[vendrov]

Describe what this PR does / why we need it

Bumps spring.boot.version in sentinel-dashboard/pom.xml from 2.5.12 to 2.5.15, the last 2.5.x release. This moves the dashboard's Spring Boot stack together (no single library pinned), which updates Spring Framework 5.3.18 -> 5.3.27, Tomcat 9.0.60 -> 9.0.75, Jackson 2.12.6.1 -> 2.12.7.1 and Logback 1.2.11 -> 1.2.12, and addresses the advisories listed in the issue (CVE-2023-20860, CVE-2023-20883, CVE-2022-22970, CVE-2022-22968, CVE-2023-20863, CVE-2023-20861, CVE-2022-42252, CVE-2022-45143, CVE-2023-24998, CVE-2022-42003, CVE-2022-42004). Java 8 support is unchanged.

Does this pull request fix one issue?

Fixes #3672

Describe how you did it

One property change. spring.boot.version is defined and used only in sentinel-dashboard/pom.xml, so no other module is affected (the demos have their own property).

Describe how to verify it

What was run on the 1.8 branch at a3f40ba, before and after the change:

• mvn -pl sentinel-dashboard -am install -DskipTests: builds.
• mvn -pl sentinel-dashboard dependency:list -DincludeScope=runtime: only version changes (Spring Boot, Spring Framework, Tomcat, Jackson, Logback), nothing added or removed.
• Dashboard unit tests: 24 tests, identical results per class before and after (20 pass; 2 failures in JsonSerializeTest and 2 errors in DashboardConfigTest exist on 1.8 already). Note: these JUnit 4 tests only run with the JUnit vintage engine on the test classpath, which sentinel-dashboard does not declare, so mvn test currently runs 0 of them; the engine was added locally for this check only and is not part of this PR.
• Runtime: the original jar (twice, as a noise baseline) and the bumped jar started side by side on Java 8 (1.8.0_452) and Java 17 (17.0.15), and 22 read-only GET requests (/, /version, /app/*, /registry/machine, rule and metric list endpoints, gateway endpoints) sent to each: same HTTP status for every request, and identical response bodies apart from the timestamp field of error responses.

Special notes for reviews

• Not a complete fix: later advisories for Tomcat 9.0.x, Spring Framework 5.3.x and Spring Boot need versions outside the 2.5 line (for example Tomcat >= 9.0.99, which on Java 17 also needs --add-opens java.base/java.io=ALL-UNNAMED to start, or Spring Boot 2.7/3.x). Kept out of this PR on purpose.
• Found and checked with an automated dependency scanner and an AI assistant; the change and the results above were reviewed by me.

[CLAassistant]

All committers have signed the CLA.