[Snyk] Upgrade org.thymeleaf.extras:thymeleaf-extras-springsecurity5 from 3.0.4.RELEASE to 3.1.3.RELEASE

[rogeliocisternas]

Snyk has created this PR to upgrade org.thymeleaf.extras:thymeleaf-extras-springsecurity5 from 3.0.4.RELEASE to 3.1.3.RELEASE.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 8 versions ahead of your current version.

• The recommended version was released a year ago.

Issues fixed by the recommended upgrade:

	Issue	Score	Exploit Maturity
	Cross-site Scripting (XSS) SNYK-JAVA-ORGTHYMELEAFEXTRAS-572299	539	No Known Exploit

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• This PR was automatically created by Snyk using the credentials of a real user.
• Max score is 1000. Note that the real score may have changed since the PR was raised.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

• 🧐 View latest project report
• 📜 Customise PR templates
• 🛠 Adjust upgrade PR settings
• 🔕 Ignore this dependency or unsubscribe from future upgrade PRs

[Copilot]

Pull request overview

This PR upgrades the thymeleaf-extras-springsecurity5 dependency from version 3.0.4.RELEASE to 3.1.3.RELEASE to address a medium-severity Cross-site Scripting (XSS) vulnerability (SNYK-JAVA-ORGTHYMELEAFEXTRAS-572299).

Changes:

• Updated thymeleaf-extras-springsecurity5 version from 3.0.4.RELEASE to 3.1.3.RELEASE in pom.xml

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

This dependency upgrade has a critical compatibility issue. Spring Boot 3.0.6 (line 8) uses Spring Security 6 by default, but thymeleaf-extras-springsecurity5 version 3.1.3.RELEASE is designed for Spring Security 5.x.

For Spring Boot 3.x with Spring Security 6, you should use thymeleaf-extras-springsecurity6 instead. This will require changing both the artifactId and version. For example:

• artifactId: thymeleaf-extras-springsecurity6
• version: 3.1.2.RELEASE (or later)

While the application may currently work because the Thymeleaf Security extras are not actively used in the templates (no sec: namespace found), this mismatch could cause runtime issues if security-specific Thymeleaf features are used in the future.