[Snyk] Fix for 5 vulnerabilities

[pavelbe4solutions]

Snyk has created this PR to fix 5 vulnerabilities in the maven dependencies of this project.

Snyk changed the following file(s):

• pom.xml

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score	Upgrade
	Path Traversal SNYK-JAVA-ORGSPRINGFRAMEWORK-8230373	585	org.springframework:spring-webmvc: 5.3.31 -> 6.1.14 Major version upgrade No Path Found No Known Exploit
	Improper Handling of Case Sensitivity SNYK-JAVA-ORGSPRINGFRAMEWORK-8230364	265	org.springframework:spring-context: 5.3.31 -> 6.1.14 org.springframework:spring-webmvc: 5.3.31 -> 6.1.14 Major version upgrade No Path Found No Known Exploit
	Improper Handling of Case Sensitivity SNYK-JAVA-ORGSPRINGFRAMEWORK-8230365	265	org.springframework:spring-context: 5.3.31 -> 6.1.14 org.springframework:spring-jdbc: 5.3.31 -> 6.1.14 org.springframework:spring-tx: 5.3.31 -> 6.1.14 org.springframework:spring-web: 5.3.31 -> 6.1.14 org.springframework:spring-webmvc: 5.3.31 -> 6.1.14 Major version upgrade No Path Found No Known Exploit
	Improper Handling of Case Sensitivity SNYK-JAVA-ORGSPRINGFRAMEWORK-8230366	265	org.springframework:spring-web: 5.3.31 -> 6.1.14 org.springframework:spring-webmvc: 5.3.31 -> 6.1.14 Major version upgrade No Path Found No Known Exploit
	Improper Handling of Case Sensitivity SNYK-JAVA-ORGSPRINGFRAMEWORK-8230368	265	org.springframework:spring-webmvc: 5.3.31 -> 6.1.14 Major version upgrade No Path Found No Known Exploit

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Path Traversal

[dryrunsecurity]

DryRun Security Summary

This pull request focuses on improving the security and deployment configuration of the OWASP Benchmark application, including upgrading the Spring framework, adding deployment profiles for integrating application security tools, configuring security-focused static code analysis, and enforcing code formatting and style rules.

Expand for full summary

Summary:

The changes in this pull request appear to be focused on improving the security and deployment
configuration of the OWASP Benchmark application. The key changes include:

1. Upgrading the Spring framework version from 5.3.31 to 6.1.14, which is a major version
   change that may require code updates to address the migration from Java EE to Jakarta EE.
2. Adding several deployment profiles (e.g., deploy, deploywcontrast, deploywseeker,
   deploywcxiast) that integrate various application security tools like Contrast, Seeker,
   and CxIAST during the deployment process.
3. Introducing a findsecbugs profile that configures the SpotBugs Maven plugin to use the
   FindSecBugs plugin for additional security-focused static code analysis.
4. Adding the spotless-maven-plugin to enforce code formatting and style rules, including
   the use of the Google Java Format.

These changes demonstrate a proactive approach to improving the security of the OWASP
Benchmark application by incorporating security-focused static code analysis, integrating
application security tools during deployment, and ensuring code quality and formatting
standards.

Files Changed:

• pom.xml: This file has been updated to include the following changes:
  • Upgrade the Spring framework version from 5.3.31 to 6.1.14.
  • Add deployment profiles for integrating various application security tools like
    Contrast, Seeker, and CxIAST.
  • Add a findsecbugs profile to configure the SpotBugs Maven plugin with the
    FindSecBugs plugin for security-focused static code analysis.
  • Add the spotless-maven-plugin to enforce code formatting and style rules.

Code Analysis

We ran 9 analyzers against 1 file and 1 analyzer had findings. 8 analyzers had no findings.

Analyzer	Findings
Sensitive Files Analyzer	1 finding

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.