spring boot version

.github/workflows/.trivyignore

@@ -1,15 +1,3 @@
-# Feb 27, 2026
-# Issue with libpng, alpine image
-CVE-2026-25646
-
-# March 9, 2026
-# Issue with zlib, alpine image
-CVE-2026-22184
-
-# April 7, 2026
-# Issue with libpng, alpine image
-CVE-2026-33416
-
-# April 7, 2026
-# Issue with libpng, alpine image
-CVE-2026-33636
+# May 6, 2026
+# Issue with postgresql, spring boot should update version
+CVE-2026-42198

.github/workflows/build.yaml

@@ -6,7 +6,7 @@ on:
   pull_request:
     types: [opened, synchronize, reopened]
   schedule:
-    - cron: "0 4  * * MON" # run on Monday at 4 AM
+    - cron: "0 3 1 * *" # At 3:00 on the 1st day of the month
   workflow_dispatch:  # Allow manual triggering
 jobs:
   build:
@@ -45,7 +45,7 @@ jobs:
         run: |
           docker build -t ${{ github.event.repository.name }} .
       - name: Trivy - List all vulnerabilities
-        uses: aquasecurity/trivy-action@master
+        uses: aquasecurity/trivy-action@v0.35.0
         with:
           image-ref: '${{ github.event.repository.name }}'
           format: 'table'
@@ -55,7 +55,7 @@ jobs:
           TRIVY_SKIP_DB_UPDATE: true
           TRIVY_SKIP_JAVA_DB_UPDATE: true
       - name: Trivy - Stop on Severe Vulnerabilities
-        uses: aquasecurity/trivy-action@master
+        uses: aquasecurity/trivy-action@v0.35.0
         if: github.event_name != 'push'
         with:
           image-ref: '${{ github.event.repository.name }}'

pom.xml

@@ -6,7 +6,7 @@
   <parent>
     <groupId>org.springframework.boot</groupId>
     <artifactId>spring-boot-starter-parent</artifactId>
-    <version>4.0.5</version>
+    <version>4.0.6</version>
     <relativePath/> <!-- lookup parent from repository -->
   </parent>
   <groupId>eu.dissco</groupId>