From f0383289a05caee35805a09d2bfef145ae9a959c Mon Sep 17 00:00:00 2001
From: Viacheslav Klimov <viacheslavklimov11@gmail.com>
Date: Mon, 16 Mar 2026 10:27:58 +0200
Subject: [PATCH 1/3] Add .planning of GSD to gitignore

---
 .gitignore | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.gitignore b/.gitignore
index 6c5003fc02..ee8c78dad3 100644
--- a/.gitignore
+++ b/.gitignore
@@ -38,3 +38,4 @@ rebuild-docker.sh
 .run/**
 .run
 .claude
+.planning

From b2d7857871e786cdc393b851fd833f7229cb11ad Mon Sep 17 00:00:00 2001
From: Viacheslav Klimov <viacheslavklimov11@gmail.com>
Date: Mon, 16 Mar 2026 10:48:53 +0200
Subject: [PATCH 2/3] Bump ZooKeeper from 3.9.3 to 3.9.5 to fix CVE-2026-24308
 and CVE-2026-24281

---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index bc83721914..cbb16484d7 100755
--- a/pom.xml
+++ b/pom.xml
@@ -63,7 +63,7 @@
         <leshan.version>2.0.0-M15</leshan.version>
         <mail.version>2.0.1</mail.version>
         <curator.version>5.6.0</curator.version>
-        <zookeeper.version>3.9.3</zookeeper.version>
+        <zookeeper.version>3.9.5</zookeeper.version> <!-- to fix CVE-2026-24308 and CVE-2026-24281. TODO: remove override when fixed in curator-client -->
         <protobuf.version>3.25.5</protobuf.version> <!-- A Major v4 does not support by the pubsub yet-->
         <grpc.version>1.76.0</grpc.version>
         <tbel.version>1.2.9</tbel.version>

From dbba23a51dc29f8259b375a995e641e1cf1026aa Mon Sep 17 00:00:00 2001
From: Viacheslav Klimov <viacheslavklimov11@gmail.com>
Date: Mon, 16 Mar 2026 10:49:06 +0200
Subject: [PATCH 3/3] Bump assertj-core from 3.26.3 to 3.27.7 to fix
 CVE-2026-24400

---
 pom.xml | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/pom.xml b/pom.xml
index cbb16484d7..a72c91fc32 100755
--- a/pom.xml
+++ b/pom.xml
@@ -121,6 +121,7 @@
         <perfmark-api.version>0.27.0</perfmark-api.version>
         <threetenbp.version>1.7.0</threetenbp.version>
         <!--         TEST SCOPE         -->
+        <assertj.version>3.27.7</assertj.version> <!-- to fix CVE-2026-24400 (XXE). TODO: remove when fixed in spring-boot-dependencies -->
         <dbunit.version>2.7.3</dbunit.version>
         <java-websocket.version>1.5.6</java-websocket.version>
         <mock-server.version>5.15.0</mock-server.version>
@@ -929,6 +930,15 @@
             </dependency>
             <!-- End of Jackson version override -->
 
+            <!-- Temporary assertj-core version override -->
+            <dependency>
+                <groupId>org.assertj</groupId>
+                <artifactId>assertj-core</artifactId>
+                <version>${assertj.version}</version>
+                <scope>test</scope>
+            </dependency>
+            <!-- End of assertj-core version override -->
+
             <dependency>
                 <groupId>org.springframework.boot</groupId>
                 <artifactId>spring-boot-dependencies</artifactId>