[WIP] Upgrade spring-webmvc to resolve dependabot alerts

[Copilot]

Spring WebMVC Dependency Upgrade

This PR upgrades Spring Framework and addresses security vulnerabilities to close dependabot alerts.

Checklist

• Phase 1: Analysis & Planning

  • Review existing dependency structure in pom.xml files
  • Analyze Spring 5.3.26 dependencies and compatibility
  • Review custom Spring compatibility layers (CancellableFormController, MultiActionController, etc.)
  • Analyze JSP taglib usage and compatibility
  • Review web.xml and Spring XML configuration files
  • Document findings and create upgrade plan

• Phase 2: Dependency Management Optimization

  • Centralize Spring version management with Maven properties
  • Upgrade Spring 5.3.26 → 5.3.39 (latest 5.x LTS)
  • Remove hardcoded versions, use ${spring.version} property
  • Synchronize versions across all modules (treebase-core, treebase-web, oai-pmh_data_provider)

• Phase 3: Spring Framework Upgrade

  • Upgrade Spring Framework to 5.3.39 (latest 5.x LTS)
  • Spring Security 5.8.15 (already compatible)
  • Verify custom Spring compatibility layers still work

• Phase 4: Security Dependency Upgrades

  • Upgrade commons-fileupload 1.3.3 → 1.6.0 (CVE-2023-24998, CVE-2024-25710)
  • Upgrade commons-io 2.7 → 2.15.1
  • Upgrade xalan 2.7.0 → 2.7.3 (CVE-2022-34169)
  • Add exclusion for old xalan 2.6.0 from jaxen/xom transitive

• Phase 5: Validation & Testing

  • Build all modules successfully
  • Verify dependency tree shows correct versions

• Phase 6: Code Review & Final Checks

  • Run code review
  • Run CodeQL security check
  • Document known Spring 5.x vulnerabilities that cannot be fixed

Security Summary

Vulnerabilities Fixed:

CVE	Component	Status
CVE-2023-24998	commons-fileupload	✅ FIXED (→ 1.6.0)
CVE-2024-25710	commons-fileupload	✅ FIXED (→ 1.6.0)
CVE-2022-34169	xalan	✅ FIXED (→ 2.7.3)

Known Unfixable Vulnerabilities (requires Spring 6.x migration):

CVE	Component	Patch Version
CVE-2024-38816	spring-webmvc	Spring 6.1.14+
CVE-2024-38819	spring-webmvc	Spring 6.1.14+
CVE-2025-22228	spring-core	Spring 6.2.11+

Why these cannot be fixed:

• Spring 5.x reached end-of-life December 2024
• No security patches will be released for Spring 5.x
• Patches require Spring 6.x which needs Jakarta EE namespace migration (javax.* → jakarta.*)

Risk Mitigation:

• Path Traversal CVEs primarily affect functional web endpoints (RouterFunction) - TreeBASE uses traditional annotation-based controllers with lower exposure
• Annotation Detection CVE affects Spring Security annotation processing - TreeBASE uses XML-based security configuration with lower exposure

Recommended Next Step: Plan Spring 6.2.11+ migration (60-80 hours estimated)

Original prompt

We need to upgrade spring-webmvc so that 8 dependabot alerts can be closed and hopefully some structural issues in the dependency management can be resolved. However, this may require changes in the Java and JSP code, the dependency management (pom.xml), and the web application configuration management XML. Make a plan to do the upgrade:

• thoroughly analyse the code bases of treebase-core and treebase-web to see what the impact might be and what API changes might be needed
• also consider the dependency management from an integral perspective: can things be streamlined and simplified?
• also consider the configuration of the web application (tomcat and spring XML files) and its deployment (Docker stack)
• also consider the state of the JSPs and whether they need changes
• also consider related dependencies: if a more elegant dependency graph can be achieved by doing additional upgrades, look at this as a viable and desirable option

We embark on this in the hopes of addressing multiple issues:

• very old dependencies and a complex dependency management system with various exclusions that may be avoided given an integral approach
• problems with launching the web application with apparent race conditions between class loading of multiple dependencies
• security alerts whose number and/or severity we want to bring down

In general: think outside the box and consider multiple pathways. Take a holistic view of the system and identify opportunities for additional upgrades that will make the system more coherent and streamlined. Keep in mind that the current system has problems in launching the web application (class loading race conditions) that we want to address but have had difficulties resolving.

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.