From 7059c8c2935181f7606c9f9c057fd287dae82ef2 Mon Sep 17 00:00:00 2001
From: Alexander Zakharov <alexander.zakharov@entur.org>
Date: Fri, 15 May 2026 10:54:51 +0200
Subject: [PATCH 1/3] chore: ETU-72189 upgrade to the latest version of Spring
 Boot 3.5.x

---
 build.gradle                         | 2 +-
 oidc-client-spring-boot/build.gradle | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/build.gradle b/build.gradle
index dff0582..d8ccdc5 100644
--- a/build.gradle
+++ b/build.gradle
@@ -14,7 +14,7 @@ subprojects {
         mockitoVersion = '5.11.0'
         guavaVersion = '33.5.0-jre'
         lombokVersion = '1.18.36'
-        springBoot3Version = '3.5.7'
+        springBootVersion = '3.5.14'
         caffeineVersion = "3.2.3"
         slf4jVersion = '2.0.17'
         logback14xVersion = '1.5.18'
diff --git a/oidc-client-spring-boot/build.gradle b/oidc-client-spring-boot/build.gradle
index 0009b39..25a72c8 100644
--- a/oidc-client-spring-boot/build.gradle
+++ b/oidc-client-spring-boot/build.gradle
@@ -13,11 +13,11 @@ dependencies {
     api project(":oidc-client")
     api("com.auth0:auth0:${auth0JavaVersion}")
 
-    compileOnly("org.springframework.boot:spring-boot-starter-web:${springBoot3Version}")
+    compileOnly("org.springframework.boot:spring-boot-starter-web:${springBootVersion}")
 
     // Dependencies required to run tests
-    testImplementation("org.springframework.boot:spring-boot-starter-test:${springBoot3Version}")
-    testImplementation("org.springframework.boot:spring-boot-starter-web:${springBoot3Version}")
+    testImplementation("org.springframework.boot:spring-boot-starter-test:${springBootVersion}")
+    testImplementation("org.springframework.boot:spring-boot-starter-web:${springBootVersion}")
 }
 
 spotbugs {

From dd73a8ebf948f5c88a580db4f9f97fc13f32f27c Mon Sep 17 00:00:00 2001
From: Alexander Zakharov <alexander.zakharov@entur.org>
Date: Wed, 20 May 2026 15:45:35 +0200
Subject: [PATCH 2/3] fix: address CVE-2026-41293

---
 oidc-client-spring-boot/build.gradle | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/oidc-client-spring-boot/build.gradle b/oidc-client-spring-boot/build.gradle
index 25a72c8..1854ff1 100644
--- a/oidc-client-spring-boot/build.gradle
+++ b/oidc-client-spring-boot/build.gradle
@@ -18,6 +18,11 @@ dependencies {
     // Dependencies required to run tests
     testImplementation("org.springframework.boot:spring-boot-starter-test:${springBootVersion}")
     testImplementation("org.springframework.boot:spring-boot-starter-web:${springBootVersion}")
+
+    constraints {
+        compileOnly('org.apache.tomcat.embed:tomcat-embed-core:10.1.55') { because 'CVE-2026-41293' }
+        testImplementation('org.apache.tomcat.embed:tomcat-embed-core:10.1.55') { because 'CVE-2026-41293' }
+    }
 }
 
 spotbugs {

From 697dda0bb13f024427c181c02688a280632e271c Mon Sep 17 00:00:00 2001
From: Alexander Zakharov <alexander.zakharov@entur.org>
Date: Wed, 20 May 2026 15:50:01 +0200
Subject: [PATCH 3/3] build: add 'spring-boot-3.5.x' branch to workflows

---
 .github/workflows/codeql.yml | 6 ++++--
 .github/workflows/pr.yaml    | 1 +
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 4713d04..7e232a2 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -5,10 +5,12 @@ name: CodeQL Scan
 on:
   pull_request:
     branches:
-      - "main"
+      - main
+      - spring-boot-3.5.x
   push:
     branches:
-      - "main"
+      - main
+      - spring-boot-3.5.x
   schedule:
     - cron: "0 3 * * MON" # Run Monday at 3AM UTC
 
diff --git a/.github/workflows/pr.yaml b/.github/workflows/pr.yaml
index bc9bc60..ebef234 100644
--- a/.github/workflows/pr.yaml
+++ b/.github/workflows/pr.yaml
@@ -5,6 +5,7 @@ on:
   pull_request:
     branches:
       - main
+      - spring-boot-3.5.x
 
 jobs:
   build: