Repository navigation
LedgerMesh 6.0.1 is a dependency refresh past published advisories and contains no other commits since 6.0.0. The Spring Boot parent moves from 3.5.3 to 3.5.16 for GHSA-wwpq-f5c3-7hvx (fixed in 3.5.14), under which a local user on the same host could take control of the directory ApplicationTemp uses; the session and code execution paths the advisory describes need server.servlet.session.persistent, which none of the three services sets. The parent also moves the versions it manages, among them Spring Framework 6.2.8 to 6.2.19, Spring Data 2025.0.1 to 2025.0.13, Hibernate ORM 6.6.18 to 6.6.53, Spring for Apache Kafka 3.3.7 to 3.3.16 and Jackson 2.19.1 to 2.21.4.
In the browser demo's build tools, vite moves from 7.3.6 to 7.3.7 for GHSA-587h-7wmj-h5pm and GHSA-698v-4r3x-3vcv (Windows only) and GHSA-r825-w8mm-5pxw (WSL only) in the launch-editor copy it bundles, and for GHSA-9jrq-w75r-8gcw and GHSA-rq7h-c2jc-7f22; all five concern the development server, not the static site vite build writes. source-map-js moves from 1.2.1 to 1.2.2 for GHSA-68fv-2mgg-jv7q; only postcss loads it, during the build. An OSV scan of the pinned packages goes from three vulnerable packages to none. The services' code, schemas, events and tests are unchanged.
Because the parent sets the Spring Data and Hibernate versions that decide whether a save inserts or merges, the release PR ran ExactlyOnceIT 50 times on fresh stacks in repeat run 40181700070 with no failed run, next to all seven jobs of PR CI 40181699990. The merge commit passed all seven jobs in main CI 40182392808: 172 tests (144 unit/H2, ten PostgreSQL authorization ownership and 18 end-to-end) with no failures, errors or skips, the three service images, the web build and self-checks, and a fresh chaos run (seed 22145) in which 1,200 orders were submitted, 1,170 confirmed and 30 cancelled for stock, none failed or stuck and no money or stock rule was broken.