fix(deps): update non-major dependencies

[renovate-wenisch-tech]

This PR contains the following updates:

Package	Type	Update	Change	Age	Confidence
docker/dockerfile	syntax	minor	1.25 → 1.27
org.springdoc:springdoc-openapi-starter-webmvc-ui (source)	compile	minor	2.8.17 → 2.9.1

---

Release Notes

springdoc/springdoc-openapi (org.springdoc:springdoc-openapi-starter-webmvc-ui)

v2.9.1: springdoc-openapi v2.9.1 released!

Compare Source

Security

• GHSA-rhhx-6j8h-8cvw – Unbounded per-locale OpenAPI cache allows memory exhaustion via Accept-Language
• GHSA-c925-vm88-mpp9 – Scalar starters trust client-supplied forwarded headers and render from a shared mutable bean
• CVE-2026-75838 – Cross-site scripting in the DOMPurify bundled with swagger-ui, addressed by upgrading swagger-ui to 5.32.14

Added

• #​3340 – Describe JsonNullable values without their Java wrapper
• #​3325 – Manage the swagger artifacts in springdoc-openapi-bom, so that modules holding only the annotations stay in lockstep
• #​3321 – Add springdoc.login-endpoint.username-example and springdoc.login-endpoint.password-example to document the Spring Security login endpoint

Changed

• The Scalar starters no longer register forwarded-header handling. Set server.forward-headers-strategy=framework (or native) behind a trusted proxy
• Add springdoc.cache.max-entries (default 100) to bound the per-locale OpenAPI cache
• Document the security policy and the release versioning scheme
• #​3351 – java.time.Duration, LocalTime and OffsetTime are now resolved by swagger-core instead of being forced to a bare string, so they carry a format (duration and partial-time respectively for the first two)
• A property whose type only implements Set indirectly (LinkedHashSet, TreeSet, …) is now described with uniqueItems: true, following swagger-api/swagger-core#5265
• Upgrade swagger-core to version 2.2.55
• Upgrade swagger-ui to version 5.32.14

Fixed

• #​3320 – @Order and Ordered ignored when applying customizers
• #​3319 – A Page nested in another schema is not replaced by PagedModel
• #​3313 – Springdoc auto-configurations rely on unspecified auto-configuration ordering
• #​3331 – Validation annotations declared inside Optional parameters are dropped
• #​3322 – Validation annotations on a container's type argument leak between parameters
• #​3315 – An OAS 3.1 JsonSchema cannot be cloned through JSON
• #​3314 – Json Processing Exception occurred is logged for every constrained parameter whose schema is not a JsonSchema
• #​3300 – TYPE_USE annotations on @ParameterObject fields are not passed along
• #​3341 – Stabilize Spring Data Sort and Pageable schema property order
• #​3338 – Kotlin nullability interpretation of the Any? type
• #​3332 – The properties a Kotlin entity inherits from an @Embeddable are missing from the Spring Data REST schemas
• #​3136 – A Spring Data REST association to a non-exported entity expands its @EmbeddedId and @MapsId fields recursively in the response schemas
• The Spring Data REST response post-processing rewrote an association property in place, so the …Response refs could leak into the schema shared with the request body representation
• #​3317 – Ignore an injected HttpHeaders parameter explicitly. The reported failure needs Spring Framework 7, where HttpHeaders stopped implementing MultiValueMap; on this line it is still covered by the Map entry of the ignore list, so this is regression cover rather than a behaviour change
• Harden the Spring Data REST response post-processing against an _embedded schema that carries no properties

New Contributors

• @​tthornton3-chwy made their first contribution in #​3300

Full Changelog: springdoc/springdoc-openapi@v2.9.0...v2.9.1

v2.9.0: springdoc-openapi v2.9.0 released!

Compare Source

What's Changed

• Fix version mismatch in springdoc-openapi-tests: update sub-modules to 2.8.18-SNAPSHOT by @​ankushsurani in #​3262
• Upgrade swagger-core from version 2.2.47 to 2.2.48 by @​Mattias-Sehlstedt in #​3266
• Add mechanism to disable nullable for Kotlin properties by @​0xabadea in #​3269
• Stabilize Spring Data Page schema property order by @​dpkass in #​3281
• Upgrade swagger-core from version 2.2.48 to 2.2.49 by @​Mattias-Sehlstedt in #​3284
• Fix vulnerabilities: upgrade spring boot to 3.5.14 and swagger-ui to 5.32.5 by @​Axel-1 in #​3291

• Make WebProperties and WebMvcProperties optional in SwaggerConfig by @​seonwooj0810 in #​3292
• chore: act upon SonarQube warnings by @​Mattias-Sehlstedt in #​3306

• Upgrade Spring Boot to version 3.5.16
• Upgrade swagger-core to version 2.2.52
• Upgrade swagger-ui to version 5.32.11
• Upgrade commons-lang to version 3.20.0
• Act upon SonarQube warnings (#​3306, #​3307)

Added

• Allow request-specific Swagger UI index transformation
• Add a mechanism to disable nullable for Kotlin properties

Fixed

• #​3304 – Kotlin parent class's field is not properly marked as nullable
• #​3298 – Update Spring Boot to 3.5.16
• #​3294 – Duplicated path getting swagger-config
• #​3293 – Inconsistent OpenAPI schema naming with SNAKE_CASE: some Java record fields remain camelCase
• #​3291 – Fix vulnerabilities: upgrade Spring Boot to 3.5.14 and swagger-ui to 5.32.5
• #​3288 – Make WebProperties and WebMvcProperties optional in SwaggerConfig
• #​3281 – Stabilize Spring Data Page schema property order
• #​3274 – Description disappears from the generated JSON after upgrade to 3.0.3
• #​3270 – Validation annotation of ParameterObject property applied to PathVariable with the same name, even in unrelated endpoints
• #​3263 – Null key for a Map not allowed in JSON
• #​3262 – Fix version mismatch in springdoc-openapi-tests modules

New Contributors

• @​ankushsurani made their first contribution in #​3262
• @​0xabadea made their first contribution in #​3269
• @​dpkass made their first contribution in #​3281
• @​Axel-1 made their first contribution in #​3291

Full Changelog: springdoc/springdoc-openapi@v2.8.17...v2.9.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.