Write Spring Security headers eagerly (CVE-2026-22732)
ProprietaryAdds a BeanPostProcessor that sets HeaderWriterFilter.setShouldWriteHeadersEagerly(true), so Spring Security writes X-Frame-Options, X-Content-Type-Options, Cache-Control and the other security headers before the filter chain proceeds instead of lazily on response commit. This closes CVE-2026-22732 for every sink in the project at once, including call sites that set Content-Length in ways the detection recipes cannot see. Only projects that resolve an affected Spring Security version are changed, and projects that already write headers eagerly or vendor a patched OnCommittedResponseWrapper are left alone.
org.Optional
Leave alone any project that could reach a fixed Spring Security version by a version bump, so the cleaner remediation is not duplicated. A project qualifies only if its series has an open-source fix (6.5.9 or 7.0.4) and it declares a Spring Security version of its own for a bump to edit. Projects on a Spring Enterprise-only series (5.7, 5.8, 6.3, 6.4), on a series that never got a fix (6.0 - 6.2), or that inherit their version from an imported BOM are still patched. Defaults to false.
mod run .Install it once from Recipe actions, then run it on every repository under the current directory. New to the Moderne CLI? Set it up.