build(deps): bump org.springframework.cloud:spring-cloud-dependencies from 2025.1.2 to 2025.1.3

[dependabot]

Bumps org.springframework.cloud:spring-cloud-dependencies from 2025.1.2 to 2025.1.3.

Release notes

Sourced from org.springframework.cloud:spring-cloud-dependencies's releases.

v2025.1.3

Security

This release train contains fixes for 17 CVEs across 5 modules.

Spring Cloud Commons 5.0.3

• CVE-2026-59284 — Spring Cloud Commons no allow list for writable env actuator endpoint

Spring Cloud Config 5.0.5

• CVE-2026-47836 — Spring Cloud Config Server Susceptible To TOCTOU Attack When Using SVN
• CVE-2026-47837 — Spring Cloud Config Server Monitor Endpoint Does Not Validate Webhook Requests
• CVE-2026-47894 — Spring Cloud Config Server Native Environment Repository Exposure
• CVE-2026-59315 — Spring Cloud Config Monitor Denial of Service

Spring Cloud Function 5.0.4

• CVE-2026-59291 — Potential arbitrary file read and SSRF vulnerability in Spring Cloud Function
• CVE-2026-59297 — Spring Cloud Function can incorrectly determine if URI is secure
• CVE-2026-59298 — Potential for improper filtering of HTTP headers in Spring Cloud Function
• CVE-2026-59299 — Composition lookup can potentially poison base function in Spring Cloud Function
• CVE-2026-59300 — Potential for logging sensitive data in Spring Cloud Function AWS
• CVE-2026-59301 — Potential for logging sensitive data in Spring Cloud Function Azure

Spring Cloud Gateway 5.0.3

• CVE-2026-47879 — Spring Cloud Gateway SSRF and native file access with gRPC

Spring Cloud Stream 5.0.3

• CVE-2026-59302 — Potential for logging sensitive data in Spring Cloud Stream
• CVE-2026-59303 — Dynamic destination cache size is not properly bound in Spring Cloud Stream
• CVE-2026-59304 — Improper caching of the original content type in Spring Cloud Stream Avro
• CVE-2026-59305 — Partition interceptor may be improperly added while sending message
• CVE-2026-59306 — Potential for deserialization of untrusted types in Spring Cloud Stream

What's Included

• Spring Cloud Build 5.0.3 (issues)
• Spring Cloud Function 5.0.4 (issues)
• Spring Cloud Stream 5.0.3 (issues)
• Spring Cloud Commons 5.0.3 (issues)
• Spring Cloud Bus 5.0.3 (issues)
• Spring Cloud Task 5.0.2 (issues)
• Spring Cloud Config 5.0.5 (issues)
• Spring Cloud Netflix 5.0.2 (issues)
• Spring Cloud Openfeign 5.0.3 (issues)
• Spring Cloud Consul 5.0.3 (issues)
• Spring Cloud Circuitbreaker 5.0.3 (issues)
• Spring Cloud Gateway 5.0.3 (issues)

... (truncated)

Commits

• d52d95a Release 2025.1.3
• 5ba4ec5 Initialize commercial release branch
• 7e855d0 Update versions for 2025.1.3-INTERNAL-SNAPSHOT
• 22ebee1 Add commercial release CI files [skip actions]
• 3c1c981 Merge pull request #534 from spring-cloud/dependabot/npm_and_yarn/docs/main/s...
• b79bd77 Bump @​springio/antora-extensions from 1.14.12 to 1.14.13 in /docs
• 65eb111 Use canonical deploy-docs trigger workflow [skip actions]
• 7501938 Merge pull request #532 from spring-cloud/dependabot/maven/main/com.github.jk...
• e3b2779 Merge pull request #533 from spring-cloud/dependabot/maven/com.github.jknack-...
• 791fbef Bump com.github.jknack:handlebars from 4.5.3 to 4.5.4
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.