stainless-app[bot] c904c2d278 release: 0.1.0-beta.6 (#154) ...

* fix: patch security alerts — OTel, Tomcat, Jetty, Logback, Spring, SnakeYAML (#153)

Resolves open Dependabot security alerts across critical+high severity tiers.

Key change: opentelemetry-api/sdk/exporter-otlp 1.32.0 → 1.62.0 (CVE-2026-45292,
published dep). Semconv 1.23.1-alpha → 1.41.1 (stable GA); migrates
ResourceAttributes.SERVICE_* → ServiceAttributes.SERVICE_* (class removed in 1.30+).

Other fixes (test/example scope, non-published):
- Jetty 9.4.57 → 9.4.58.v20250814 (CVE-2025-5115 in http2-common)
- Logback 1.2.13 → 1.5.32 (CVE-2025-11226, CVE-2024-12798, CVE-2024-12801, CVE-2026-1225;
  the 1.2.13 pin was overly conservative — CVE-2023-6481/6378 are fixed since 1.3.12)
- Tomcat 9.0.115 → 9.0.118 in example module (14 alerts, 4 critical)
- Spring 5.3.34 → 5.3.39 + spring-expression constraint (CVE-2024-38809, CVE-2024-38808)
- SnakeYAML 1.31 → 1.32 (CVE-2022-38752, CVE-2022-41854)

Adds SECURITY_FIX_PLAN.md tracking open/stale/no-fix-available alert status.

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

* release: 0.1.0-beta.6

---------

Co-authored-by: John Kennedy <65985482+jkennedyvz@users.noreply.github.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: stainless-app[bot] <142633134+stainless-app[bot]@users.noreply.github.com>

2026-05-20 11:19:28 -07:00

..

src

release: 0.1.0-beta.6 (#154)

2026-05-20 11:19:28 -07:00

build.gradle.kts

release: 0.1.0-beta.6 (#154)

2026-05-20 11:19:28 -07:00