[mend-for-github-com]

This PR contains the following updates:

Package	Type	Update	Change
org.springframework.boot:spring-boot-starter-thymeleaf (source)	dependencies	patch	3.3.5 → 3.3.6

By merging this PR, the issue #37 will be automatically resolved and closed:

Severity	CVSS Score	Vulnerability
Critical	9.0	CVE-2026-40477
Critical	9.0	CVE-2026-40478

By merging this PR, the issue #37 will be automatically resolved and closed:

Severity	CVSS Score	Vulnerability
Critical	9.0	CVE-2026-40477
Critical	9.0	CVE-2026-40478

---

Release Notes

spring-projects/spring-boot (org.springframework.boot:spring-boot-starter-thymeleaf)

v3.3.6

⚠️ Noteworthy

• This release upgrades to OpenTelemetry 1.38.0, see this issue comment for more details.

🐞 Bug Fixes

• Spring Boot 3.3.x dependencies do not converge for Micrometer Tracing and OpenTelemetry #​43200
• Cannot package OCI image when 'docker.io/paketobuildpacks/new-relic' is provided as a buildpack #​43170
• WebServerPortFileWriter fails when using a portfile without extension #​43116
• SslOptions.isSpecified() only returns true if ciphers and enabled protocols are set #​43083
• Root cause of errors is hidden when loading images from archive #​43069
• mvn spring-boot:run fails on Windows with "Could Not Find or Load Main Class" when path contains non-ASCII characters #​43051
• Logback logging system does not process URLs with paths not ending in .xml #​42989
• NPE in bootBuildImage when setting DOCKER_CONTEXT=default #​42959
• build-info doesn't support seconds since the epoch from project.build.outputTimestamp #​42935
• NPE in OnClassCondition.resolveOutcomesThreaded following thread interruption because firstHalf is null #​42925
• X-Registry-Auth header sent to Docker Engine API contains field "authHeader" #​42914
• A @SpyBean on the output of a FactoryBean is not reset #​31204

📔 Documentation

• Documentation for 'spring.datasource.type' is misleading #​43198
• Update "Upgrading From" section to use "2.x" #​43159
• Include spring-boot-loader in API documentation #​43151
• Document how and where to add custom GraalVM configuration files #​43073
• Rework DataSource configuration examples to separate defining an additional DataSource and defining a DataSource of a different type #​43058
• Location of the layers schema is incorrect in the Maven Plugin's examples #​43032
• Link to Eclipse setup instructions #​42953
• Fix link to Checkpoint and Restore status page #​42938
• Update HttpWebServiceMessageSenderBuilder javadoc #​42893
• Move default value descriptions to "description" in logging property metadata #​42881

🔨 Dependency Upgrades

• Upgrade to ActiveMQ 6.1.4 #​43146
• Upgrade to Groovy 4.0.24 #​43095
• Upgrade to Infinispan 15.0.11.Final #​43147
• Upgrade to Jackson Bom 2.17.3 #​43036
• Upgrade to Jetty 12.0.15 #​43093
• Upgrade to jOOQ 3.19.15 #​43037
• Upgrade to Logback 1.5.12 #​43038
• Upgrade to Lombok 1.18.36 #​43181
• Upgrade to Micrometer 1.13.8 #​43182
• Upgrade to Micrometer Tracing 1.3.6 #​43000
• Upgrade to Netty 4.1.115.Final #​43148
• Upgrade to Pulsar Reactive 0.5.9 #​43183
• Upgrade to Reactor Bom 2023.0.12 #​43002
• Upgrade to Spring AMQP 3.1.8 #​43004
• Upgrade to Spring Data Bom 2024.0.6 #​43006
• Upgrade to Spring Framework 6.1.15 #​43008
• Upgrade to Spring Integration 6.3.6 #​43010
• Upgrade to Spring Kafka 3.2.5 #​43011
• Upgrade to Spring LDAP 3.2.8 #​43184
• Upgrade to Spring Pulsar 1.1.6 #​43012
• Upgrade to Spring RESTDocs 3.0.3 #​43014
• Upgrade to Spring Security 6.3.5 #​43013
• Upgrade to Tomcat 10.1.33 #​43149

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​ahoehma, @​izeye, @​ngocnhan-tran1996, @​nosan, @​quaff, and @​wickdynex

---

• If you want to rebase/retry this PR, check this box