf:protoc:4.36.2" } plugins { grpc {