Updated Spring Framework and JSON-Java

Update dependencies too. mitigate reported CVEs:

(CMS-22951)

Fixed bug that caused CAE Feeder repeated re-indexing for contents with blobs in structs

Fixed a bug, that caused the CAE Feeder to repeatedly re-index contents (by default every 12 hours), for contents that contain blobs in struct properties. The bug caused the recording of a "time dependency" when such a content was loaded, and this led to later invalidations and re-indexing of that content, even if those structs and contained blob values were not used during feeding.

The fix avoids recording such unneeded time dependencies. Note, that even with the fix, contents may still be re-indexed once, because time dependencies may still be present in the CAE Feeder database and won't be removed before the content is re-indexed.

(CMS-22915)

Synchronization: CopyOver Merge Strategy Hardened

The CopyOver merge strategy of the synchronization workflow has been hardened regarding its auto-merge behavior. Previously, it had the same strong demands on the base version of a master (also-known-as latest translated/synchronized version) as the related translation workflow.

As the base version is irrelevant in copy-over context, this evaluation path is now skipped for CopyOver workflow.

Along with that, debug logging has been enhanced, to report more details such as for logger com.coremedia.translate.workflow.AutoMergeTranslationAction , where you may see more details, when link redirection fails, which may cause subsequent issues.

(CMS-22882)

Updated (embedded) Tomcat to 9.0.73

Embedded Tomcat has been updated to version 9.0.73 (see Changelog Tomcat 9.0.73 and predecessors) to prevent known vulnerabilities.

(CMS-22877)

Updated Spring Framework to 5.2.23.RELEASE

Updated Spring Framework from 5.2.22.RELEASE to 5.2.23.RELEASE in order to mitigate CVE-2023-20861.

(CMS-22846)

Fixed Localization Workflows to not Copy the Home Page Segment to Derived Sites

Previously, Translation and Synchronization workflows tried to copy changes of the segment field of the master site's root page (aka home page) to derived sites, as part of the auto-merge functionality. This has been fixed now, and changes to the root page segment are no longer copied to derived sites. The behavior hasn't changed for child pages.

Home pages of different sites must have different values in the segment property. Because of that, it was a bug to copy the value of a master site to derived sites. Furthermore, a change of the segment in the master site caused problems in workflows: Translation workflows showed a warning about a merge conflict, synchronization workflows with conflict resolution "Manual" failed completely (escalated) and had to be aborted, and synchronization workflows with conflict resolution "Overwrite Target Site" overwrote the root segment of derived sites, which caused an illegal content state because root segments must differ between sites.

The Blueprint configuration for the Spring beans defaultAutoMergePredicateFactory and allMergeablePropertiesPredicateFactory was changed now to exclude the root channel segment from auto-merge. These beans are defined in Blueprint class com.coremedia.blueprint.workflow.boot.BlueprintWorkflowServerAutoConfiguration .

(CMS-18204)