From 1a2f84f7099dd58c0eabca9ebe666f5d348761f3 Mon Sep 17 00:00:00 2001
From: subrata71 <subrata@appsmith.com>
Date: Sat, 28 Mar 2026 10:14:08 +0600
Subject: [PATCH 1/2] fix(security): mitigate CVE-2026-22732 by upgrading
 Spring Boot to 3.5.12

Upgrade Spring Boot from 3.5.11 to 3.5.12, which bundles Spring Security
6.5.9 (patched) and Spring Framework 6.2.17. Pin Lombok to 1.18.42 to
avoid a breaking change in 1.18.44 that makes @FieldNameConstants inner
class constructors private.
---
 app/server/pom.xml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/app/server/pom.xml b/app/server/pom.xml
index 633116ac93d1..2f37c8127972 100644
--- a/app/server/pom.xml
+++ b/app/server/pom.xml
@@ -7,7 +7,7 @@
     <parent>
         <groupId>org.springframework.boot</groupId>
         <artifactId>spring-boot-starter-parent</artifactId>
-        <version>3.5.11</version>
+        <version>3.5.12</version>
         <relativePath/>
         <!-- lookup parent from repository -->
     </parent>
@@ -30,6 +30,8 @@
         <jackson-bom.version>2.17.0</jackson-bom.version>
         <jackson.version>2.17.0</jackson.version>
         <java.version>25</java.version>
+        <!-- Pin Lombok to 1.18.42 to avoid breaking @FieldNameConstants inner class constructor change in 1.18.44 -->
+        <lombok.version>1.18.42</lombok.version>
         <javadoc.disabled>true</javadoc.disabled>
         <maven.compiler.source>${java.version}</maven.compiler.source>
         <maven.compiler.target>${java.version}</maven.compiler.target>

From e2bec36597795a5b783a2bec0e685d56a22c68a3 Mon Sep 17 00:00:00 2001
From: subrata71 <subrata@appsmith.com>
Date: Sat, 28 Mar 2026 10:22:18 +0600
Subject: [PATCH 2/2] Apply spotless

---
 app/server/pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/server/pom.xml b/app/server/pom.xml
index 2f37c8127972..d79df182814e 100644
--- a/app/server/pom.xml
+++ b/app/server/pom.xml
@@ -30,9 +30,9 @@
         <jackson-bom.version>2.17.0</jackson-bom.version>
         <jackson.version>2.17.0</jackson.version>
         <java.version>25</java.version>
+        <javadoc.disabled>true</javadoc.disabled>
         <!-- Pin Lombok to 1.18.42 to avoid breaking @FieldNameConstants inner class constructor change in 1.18.44 -->
         <lombok.version>1.18.42</lombok.version>
-        <javadoc.disabled>true</javadoc.disabled>
         <maven.compiler.source>${java.version}</maven.compiler.source>
         <maven.compiler.target>${java.version}</maven.compiler.target>
         <mockito.version>4.4.0</mockito.version>