Merge pull request #229 from kinde-oss/fix/security-cve-logback-and-deps

fix(security): patch Thymeleaf SSTI, Actuator auth bypass, and logback CVE-2026-1225

Author: Koosha-Owji

playground/kinde-springboot-starter-example/pom.xml

@@ -32,7 +32,7 @@
     <dependency>
       <groupId>org.springframework.boot</groupId>
       <artifactId>spring-boot-starter-actuator</artifactId>
-      <version>3.5.6</version>
+      <version>3.5.12</version>
     </dependency>
     <dependency>
       <groupId>org.springframework.boot</groupId>
@@ -47,12 +47,12 @@
     <dependency>
       <groupId>org.thymeleaf</groupId>
       <artifactId>thymeleaf</artifactId>
-      <version>3.1.3.RELEASE</version>
+      <version>3.1.4.RELEASE</version>
     </dependency>
     <dependency>
       <groupId>org.thymeleaf</groupId>
       <artifactId>thymeleaf-spring6</artifactId>
-      <version>3.1.3.RELEASE</version>
+      <version>3.1.4.RELEASE</version>
     </dependency>
     <dependency>
       <groupId>org.springframework.boot</groupId>
@@ -73,7 +73,7 @@
       <groupId>ch.qos.logback</groupId>
       <artifactId>logback-classic</artifactId>
       <scope>runtime</scope>
-      <version>1.5.19</version>
+      <version>1.5.32</version>
     </dependency>
 
     <dependency>

playground/kinde-springboot-thymeleaf-full-example/pom.xml

@@ -28,7 +28,7 @@
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-actuator</artifactId>
-            <version>3.5.5</version>
+            <version>3.5.12</version>
         </dependency>
 
         <dependency>
@@ -61,6 +61,16 @@
             <artifactId>spring-boot-starter-thymeleaf</artifactId>
             <version>3.5.5</version>
         </dependency>
+        <dependency>
+            <groupId>org.thymeleaf</groupId>
+            <artifactId>thymeleaf</artifactId>
+            <version>3.1.4.RELEASE</version>
+        </dependency>
+        <dependency>
+            <groupId>org.thymeleaf</groupId>
+            <artifactId>thymeleaf-spring6</artifactId>
+            <version>3.1.4.RELEASE</version>
+        </dependency>
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-devtools</artifactId>