Upgrade Spring Security to a version patched for CVE-2026-22732

Proprietary

Bumps Spring Security to the fix released on the project's own minor series: 6.5.9 or 7.0.4. Each bump is gated on the series it applies to, so a project on 6.5 is never dragged to 7.0. Only the 6.5 and 7.0 fixes are published to Maven Central — the 5.7.22, 5.8.24, 6.3.15 and 6.4.15 fixes ship to Spring Enterprise subscribers only, and the 6.0 - 6.2 series never received one, so this recipe cannot help those projects. Use org.openrewrite.java.security.spring.cve202622732.AddEagerHeaderWriterConfiguration for them.

org.openrewrite.java.security.spring.cve202622732.UpgradeSpringSecurityToPatchedVersion

mod run . --recipe=org.openrewrite.java.security.spring.cve202622732.UpgradeSpringSecurityToPatchedVersion

Install it once from Recipe actions, then run it on every repository under the current directory. New to the Moderne CLI? Set it up.