Upgrade to Spring Boot 3.5.15 to fix Netty and Spring CVEs

3.5.15 ships Netty 4.1.135.Final (fixes CVE-2026-42582 and 18 additional Netty CVEs)
and Spring Framework 6.2.19 (fixes CVE-2026-41840 through CVE-2026-41851). Also ships
Tomcat 10.1.55 so the explicit overrides for Netty and Tomcat are no longer needed.

Reverts the CVE suppressions added in the previous commit.

Author: thibauult

allow-list.xml

@@ -39,26 +39,4 @@
         <vulnerabilityName>GHSA-7rx3-28cr-v5wh</vulnerabilityName>
         <vulnerabilityName>GHSA-442j-39wm-28r2</vulnerabilityName>
     </suppress>
-    <suppress>
-        <notes><![CDATA[
-          CVE-2026-42582 affects Netty 4.1.134.Final. No fixed release available yet.
-          Tracked for resolution via a dependency upgrade PR.
-          ]]></notes>
-        <packageUrl regex="true">^pkg:maven/io\.netty/.*@.*$</packageUrl>
-        <cve>CVE-2026-42582</cve>
-    </suppress>
-    <suppress>
-        <notes><![CDATA[
-          CVE-2026-41840 through CVE-2026-41851 affect Spring Framework 6.2.18, pulled in via
-          spring-boot-dependencies:3.5.14. No fixed Spring Boot 3.5.x release available yet.
-          Tracked for resolution via a dependency upgrade PR.
-          ]]></notes>
-        <packageUrl regex="true">^pkg:maven/org\.springframework/.*@.*$</packageUrl>
-        <cve>CVE-2026-41840</cve>
-        <cve>CVE-2026-41841</cve>
-        <cve>CVE-2026-41842</cve>
-        <cve>CVE-2026-41843</cve>
-        <cve>CVE-2026-41850</cve>
-        <cve>CVE-2026-41851</cve>
-    </suppress>
 </suppressions>

symphony-bdk-bom/build.gradle

@@ -16,15 +16,13 @@ repositories {
 
 dependencies {
     // import Spring Boot's BOM
-    api platform('org.springframework.boot:spring-boot-dependencies:3.5.14')
+    api platform('org.springframework.boot:spring-boot-dependencies:3.5.15')
     // import Jackson's BOM
     api platform('com.fasterxml.jackson:jackson-bom:2.18.2')
     // import Jersey's BOM
     api platform('org.glassfish.jersey:jersey-bom:3.1.9')
     // import Log4j's BOM
     api platform('org.apache.logging.log4j:log4j-bom:2.26.0')
-    // override Netty (Spring Boot 3.5.14 ships 4.1.132 which is still vulnerable to CVE-2026-41417)
-    api platform('io.netty:netty-bom:4.1.134.Final')
 
     // define all our dependencies versions
     constraints {
@@ -45,11 +43,6 @@ dependencies {
 
         // External dependencies
 
-        // override Tomcat (Spring Boot 3.5.14 ships 10.1.54 which is vulnerable to multiple CVEs)
-        api 'org.apache.tomcat.embed:tomcat-embed-core:10.1.55'
-        api 'org.apache.tomcat.embed:tomcat-embed-el:10.1.55'
-        api 'org.apache.tomcat.embed:tomcat-embed-websocket:10.1.55'
-
         api 'org.apiguardian:apiguardian-api:1.1.2'
 
         api 'org.slf4j:slf4j-api:2.0.9'