Update dependency org.springframework.data:spring-data-mongodb to v4 - #140
Open
mend-for-github-com[bot] wants to merge 1 commit into
Open
Mend for GitHub.com / Mend Security Check
failed
Aug 14, 2026 in 21m 6s
Security Report
You have successfully remediated 26 vulnerabilities, but introduced 2 new vulnerabilities in this branch.
❌ New vulnerabilities:
| Vulnerability | Severity | Vulnerable Library | Direct Library | Suggested Fix | Issue | |
|---|---|---|---|---|---|---|
CVE-2026-41717Path to dependency file: /pom.xml Path to vulnerable library: /pom.xml Dependency Hierarchy: -> ❌ spring-data-mongodb-4.0.0.jar (Vulnerable Library) |
8.1 | Direct spring-data-mongodb-4.0.0.jar |
spring-data-mongodb-4.0.0.jar | org.springframework.data:spring-data-mongodb:4.3.17,org.springframework.data:spring-data-mongodb:4.4.15,org.springframework.data:spring-data-mongodb:5.0.6,org.springframework.data:spring-data-mongodb:4.5.12,org.springframework.data:spring-data-mongodb:3.4.20,https://github.com/spring-projects/spring-data-mongodb.git - 5.0.6 | None | |
CVE-2026-41696Path to dependency file: /pom.xml Path to vulnerable library: /pom.xml Dependency Hierarchy: -> ❌ spring-data-mongodb-4.0.0.jar (Vulnerable Library) |
5.9 | Direct spring-data-mongodb-4.0.0.jar |
spring-data-mongodb-4.0.0.jar | org.springframework.data:spring-data-mongodb:3.4.20,org.springframework.data:spring-data-mongodb:4.4.15,org.springframework.data:spring-data-mongodb:4.5.12,org.springframework.data:spring-data-mongodb:4.3.17,org.springframework.data:spring-data-mongodb:5.0.6,https://github.com/spring-projects/spring-data-mongodb.git - 5.0.6 | None |
✔️ Remediated vulnerabilities:
| Vulnerability | Vulnerable Library |
|---|---|
| CVE-2022-40152 | woodstox-core-5.0.3.jar |
| CVE-2026-41717 | spring-data-mongodb-2.1.1.RELEASE.jar |
| CVE-2022-22980 | spring-data-mongodb-2.1.1.RELEASE.jar |
| CVE-2026-41716 | spring-data-commons-2.1.1.RELEASE.jar |
| CVE-2023-20863 | spring-expression-5.1.1.RELEASE.jar |
| CVE-2026-41851 | spring-expression-5.1.1.RELEASE.jar |
| WS-2018-0629 | woodstox-core-5.0.3.jar |
| CVE-2025-48924 | commons-lang3-3.4.jar |
| CVE-2025-41242 | spring-beans-5.0.7.RELEASE.jar |
| CVE-2023-34623 | jtidy-r938.jar |
| CVE-2026-41696 | spring-data-mongodb-2.1.1.RELEASE.jar |
| CVE-2020-15250 | junit-4.10.jar |
| CVE-2026-41721 | spring-data-commons-2.1.1.RELEASE.jar |
| CVE-2026-41711 | spring-data-commons-2.1.1.RELEASE.jar |
| CVE-2023-44483 | xmlsec-2.1.4.jar |
| CVE-2023-20861 | spring-expression-5.1.1.RELEASE.jar |
| CVE-2022-22965 | spring-beans-5.0.7.RELEASE.jar |
| CVE-2021-40690 | xmlsec-2.1.4.jar |
| CVE-2026-41852 | spring-expression-5.1.1.RELEASE.jar |
| CVE-2024-38808 | spring-expression-5.1.1.RELEASE.jar |
| CVE-2023-5072 | json-20180130.jar |
| CVE-2022-45688 | json-20180130.jar |
| CVE-2026-41850 | spring-expression-5.1.1.RELEASE.jar |
| CVE-2022-22950 | spring-expression-5.1.1.RELEASE.jar |
| CVE-2022-22970 | spring-beans-5.0.7.RELEASE.jar |
| CVE-2026-41849 | spring-expression-5.1.1.RELEASE.jar |
Base branch total remaining vulnerabilities: 63
Base branch commit: null
Total libraries scanned: 35
Scan token: 45c8f17faa29499f8a6da6b09d754cc6
Loading