Merge branch 'apache-3.2' into apache-3.3

# Conflicts:
#	dubbo-common/src/main/java/org/apache/dubbo/common/json/impl/FastJson2Impl.java
#	dubbo-config/dubbo-config-api/src/test/java/org/apache/dubbo/config/deploy/DefaultApplicationDeployerTest.java
#	dubbo-dependencies-bom/pom.xml
#	dubbo-spring-boot/pom.xml
#	dubbo-test/dubbo-test-spring/pom.xml

dubbo-common/src/main/java/org/apache/dubbo/common/config/ConfigurationUtils.java

@@ -31,10 +31,9 @@ import java.io.StringReader;
 import java.util.Collection;
 import java.util.Collections;
 import java.util.HashMap;
+import java.util.HashSet;
 import java.util.LinkedHashMap;
 import java.util.LinkedHashSet;
-import java.util.LinkedList;
-import java.util.List;
 import java.util.Map;
 import java.util.Objects;
 import java.util.Properties;
@@ -43,6 +42,7 @@ import java.util.Set;
 import static org.apache.dubbo.common.constants.CommonConstants.DEFAULT_SERVER_SHUTDOWN_TIMEOUT;
 import static org.apache.dubbo.common.constants.CommonConstants.SHUTDOWN_WAIT_KEY;
 import static org.apache.dubbo.common.constants.CommonConstants.SHUTDOWN_WAIT_SECONDS_KEY;
+import static org.apache.dubbo.common.constants.LoggerCodeConstants.COMMON_PROPERTY_TYPE_MISMATCH;
 
 /**
  * Utilities for manipulating configurations from different sources
@@ -57,18 +57,18 @@ public final class ConfigurationUtils {
     }
 
     private static final ErrorTypeAwareLogger logger = LoggerFactory.getErrorTypeAwareLogger(ConfigurationUtils.class);
-    private static final List<String> securityKey;
+    private static final Set<String> securityKey;
 
     private static volatile long expectedShutdownTime = Long.MAX_VALUE;
 
     static {
-        List<String> keys = new LinkedList<>();
+        Set<String> keys = new HashSet<>();
         keys.add("accesslog");
         keys.add("router");
         keys.add("rule");
         keys.add("runtime");
         keys.add("type");
-        securityKey = Collections.unmodifiableList(keys);
+        securityKey = Collections.unmodifiableSet(keys);
     }
 
     /**
@@ -213,11 +213,15 @@ public final class ConfigurationUtils {
             properties.load(new StringReader(content));
             properties.stringPropertyNames().forEach(k -> {
                 boolean deny = false;
-                for (String key : securityKey) {
+                // check whether property name is safe or not based on the last fragment kebab-case comparison.
-                    if (k.contains(key)) {
+                String[] fragments = k.split("\\.");
-                        deny = true;
+                if (securityKey.contains(StringUtils.convertToSplitName(fragments[fragments.length - 1], "-"))) {
-                        break;
+                    deny = true;
-                    }
+                    logger.warn(
+                            COMMON_PROPERTY_TYPE_MISMATCH,
+                            "security properties are not allowed to be set",
+                            "",
+                            String.format("'%s' is not allowed to be set as it is on the security key list.", k));
                 }
                 if (!deny) {
                     map.put(k, properties.getProperty(k));

dubbo-common/src/main/java/org/apache/dubbo/common/json/JsonUtil.java

@@ -26,6 +26,8 @@ import java.util.Map;
 public interface JsonUtil {
     boolean isSupport();
 
+    boolean isJson(String json);
+
     <T> T toJavaObject(String json, Type type);
 
     <T> List<T> toJavaList(String json, Class<T> clazz);

dubbo-common/src/main/java/org/apache/dubbo/common/json/impl/FastJson2Impl.java

@@ -19,9 +19,16 @@ package org.apache.dubbo.common.json.impl;
 import java.lang.reflect.Type;
 import java.util.List;
 
+import com.alibaba.fastjson2.JSONValidator;
 import com.alibaba.fastjson2.JSONWriter;
 
 public class FastJson2Impl extends AbstractJsonUtilImpl {
+
+    @Override
+    public boolean isJson(String json) {
+        JSONValidator validator = JSONValidator.from(json);
+        return validator.validate();
+    }
     @Override
     public <T> T toJavaObject(String json, Type type) {
         return com.alibaba.fastjson2.JSON.parseObject(json, type);

dubbo-common/src/main/java/org/apache/dubbo/common/json/impl/FastJsonImpl.java

@@ -24,6 +24,16 @@ import com.alibaba.fastjson.serializer.SerializerFeature;
 
 public class FastJsonImpl extends AbstractJsonUtilImpl {
 
+    @Override
+    public boolean isJson(String json) {
+        try {
+            Object obj = com.alibaba.fastjson.JSON.parse(json);
+            return obj instanceof com.alibaba.fastjson.JSONObject || obj instanceof com.alibaba.fastjson.JSONArray;
+        } catch (com.alibaba.fastjson.JSONException e) {
+            return false;
+        }
+    }
+
     @Override
     public <T> T toJavaObject(String json, Type type) {
         return com.alibaba.fastjson.JSON.parseObject(json, type);

dubbo-common/src/main/java/org/apache/dubbo/common/json/impl/GsonImpl.java

@@ -20,12 +20,25 @@ import java.lang.reflect.Type;
 import java.util.List;
 
 import com.google.gson.Gson;
+import com.google.gson.JsonElement;
+import com.google.gson.JsonParser;
+import com.google.gson.JsonSyntaxException;
 import com.google.gson.reflect.TypeToken;
 
 public class GsonImpl extends AbstractJsonUtilImpl {
     // weak reference of com.google.gson.Gson, prevent throw exception when init
     private volatile Object gsonCache = null;
 
+    @Override
+    public boolean isJson(String json) {
+        try {
+            JsonElement jsonElement = JsonParser.parseString(json);
+            return jsonElement.isJsonObject() || jsonElement.isJsonArray();
+        } catch (JsonSyntaxException e) {
+            return false;
+        }
+    }
+
     @Override
     public <T> T toJavaObject(String json, Type type) {
         return getGson().fromJson(json, type);

dubbo-common/src/main/java/org/apache/dubbo/common/json/impl/JacksonImpl.java

@@ -20,7 +20,9 @@ import java.lang.reflect.Type;
 import java.util.List;
 
 import com.fasterxml.jackson.annotation.JsonInclude.Include;
+import com.fasterxml.jackson.core.JsonProcessingException;
 import com.fasterxml.jackson.databind.DeserializationFeature;
+import com.fasterxml.jackson.databind.JsonNode;
 import com.fasterxml.jackson.databind.MapperFeature;
 import com.fasterxml.jackson.databind.ObjectMapper;
 import com.fasterxml.jackson.databind.json.JsonMapper;
@@ -31,6 +33,16 @@ public class JacksonImpl extends AbstractJsonUtilImpl {
 
     private volatile Object jacksonCache = null;
 
+    @Override
+    public boolean isJson(String json) {
+        try {
+            JsonNode node = objectMapper.readTree(json);
+            return node.isObject() || node.isArray();
+        } catch (JsonProcessingException e) {
+            return false;
+        }
+    }
+
     @Override
     public <T> T toJavaObject(String json, Type type) {
         try {

dubbo-common/src/main/java/org/apache/dubbo/common/utils/JsonUtils.java

@@ -155,4 +155,8 @@ public class JsonUtils {
     public static List<String> checkStringList(List<?> rawList) {
         return getJson().checkStringList(rawList);
     }
+
+    public static boolean checkJson(String json) {
+        return getJson().isJson(json);
+    }
 }

dubbo-common/src/test/java/org/apache/dubbo/common/extension/ExtensionDirectorTest.java

@@ -45,8 +45,7 @@ class ExtensionDirectorTest {
         // 2. Child ExtensionDirector can get extension instance from parent
         // 3. Parent ExtensionDirector can't get extension instance from child
 
-        ExtensionDirector fwExtensionDirector =
+        ExtensionDirector fwExtensionDirector = FrameworkModel.defaultModel().getExtensionDirector();
-                new ExtensionDirector(null, ExtensionScope.FRAMEWORK, FrameworkModel.defaultModel());
         ExtensionDirector appExtensionDirector =
                 new ExtensionDirector(fwExtensionDirector, ExtensionScope.APPLICATION, ApplicationModel.defaultModel());
         ExtensionDirector moduleExtensionDirector = new ExtensionDirector(

dubbo-common/src/test/java/org/apache/dubbo/common/json/GsonUtilsTest.java

@@ -36,7 +36,8 @@ class GsonUtilsTest {
             Assertions.fail();
         } catch (RuntimeException ex) {
             Assertions.assertEquals(
-                    "Generic serialization [gson] Json syntax exception thrown when parsing (message:{'name':'Tom','age':} type:class org.apache.dubbo.common.json.GsonUtilsTest$User) error:com.google.gson.stream.MalformedJsonException: Expected value at line 1 column 21 path $.age",
+                    "Generic serialization [gson] Json syntax exception thrown when parsing (message:{'name':'Tom','age':} type:class org.apache.dubbo.common.json.GsonUtilsTest$User) error:com.google.gson.stream.MalformedJsonException: Expected value at line 1 column 21 path $.age\n"
+                            + "See https://github.com/google/gson/blob/main/Troubleshooting.md#malformed-json",
                     ex.getMessage());
         }
     }

dubbo-common/src/test/java/org/apache/dubbo/common/utils/JsonUtilsTest.java

@@ -66,6 +66,49 @@ class JsonUtilsTest {
         }
     }
 
+    @Test
+    void testIsJson() {
+        JsonUtils.setJson(null);
+        // prefer use fastjson2
+        System.setProperty("dubbo.json-framework.prefer", "fastjson2");
+        Assertions.assertTrue(
+                JsonUtils.getJson().isJson("{\"title\":\"Java Programming\",\"author\":\"John Doe\",\"pages\":300}"));
+        Assertions.assertFalse(JsonUtils.getJson().isJson("This is not a JSON string"));
+        Assertions.assertTrue(
+                JsonUtils.getJson().isJson("[{\"title\":\"Java Programming\"}, {\"title\":\"Python Programming\"}]"));
+        System.clearProperty("dubbo.json-framework.prefer");
+
+        // prefer use fastjson
+        JsonUtils.setJson(null);
+        System.setProperty("dubbo.json-framework.prefer", "fastjson");
+        Assertions.assertTrue(
+                JsonUtils.getJson().isJson("{\"title\":\"Java Programming\",\"author\":\"John Doe\",\"pages\":300}"));
+        Assertions.assertFalse(JsonUtils.getJson().isJson("This is not a JSON string"));
+        Assertions.assertTrue(
+                JsonUtils.getJson().isJson("[{\"title\":\"Java Programming\"}, {\"title\":\"Python Programming\"}]"));
+        System.clearProperty("dubbo.json-framework.prefer");
+
+        // prefer use gson
+        JsonUtils.setJson(null);
+        System.setProperty("dubbo.json-framework.prefer", "gson");
+        Assertions.assertTrue(
+                JsonUtils.getJson().isJson("{\"title\":\"Java Programming\",\"author\":\"John Doe\",\"pages\":300}"));
+        Assertions.assertFalse(JsonUtils.getJson().isJson("This is not a JSON string"));
+        Assertions.assertTrue(
+                JsonUtils.getJson().isJson("[{\"title\":\"Java Programming\"}, {\"title\":\"Python Programming\"}]"));
+        System.clearProperty("dubbo.json-framework.prefer");
+
+        // prefer use jackson
+        JsonUtils.setJson(null);
+        System.setProperty("dubbo.json-framework.prefer", "jackson");
+        Assertions.assertTrue(
+                JsonUtils.getJson().isJson("{\"title\":\"Java Programming\",\"author\":\"John Doe\",\"pages\":300}"));
+        Assertions.assertFalse(JsonUtils.getJson().isJson("This is not a JSON string"));
+        Assertions.assertTrue(
+                JsonUtils.getJson().isJson("[{\"title\":\"Java Programming\"}, {\"title\":\"Python Programming\"}]"));
+        System.clearProperty("dubbo.json-framework.prefer");
+    }
+
     @Test
     void testGetJson1() {
         Assertions.assertNotNull(JsonUtils.getJson());

dubbo-config/dubbo-config-api/pom.xml

@@ -251,7 +251,7 @@
     <dependency>
       <groupId>org.testcontainers</groupId>
       <artifactId>testcontainers</artifactId>
-      <version>1.19.7</version>
+      <version>1.19.8</version>
       <scope>test</scope>
     </dependency>
 

dubbo-config/dubbo-config-api/src/main/java/org/apache/dubbo/config/deploy/DefaultApplicationDeployer.java

@@ -389,6 +389,9 @@ public class DefaultApplicationDeployer extends AbstractDeployer<ApplicationMode
         Optional<MetricsConfig> configOptional = configManager.getMetrics();
         // If no specific metrics type is configured and there is no Prometheus dependency in the dependencies.
         MetricsConfig metricsConfig = configOptional.orElse(new MetricsConfig(applicationModel));
+        if (PROTOCOL_PROMETHEUS.equals(metricsConfig.getProtocol()) && !isSupportPrometheus()) {
+            return;
+        }
         if (StringUtils.isBlank(metricsConfig.getProtocol())) {
             metricsConfig.setProtocol(
                     MetricsSupportUtil.isSupportPrometheus() ? PROTOCOL_PROMETHEUS : PROTOCOL_DEFAULT);

dubbo-config/dubbo-config-api/src/test/java/org/apache/dubbo/config/deploy/DefaultApplicationDeployerTest.java

@@ -17,10 +17,13 @@
 package org.apache.dubbo.config.deploy;
 
 import org.apache.dubbo.common.utils.Assert;
+import org.apache.dubbo.config.MetricsConfig;
 import org.apache.dubbo.metrics.utils.MetricsSupportUtil;
 
 import org.junit.jupiter.api.Test;
 
+import static org.apache.dubbo.common.constants.MetricsConstants.PROTOCOL_PROMETHEUS;
+
 class DefaultApplicationDeployerTest {
 
     @Test
@@ -28,4 +31,13 @@ class DefaultApplicationDeployerTest {
         boolean supportPrometheus = MetricsSupportUtil.isSupportPrometheus();
         Assert.assertTrue(supportPrometheus, "MetricsSupportUtil.isSupportPrometheus() should return true");
     }
+
+    @Test
+    void isImportPrometheus() {
+        MetricsConfig metricsConfig = new MetricsConfig();
+        metricsConfig.setProtocol("prometheus");
+        boolean importPrometheus = PROTOCOL_PROMETHEUS.equals(metricsConfig.getProtocol())
+                && !DefaultApplicationDeployer.isSupportPrometheus();
+        Assert.assertTrue(!importPrometheus, " should return false");
+    }
 }

dubbo-config/dubbo-config-spring/pom.xml

@@ -74,7 +74,7 @@
     <dependency>
       <groupId>org.aspectj</groupId>
       <artifactId>aspectjweaver</artifactId>
-      <version>1.9.22</version>
+      <version>1.9.22.1</version>
       <scope>test</scope>
     </dependency>
     <dependency>

dubbo-demo/dubbo-demo-native/dubbo-demo-native-consumer/pom.xml

@@ -199,7 +199,7 @@
           <plugin>
             <groupId>org.graalvm.buildtools</groupId>
             <artifactId>native-maven-plugin</artifactId>
-            <version>0.10.1</version>
+            <version>0.10.2</version>
             <configuration>
               <classesDirectory>${project.build.outputDirectory}</classesDirectory>
               <metadataRepository>

dubbo-demo/dubbo-demo-native/dubbo-demo-native-provider/pom.xml

@@ -199,7 +199,7 @@
           <plugin>
             <groupId>org.graalvm.buildtools</groupId>
             <artifactId>native-maven-plugin</artifactId>
-            <version>0.10.1</version>
+            <version>0.10.2</version>
             <configuration>
               <classesDirectory>${project.build.outputDirectory}</classesDirectory>
               <metadataRepository>

dubbo-demo/dubbo-demo-spring-boot/pom.xml

@@ -35,7 +35,7 @@
     <skip_maven_deploy>true</skip_maven_deploy>
     <spring-boot.version>2.7.18</spring-boot.version>
     <spring-boot-maven-plugin.version>2.7.18</spring-boot-maven-plugin.version>
-    <micrometer-core.version>1.12.5</micrometer-core.version>
+    <micrometer-core.version>1.13.0</micrometer-core.version>
   </properties>
 
   <dependencyManagement>

dubbo-dependencies-bom/pom.xml

@@ -90,10 +90,10 @@
   <properties>
     <!-- Common libs -->
     <!-- <spring_version>4.3.30.RELEASE</spring_version> -->
-    <spring_version>5.3.34</spring_version>
+    <spring_version>5.3.35</spring_version>
     <spring_security_version>5.8.12</spring_security_version>
     <javassist_version>3.30.2-GA</javassist_version>
-    <byte-buddy_version>1.14.14</byte-buddy_version>
+    <byte-buddy_version>1.14.15</byte-buddy_version>
     <netty_version>3.2.10.Final</netty_version>
     <netty4_version>4.1.109.Final</netty4_version>
     <httpclient_version>4.5.14</httpclient_version>
@@ -119,14 +119,14 @@
     <snakeyaml_version>2.2</snakeyaml_version>
     <commons_lang3_version>3.14.0</commons_lang3_version>
     <envoy_api_version>0.1.35</envoy_api_version>
-    <micrometer.version>1.12.5</micrometer.version>
+    <micrometer.version>1.13.0</micrometer.version>
     <opentelemetry.version>1.26.0</opentelemetry.version>
     <zipkin-reporter.version>2.16.4</zipkin-reporter.version>
     <micrometer-tracing.version>1.2.5</micrometer-tracing.version>
     <t_digest.version>3.3</t_digest.version>
     <prometheus_client.version>0.16.0</prometheus_client.version>
     <reactive.version>1.0.4</reactive.version>
-    <reactor.version>3.6.5</reactor.version>
+    <reactor.version>3.6.6</reactor.version>
     <rxjava.version>2.2.21</rxjava.version>
     <okhttp_version>3.14.9</okhttp_version>
 
@@ -137,13 +137,13 @@
     <nacos_version>2.3.2</nacos_version>
     <sentinel.version>1.8.6</sentinel.version>
     <seata.version>1.6.1</seata.version>
-    <grpc.version>1.63.0</grpc.version>
+    <grpc.version>1.64.0</grpc.version>
     <grpc_contrib_verdion>0.8.1</grpc_contrib_verdion>
     <jprotoc_version>1.2.2</jprotoc_version>
     <mustache_version>0.9.10</mustache_version>
     <!-- Log libs -->
     <slf4j_version>1.7.36</slf4j_version>
-    <jcl_version>1.3.1</jcl_version>
+    <jcl_version>1.3.2</jcl_version>
     <log4j_version>1.2.17</log4j_version>
     <logback_version>1.2.13</logback_version>
     <!-- Fix the bug of log4j refer:https://github.com/apache/logging-log4j2/pull/608 -->
@@ -166,7 +166,7 @@
 
     <jaxb_version>2.2.7</jaxb_version>
     <activation_version>1.2.0</activation_version>
-    <test_container_version>1.19.7</test_container_version>
+    <test_container_version>1.19.8</test_container_version>
     <hessian_lite_version>4.0.0</hessian_lite_version>
     <swagger_version>1.6.14</swagger_version>
 
@@ -174,7 +174,7 @@
     <bouncycastle-bcprov_version>1.70</bouncycastle-bcprov_version>
     <sofa_registry_version>5.4.3</sofa_registry_version>
     <metrics_version>2.0.6</metrics_version>
-    <gson_version>2.10.1</gson_version>
+    <gson_version>2.11.0</gson_version>
     <jackson_version>2.17.1</jackson_version>
     <mortbay_jetty_version>6.1.26</mortbay_jetty_version>
     <portlet_version>2.0</portlet_version>

dubbo-metrics/dubbo-metrics-prometheus/pom.xml

@@ -43,7 +43,7 @@
     </dependency>
     <dependency>
       <groupId>io.micrometer</groupId>
-      <artifactId>micrometer-registry-prometheus</artifactId>
+      <artifactId>micrometer-registry-prometheus-simpleclient</artifactId>
     </dependency>
     <dependency>
       <groupId>io.prometheus</groupId>

dubbo-registry/dubbo-registry-zookeeper/src/main/java/org/apache/dubbo/registry/zookeeper/ZookeeperRegistry.java

@@ -22,6 +22,7 @@ import org.apache.dubbo.common.logger.LoggerFactory;
 import org.apache.dubbo.common.utils.CollectionUtils;
 import org.apache.dubbo.common.utils.ConcurrentHashMapUtils;
 import org.apache.dubbo.common.utils.ConcurrentHashSet;
+import org.apache.dubbo.common.utils.JsonUtils;
 import org.apache.dubbo.common.utils.UrlUtils;
 import org.apache.dubbo.registry.NotifyListener;
 import org.apache.dubbo.registry.support.CacheableFailbackRegistry;
@@ -46,6 +47,7 @@ import static org.apache.dubbo.common.constants.CommonConstants.ANY_VALUE;
 import static org.apache.dubbo.common.constants.CommonConstants.CHECK_KEY;
 import static org.apache.dubbo.common.constants.CommonConstants.INTERFACE_KEY;
 import static org.apache.dubbo.common.constants.CommonConstants.PATH_SEPARATOR;
+import static org.apache.dubbo.common.constants.LoggerCodeConstants.PROTOCOL_ERROR_DESERIALIZE;
 import static org.apache.dubbo.common.constants.LoggerCodeConstants.REGISTRY_ZOOKEEPER_EXCEPTION;
 import static org.apache.dubbo.common.constants.RegistryConstants.CONFIGURATORS_CATEGORY;
 import static org.apache.dubbo.common.constants.RegistryConstants.CONSUMERS_CATEGORY;
@@ -201,7 +203,15 @@ public class ZookeeperRegistry extends CacheableFailbackRegistry {
                 ChildListener zkListener = ConcurrentHashMapUtils.computeIfAbsent(
                         listeners, listener, k -> (parentPath, currentChildren) -> {
                             for (String child : currentChildren) {
-                                child = URL.decode(child);
+                                try {
+                                    child = URL.decode(child);
+                                    if (!(JsonUtils.checkJson(child))) {
+                                        throw new Exception("dubbo-admin subscribe " + child + " failed,beacause "
+                                                + child + "is root path in " + url);
+                                    }
+                                } catch (Exception e) {
+                                    logger.warn(PROTOCOL_ERROR_DESERIALIZE, "", "", e.getMessage());
+                                }
                                 if (!anyServices.contains(child)) {
                                     anyServices.add(child);
                                     subscribe(

dubbo-spring-boot/dubbo-spring-boot-starters/observability/autoconfigure/pom.xml

@@ -42,7 +42,7 @@
     </dependency>
     <dependency>
       <groupId>io.micrometer</groupId>
-      <artifactId>micrometer-registry-prometheus</artifactId>
+      <artifactId>micrometer-registry-prometheus-simpleclient</artifactId>
     </dependency>
     <dependency>
       <groupId>com.tdunning</groupId>

dubbo-spring-boot/dubbo-spring-boot-starters/observability/pom.xml

@@ -36,7 +36,7 @@
   </modules>
 
   <properties>
-    <micrometer.version>1.12.5</micrometer.version>
+    <micrometer.version>1.13.0</micrometer.version>
     <micrometer-tracing.version>1.2.5</micrometer-tracing.version>
     <opentelemetry.version>1.34.1</opentelemetry.version>
     <zipkin-reporter.version>2.17.2</zipkin-reporter.version>

dubbo-spring-boot/pom.xml

@@ -41,7 +41,7 @@
   <properties>
     <spring-boot.version>2.7.18</spring-boot.version>
     <!-- Spring boot buddy is lower than the delivery dependency package version and can only show the defined dependency version -->
-    <byte-buddy.version>1.14.14</byte-buddy.version>
+    <byte-buddy.version>1.14.15</byte-buddy.version>
     <mockito_version>4.11.0</mockito_version>
   </properties>
 

dubbo-test/dubbo-test-spring3.2/pom.xml

@@ -28,7 +28,7 @@
 
   <properties>
     <skip_maven_deploy>true</skip_maven_deploy>
-    <spring_version>5.3.34</spring_version>
+    <spring_version>5.3.35</spring_version>
   </properties>
 
   <dependencyManagement>

dubbo-test/dubbo-test-spring4.1/pom.xml

@@ -28,7 +28,7 @@
 
   <properties>
     <skip_maven_deploy>true</skip_maven_deploy>
-    <spring_version>5.3.34</spring_version>
+    <spring_version>5.3.35</spring_version>
   </properties>
 
   <dependencyManagement>

dubbo-test/dubbo-test-spring4.2/pom.xml

@@ -28,7 +28,7 @@
 
   <properties>
     <skip_maven_deploy>true</skip_maven_deploy>
-    <spring_version>5.3.34</spring_version>
+    <spring_version>5.3.35</spring_version>
   </properties>
 
   <dependencyManagement>

pom.xml

@@ -265,7 +265,7 @@
         <plugin>
           <groupId>org.codehaus.mojo</groupId>
           <artifactId>build-helper-maven-plugin</artifactId>
-          <version>3.5.0</version>
+          <version>3.6.0</version>
         </plugin>
         <plugin>
           <groupId>org.fusesource.hawtjni</groupId>