From ea7ff63c11e19b8ad7313a062807cea824b1c989 Mon Sep 17 00:00:00 2001
From: Viacheslav Klimov <viacheslavklimov11@gmail.com>
Date: Thu, 11 Jun 2026 14:34:37 +0300
Subject: [PATCH 1/4] Bump com.squareup.wire:wire-schema from 3.7.1 to 6.3.0 to
 fix CVE-2026-45799

---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 9fb6c66d0f..a1fc5bff0e 100755
--- a/pom.xml
+++ b/pom.xml
@@ -136,7 +136,7 @@
         <commons-beanutils.version>1.11.0</commons-beanutils.version>
         <commons-collections.version>4.4</commons-collections.version>
         <protobuf-dynamic.version>1.0.4TB</protobuf-dynamic.version>
-        <wire-schema.version>3.7.1</wire-schema.version>
+        <wire-schema.version>6.3.0</wire-schema.version> <!-- to fix CVE-2026-45799 (transitive wire-runtime). TODO: remove pin when upstream bundles >= 6.3.0 -->
         <twilio.version>10.1.3</twilio.version>
         <hypersistence-utils.version>3.7.4</hypersistence-utils.version> <!-- artifact name should be updated with hibernate-core version -->
         <jakarta.el.version>4.0.2</jakarta.el.version>

From 166292f3ef36c6bbdf9a6754e2502e50de15affb Mon Sep 17 00:00:00 2001
From: Viacheslav Klimov <viacheslavklimov11@gmail.com>
Date: Thu, 11 Jun 2026 14:35:48 +0300
Subject: [PATCH 2/4] Bump spring-boot from 3.5.14 to 3.5.15 and drop redundant
 postgresql and tomcat version overrides now provided by the BOM

---
 pom.xml | 26 +-------------------------
 1 file changed, 1 insertion(+), 25 deletions(-)

diff --git a/pom.xml b/pom.xml
index a1fc5bff0e..ab5328ec7e 100755
--- a/pom.xml
+++ b/pom.xml
@@ -62,15 +62,13 @@
         <pkg.implementationTitle>${project.name}</pkg.implementationTitle>
         <pkg.unixLogFolder>/var/log/${pkg.name}</pkg.unixLogFolder>
         <pkg.installFolder>/usr/share/${pkg.name}</pkg.installFolder>
-        <spring-boot.version>3.5.14</spring-boot.version>
+        <spring-boot.version>3.5.15</spring-boot.version>
         <!-- TODO: remove spring-boot-test.version override and the matching dependencyManagement entries below
              once Spring Boot 3.5.15+ is released with a fix for the ImportsContextCustomizer regression in 3.5.14
              that causes "Duplicate spy definition" failures on legacy @SpyBean fields (see PR #15557). -->
         <spring-boot-test.version>3.5.13</spring-boot-test.version>
         <commons-lang3.version>3.18.0</commons-lang3.version> <!-- to fix CVE-2025-48924. TODO: remove when fixed in spring-boot-dependencies -->
-        <postgresql.version>42.7.11</postgresql.version> <!-- to fix CVE-2026-42198. TODO: remove when fixed in spring-boot-dependencies -->
         <netty.version>4.1.134.Final</netty.version> <!-- to fix CVE-2026-42579, CVE-2026-42583, CVE-2026-42584, CVE-2026-42587, and MQTT decoder regression introduced in 4.1.133 by the CVE-2026-44248 fix. TODO: remove when fixed in spring-boot-dependencies -->
-        <tomcat.version>10.1.55</tomcat.version> <!-- to fix CVE-2026-41284, CVE-2026-43512. TODO: remove when fixed in spring-boot-dependencies -->
         <javax.xml.bind-api.version>2.4.0-b180830.0359</javax.xml.bind-api.version>
         <jjwt.version>0.12.5</jjwt.version>
         <rat.version>0.10</rat.version> <!-- unused -->
@@ -1015,23 +1013,6 @@
                 <scope>import</scope>
             </dependency>
             <!-- End of netty-bom version override -->
-            <!-- Temporary tomcat-embed version override -->
-            <dependency>
-                <groupId>org.apache.tomcat.embed</groupId>
-                <artifactId>tomcat-embed-core</artifactId>
-                <version>${tomcat.version}</version>
-            </dependency>
-            <dependency>
-                <groupId>org.apache.tomcat.embed</groupId>
-                <artifactId>tomcat-embed-el</artifactId>
-                <version>${tomcat.version}</version>
-            </dependency>
-            <dependency>
-                <groupId>org.apache.tomcat.embed</groupId>
-                <artifactId>tomcat-embed-websocket</artifactId>
-                <version>${tomcat.version}</version>
-            </dependency>
-            <!-- End of tomcat-embed version override -->
             <dependency>
                 <groupId>org.springframework.boot</groupId>
                 <artifactId>spring-boot-dependencies</artifactId>
@@ -1369,11 +1350,6 @@
                 <artifactId>commons-lang3</artifactId>
                 <version>${commons-lang3.version}</version>
             </dependency>
-            <dependency>
-                <groupId>org.postgresql</groupId>
-                <artifactId>postgresql</artifactId>
-                <version>${postgresql.version}</version>
-            </dependency>
             <dependency>
                 <groupId>commons-io</groupId>
                 <artifactId>commons-io</artifactId>

From 2bb249f86f41ab0ba6cd45ec50a0ac354564abc0 Mon Sep 17 00:00:00 2001
From: Viacheslav Klimov <viacheslavklimov11@gmail.com>
Date: Thu, 11 Jun 2026 16:34:59 +0300
Subject: [PATCH 3/4] Use wire-schema-jvm coordinate so wire 6.3.0 resolves
 under Maven

---
 common/data/pom.xml | 5 ++++-
 pom.xml             | 2 +-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/common/data/pom.xml b/common/data/pom.xml
index a9ca14a2d6..450a0826b9 100644
--- a/common/data/pom.xml
+++ b/common/data/pom.xml
@@ -84,8 +84,11 @@
             <scope>test</scope>
         </dependency>
         <dependency>
+            <!-- wire-schema-jvm (not wire-schema): from Wire 4.x the plain wire-schema artifact is an empty
+                 Kotlin-Multiplatform pointer whose Maven pom carries no classes, so the -jvm variant must be
+                 referenced explicitly. It transitively pulls wire-runtime-jvm. See CVE-2026-45799 fix. -->
             <groupId>com.squareup.wire</groupId>
-            <artifactId>wire-schema</artifactId>
+            <artifactId>wire-schema-jvm</artifactId>
         </dependency>
         <dependency>
             <groupId>org.thingsboard</groupId>
diff --git a/pom.xml b/pom.xml
index ab5328ec7e..73e61092f3 100755
--- a/pom.xml
+++ b/pom.xml
@@ -1770,7 +1770,7 @@
             </dependency>
             <dependency>
                 <groupId>com.squareup.wire</groupId>
-                <artifactId>wire-schema</artifactId>
+                <artifactId>wire-schema-jvm</artifactId>
                 <version>${wire-schema.version}</version>
             </dependency>
             <dependency>

From fadad06407b9ba3946a15a42a59237646f715efc Mon Sep 17 00:00:00 2001
From: Viacheslav Klimov <viacheslavklimov11@gmail.com>
Date: Fri, 12 Jun 2026 12:39:05 +0300
Subject: [PATCH 4/4] Clarify spring-boot-test and wire-schema pin comments per
 PR review

---
 pom.xml | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/pom.xml b/pom.xml
index 73e61092f3..2a56db5e8f 100755
--- a/pom.xml
+++ b/pom.xml
@@ -63,9 +63,11 @@
         <pkg.unixLogFolder>/var/log/${pkg.name}</pkg.unixLogFolder>
         <pkg.installFolder>/usr/share/${pkg.name}</pkg.installFolder>
         <spring-boot.version>3.5.15</spring-boot.version>
-        <!-- TODO: remove spring-boot-test.version override and the matching dependencyManagement entries below
-             once Spring Boot 3.5.15+ is released with a fix for the ImportsContextCustomizer regression in 3.5.14
-             that causes "Duplicate spy definition" failures on legacy @SpyBean fields (see PR #15557). -->
+        <!-- Pins spring-boot-test to 3.5.13: the ImportsContextCustomizer change in 3.5.14 causes "Duplicate spy
+             definition" failures on legacy @SpyBean fields (see PR #15557). Spring declined to restore the prior
+             behavior (spring-projects/spring-boot#50230, closed NOT_PLANNED), so no 3.5.x release fixes this — the
+             bump to 3.5.15 in this PR does not. TODO: remove this override and the matching dependencyManagement
+             entries below once TB migrates its tests off the deprecated @SpyBean/@MockBean to @MockitoSpyBean/@MockitoBean. -->
         <spring-boot-test.version>3.5.13</spring-boot-test.version>
         <commons-lang3.version>3.18.0</commons-lang3.version> <!-- to fix CVE-2025-48924. TODO: remove when fixed in spring-boot-dependencies -->
         <netty.version>4.1.134.Final</netty.version> <!-- to fix CVE-2026-42579, CVE-2026-42583, CVE-2026-42584, CVE-2026-42587, and MQTT decoder regression introduced in 4.1.133 by the CVE-2026-44248 fix. TODO: remove when fixed in spring-boot-dependencies -->
@@ -134,7 +136,7 @@
         <commons-beanutils.version>1.11.0</commons-beanutils.version>
         <commons-collections.version>4.4</commons-collections.version>
         <protobuf-dynamic.version>1.0.4TB</protobuf-dynamic.version>
-        <wire-schema.version>6.3.0</wire-schema.version> <!-- to fix CVE-2026-45799 (transitive wire-runtime). TODO: remove pin when upstream bundles >= 6.3.0 -->
+        <wire-schema.version>6.3.0</wire-schema.version> <!-- to fix CVE-2026-45799 (transitive wire-runtime). Not managed by the Spring Boot BOM — this pin is the sole source of the wire version, nothing to defer to. TODO: remove only once a TB dependency pulls wire >= 6.3.0 transitively, making the explicit pin redundant. -->
         <twilio.version>10.1.3</twilio.version>
         <hypersistence-utils.version>3.7.4</hypersistence-utils.version> <!-- artifact name should be updated with hibernate-core version -->
         <jakarta.el.version>4.0.2</jakarta.el.version>