[Snyk] Fix for 2 vulnerabilities

[macroscope-cloud]

Snyk has created this PR to fix 2 vulnerabilities in the maven dependencies of this project.

Snyk changed the following file(s):

• examples/iOS-Hybrid-App-Java-Server/pom.xml

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score	Upgrade
	Allocation of Resources Without Limits or Throttling SNYK-JAVA-TOOLSJACKSONCORE-18170128	828	org.springframework.boot:spring-boot-starter-json: 4.0.0 -> 4.0.7 Proof of Concept
	Deserialization of Untrusted Data SNYK-JAVA-ORGSPRINGFRAMEWORK-18326609	746	org.springframework:spring-web: 6.2.17 -> 6.2.19 No Known Exploit

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Deserialization of Untrusted Data
🦉 Allocation of Resources Without Limits or Throttling

[macroscope-cloud]

This update includes two patch-level upgrades. The upgrade for spring-web carries a medium risk due to extensive security fixes that may introduce behavioral changes, while the spring-boot-starter-json upgrade is low risk.

org.springframework:spring-web@6.2.17 → 6.2.19 (Medium Risk)

This is a security-focused release that addresses numerous CVEs in the web layer (Spring MVC and WebFlux). [13] Key changes include:

• Behavioral Changes for Security: Fixes for vulnerabilities such as Path Traversal, Open Redirect, Cross-Site Scripting (XSS), and multipart request handling may tighten validation and change how edge-case requests are processed. [7, 13]
• New Default Limits: To mitigate Denial of Service (DoS) risks, a default limit on the number of operations in Spring Expression Language (SpEL) expressions has been introduced as of version 6.2.19. [12] Applications with unusually complex SpEL expressions may be affected.
• Deserialization Controls: New methods have been added to JacksonJmsMessageConverter to restrict trusted packages for deserialization, addressing CVE-2026-41855. [12, 13]

Recommendation: After upgrading, verify application functionality related to file serving, URL redirects, complex SpEL expressions, and JMS message conversion to ensure these security enhancements do not cause regressions.

org.springframework.boot:spring-boot-starter-json@4.0.0 → 4.0.7 (Low Risk)

This is a routine patch release for Spring Boot. It bundles bug fixes, documentation improvements, and dependency upgrades, including patches for two CVEs (CVE-2026-40992, CVE-2026-41001). [8] No breaking API changes are documented for this range.

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.