[Snyk] Security upgrade org.springframework.webflow:spring-webflow from 2.5.0.RELEASE to 4.0.0

[bogarin]

Snyk has created this PR to fix 5 vulnerabilities in the maven dependencies of this project.

Snyk changed the following file(s):

• spring-web-modules/spring-mvc-webflow/pom.xml

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score	Upgrade
	Path Traversal SNYK-JAVA-ORGSPRINGFRAMEWORK-7945490	756	org.springframework.webflow:spring-webflow: 2.5.0.RELEASE -> 4.0.0 Major version upgrade Proof of Concept
	Path Traversal SNYK-JAVA-ORGSPRINGFRAMEWORK-8230373	756	org.springframework.webflow:spring-webflow: 2.5.0.RELEASE -> 4.0.0 Major version upgrade Proof of Concept
	Improper Handling of Case Sensitivity SNYK-JAVA-ORGSPRINGFRAMEWORK-8230364	329	org.springframework.webflow:spring-webflow: 2.5.0.RELEASE -> 4.0.0 Major version upgrade No Known Exploit
	Improper Handling of Case Sensitivity SNYK-JAVA-ORGSPRINGFRAMEWORK-8230366	329	org.springframework.webflow:spring-webflow: 2.5.0.RELEASE -> 4.0.0 Major version upgrade No Known Exploit
	Improper Handling of Case Sensitivity SNYK-JAVA-ORGSPRINGFRAMEWORK-8230368	329	org.springframework.webflow:spring-webflow: 2.5.0.RELEASE -> 4.0.0 Major version upgrade No Known Exploit

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Path Traversal

[Copilot]

Pull request overview

This PR upgrades org.springframework.webflow:spring-webflow from version 2.5.0.RELEASE to 4.0.0 to address 5 security vulnerabilities (2 high-severity path traversal issues and 3 low-severity case sensitivity issues). However, this upgrade introduces a critical compatibility issue that will prevent the application from functioning.

Key Issue:

• Spring WebFlow 4.0.0 requires Spring Framework 6.x as a minimum dependency, but the project currently uses Spring Framework 5.0.1.RELEASE

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The Spring WebFlow upgrade to 4.0.0 is incompatible with the current Spring Framework version (5.0.1.RELEASE). Spring WebFlow 4.0.0 requires Spring Framework 6.x as a minimum dependency.

To fix this issue, you need to also upgrade the Spring Framework version. For example:

<org.springframework.version>6.0.0</org.springframework.version>

Note that upgrading to Spring Framework 6.x is also a major version upgrade that may require:

• Java 17 as minimum version
• Migration from javax.* to jakarta.* namespace
• Updates to other dependencies that depend on Spring Framework
• Potential code changes to handle API changes

Consider whether a full Spring Framework 6.x upgrade is feasible for this project, or if a smaller Spring WebFlow version upgrade (e.g., to 2.5.1.RELEASE if available) would address the security vulnerabilities without requiring a major framework upgrade.

Suggested change

	<org.springframework.version>5.0.1.RELEASE</org.springframework.version>
	<org.springframework.version>6.0.0</org.springframework.version>