In Optimize 7, exclude Spring beans dependency from process engine

[yanavasileva]

Context

• Optimize 7 (3.12-3.15) has transitive dependency to Spring 5 via Camunda engine (7.20-7.22).
• Spring 5 is end of life.
• Optimize 7 doesn't use the Spring beans transitive dependency, it has its own dependency to Spring Framework 6.
• Scanner reports of users detect the transitive dependencies as vulnerable.

Acceptance Criteria (Required on creation)

• Exclude Spring beans dependency from Camunda 7 engine similar to feel engine and commons logging.

Hints

• Test PR: https://github.com/camunda/camunda-optimize/pull/15681
• Workaround: Override the Spring version to 6.1.15+

Links

• https://jira.camunda.com/browse/SUPPORT-26129
• https://github.com/camunda/camunda-optimize/blob/4111c215e38492acd5e5afa8ef296494bcda4f0c/optimize/backend/pom.xml#L60-L74

Breakdown

Pull Requests

Preview Give feedback

No tasks being tracked yet.

Dev2QA handover

• Does this ticket need a QA test and the testing goals are not clear from the description? Add a Dev2QA handover comment