Remediate high-severity CVEs: Spring Boot 3.5.12 + Log4j 2.25.3

[Copilot]

Security scan flagged two vulnerabilities in Java dependencies, one of which (CVE-2026-22731, CVSS 8.1) was breaking the CI security gate.

Changes

• CVE-2026-22731 (CVSS 8.1) — Spring Boot auth bypass under Actuator Health group paths; bump spring.boot.version 3.5.5 → 3.5.12
• CVE-2025-68161 — Log4j TLS hostname verification failure in Socket Appender; Spring Boot 3.5.12 still pins log4j2 at 2.24.3, so an explicit override is required:

<properties>
    <spring.boot.version>3.5.12</spring.boot.version>
    <log4j2.version>2.25.3</log4j2.version>
</properties>

<dependencyManagement>
    <!-- Declared before Spring Boot BOM import so explicit versions win -->
    <dependency>
        <groupId>org.apache.logging.log4j</groupId>
        <artifactId>log4j-api</artifactId>
        <version>${log4j2.version}</version>
    </dependency>
    <!-- log4j-core, log4j-to-slf4j same pattern -->
    ...
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-dependencies</artifactId>
        <version>${spring.boot.version}</version>
        <type>pom</type>
        <scope>import</scope>
    </dependency>
</dependencyManagement>

All changes are in the root pom.xml; no production logic touched.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• archive.apache.org
  • Triggering command: /usr/bin/curl curl -sSL REDACTED -o /tmp/maven4.tar.gz (dns block)
• dlcdn.apache.org
  • Triggering command: /usr/bin/wget wget --quiet REDACTED -O /tmp/tmp.XUnsDUv8Cq/apache-maven-4.0.0-rc-5-bin.zip (dns block)
• downloads.apache.org
  • Triggering command: /usr/bin/wget wget -q REDACTED -O maven4.tar.gz (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)