Update dependency de.codecentric:spring-boot-admin-server to v2.7.16 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
de.codecentric:spring-boot-admin-server (source)	2.7.14 -> 2.7.16

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

GitHub Vulnerability Alerts

CVE-2023-38286

Thymeleaf through 3.1.1.RELEASE as used in spring-boot-admin (aka Spring Boot Admin) through 3.1.1 allows for a sandbox bypass via crafted HTML. This may be relevant for SSTI (Server Side Template Injection) and code execution in spring-boot-admin if MailNotifier is enabled and there is write access to environment variables via the UI.

Spring Boot Admin 3.1.2 and 2.7.16 contain mitigations for the issue. This bypass is achived via a library called Thymeleaf which has added counter measures for this sort of bypass in version 3.1.2.RELEASE which has explicity forbidden static access to org.springframework.util in expressions. Thymeleaf itself should not be considered vulnerable.

---

Release Notes

codecentric/spring-boot-admin (de.codecentric:spring-boot-admin-server)

v2.7.16

Compare Source

Grab the new version from Maven central https://repo1.maven.org/maven2/de/codecentric/

Current docs at https://codecentric.github.io/spring-boot-admin/2.7.16/

Things that changed in this release

• 3311e1b5 - fix(#​2615): reduce ssti vectors for thymeleaf (#​3378)
• 84d1e3ac - chore: update workflow
• 9d5bb429 - fix: regression issues
• 858e1edc - chore: merge 2.7.10 and 2.7.x-HEAD

v2.7.15

Compare Source

Grab the new version from Maven central https://repo1.maven.org/maven2/de/codecentric/

Current docs at https://codecentric.github.io/spring-boot-admin/2.7.15/

Things that changed in this release

• 84d1e3ac - chore: update workflow
• 9d5bb429 - fix: regression issues
• 858e1edc - chore: merge 2.7.10 and 2.7.x-HEAD

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.