chore(v0.1.25.41): SB 3.5.14, drop tomcat override, align Jedis to 6.2.0 (#147)

Mirrors the dependency hygiene done in cycles-server-events v0.1.25.12
and cycles-server v0.1.25.18, keeping the three Cycles services on the
same Spring Boot patch and the same Redis client major.

- spring-boot-starter-parent 3.5.13 -> 3.5.14 (security + bug fixes)
- Drop <tomcat.version>10.1.54</tomcat.version> override -- SB 3.5.14's
  BOM now manages 10.1.54 directly (verified against
  spring-boot-dependencies-3.5.14.pom). Same effective Tomcat version,
  smaller pom diff for future SB bumps.
- Jedis 5.2.0 -> 6.2.0 (major) to align with events (6.2.0) and server
  (6.2.0 in v0.1.25.18). Jedis 6.1.0 explicitly restored binary
  compatibility for SetParams (#4225 upstream). mvn verify: 782/782
  tests pass.
- Bump revision 0.1.25.40 -> 0.1.25.41.
- commons-lang3 3.18.0 override retained -- SB 3.5.14's BOM still
  manages 3.17.0 (CVE-2025-48924 unfixed there). Comment updated to
  reference SB 3.5.14.

No code changes; all 782 tests pass.

Author: amavashev

AUDIT.md

@@ -1,9 +1,9 @@
-# Complete Budget Governance v0.1.25.40 — Admin Server Audit
+# Complete Budget Governance v0.1.25.41 — Admin Server Audit
 
-**Server version:** 0.1.25.40 (2026-04-23 — same-release hygiene sweep on v0.1.25.39 webhook lifecycle emits: single-op actor now populates `keyId` from `authenticated_key_id` matching bulk-path parity (B1); `changed_fields` is now a real diff vs prior snapshot instead of request-presence so identity-PATCHes emit empty changed_fields and full-identity PATCHes suppress emit entirely per spec v0.1.25.33 §6281 (B2/B3); `"no-req"` literal correlation-id fallback replaced with `req_<uuid>` to preserve uniqueness under misconfigured RequestIdFilter (B4); no wire/spec surface change), 0.1.25.39 (2026-04-23 — spec v0.1.25.33 webhook lifecycle events: `createWebhookSubscription` / `updateWebhookSubscription` / `deleteWebhookSubscription` + `bulkActionWebhooks` (PAUSE/RESUME/DELETE) now emit matching `webhook.created` / `webhook.updated` / `webhook.paused` / `webhook.resumed` / `webhook.deleted` Events with new `EventDataWebhookLifecycle` payload; closes the operator-observability blind spot that v0.1.25.38 explicitly deferred on grounds that the EventType kinds didn't exist yet; v0.1.25.38.1 baseline: hygiene-only sweep with actor-type symmetry, payload captor assertions, README catalog backfill)
+**Server version:** 0.1.25.41 (2026-04-26 — dependency hygiene matching `cycles-server-events` v0.1.25.12 and `cycles-server` v0.1.25.18: bump `spring-boot-starter-parent` 3.5.13 → 3.5.14 (patch with upstream security hardening — constant-time DevTools secret comparison, `RandomValuePropertySource` SecureRandom, consistent SSL hostname verification, symlink-handling fixes); **drop `<tomcat.version>10.1.54</tomcat.version>` override** since SB 3.5.14's BOM now manages 10.1.54 directly (verified against `spring-boot-dependencies-3.5.14.pom`); commons-lang3 3.18.0 override retained — SB 3.5.14's BOM still manages 3.17.0. **Jedis 5.2.0 → 6.2.0** to align all three services on the same Redis client major (events at 6.2.0 since v0.1.25.12, server at 6.2.0 in v0.1.25.18); all call sites use stable APIs — Jedis 6.1.0 explicitly restored binary compatibility for `SetParams` (#4225 upstream). No code changes; all 782 tests pass.), 0.1.25.40 (2026-04-23 — same-release hygiene sweep on v0.1.25.39 webhook lifecycle emits: single-op actor now populates `keyId` from `authenticated_key_id` matching bulk-path parity (B1); `changed_fields` is now a real diff vs prior snapshot instead of request-presence so identity-PATCHes emit empty changed_fields and full-identity PATCHes suppress emit entirely per spec v0.1.25.33 §6281 (B2/B3); `"no-req"` literal correlation-id fallback replaced with `req_<uuid>` to preserve uniqueness under misconfigured RequestIdFilter (B4); no wire/spec surface change), 0.1.25.39 (2026-04-23 — spec v0.1.25.33 webhook lifecycle events: `createWebhookSubscription` / `updateWebhookSubscription` / `deleteWebhookSubscription` + `bulkActionWebhooks` (PAUSE/RESUME/DELETE) now emit matching `webhook.created` / `webhook.updated` / `webhook.paused` / `webhook.resumed` / `webhook.deleted` Events with new `EventDataWebhookLifecycle` payload; closes the operator-observability blind spot that v0.1.25.38 explicitly deferred on grounds that the EventType kinds didn't exist yet; v0.1.25.38.1 baseline: hygiene-only sweep with actor-type symmetry, payload captor assertions, README catalog backfill)
 **Date:** 2026-04-23 (v0.1.25.40 webhook-emit hygiene: actor key_id parity, diff-based changed_fields, UUID correlation-id fallback), 2026-04-22 (v0.1.25.38 bulk-action event parity: per-row Events on budget + tenant bulk paths), 2026-04-21 (v0.1.25.37 Rule 1(c) bounded-convergence: PATCH /tenants/{id} and bulk-action CLOSE re-run cascade on already-CLOSED tenants for straggler convergence), 2026-04-20 (v0.1.25.36 Rule 2 guard expansion: policies + api-keys + webhook-admin create/update/delete/test/replay + budgets and webhooks bulk-action per-row + webhook-tenant delete/test), 2026-04-20 (v0.1.25.35 cascade + TENANT_CLOSED guard), 2026-04-19 (v0.1.25.34 commons-lang3 CVE pin), 2026-04-19 (v0.1.25.33 Spring Boot / Tomcat CVE bump), 2026-04-18 (v0.1.25.32 cross-plane read tolerance hardening), 2026-04-18 (v0.1.25.31 trace_id cross-surface correlation), 2026-04-18 (v0.1.25.30 bulk-action audit enrichment), 2026-04-18 (v0.1.25.29 budget bulk-action), 2026-04-17 (v0.1.25.28 audit sentinel split), 2026-04-17 (v0.1.25.27 audit filter DSL upgrade), 2026-04-17 (v0.1.25.26 bulk-action endpoints), 2026-04-17 (v0.1.25.25 search on six list endpoints), 2026-04-16 (v0.1.25.24 server-side sort — six admin list endpoints), 2026-04-16 (v0.1.25.23 BudgetLedger tenant_id on wire), 2026-04-16 (v0.1.25.22 cross-tenant list + filters), 2026-04-16 (v0.1.25.21 nightly CI), 2026-04-16 (v0.1.25.20 audit-on-failure), 2026-04-16 (v0.1.25.19 introspect dual-auth + operator docs), 2026-04-15 (v0.1.25.18 RESET_SPENT operation), 2026-04-14 (v0.1.25.17 cjson round-trip sweep: apikey + policy + tenant), 2026-04-13 (v0.1.25.16 webhooks dual-auth), 2026-04-13 (v0.1.25.15 ScopeValidator), 2026-04-13 (v0.1.25.14 admin-on-behalf-of dual-auth), 2026-04-13 (v0.1.25.13 CORS PUT fix), 2026-04-12 (v0.1.25.12 spec-compliance hardening + observability), 2026-04-12 (v0.1.25.11 contract-testing default ON), 2026-04-12 (v0.1.25.10 spec-compliance hardening), 2026-04-10 (v0.1.25.9 release), 2026-04-10 (CORS hardening + prod config), 2026-04-10 (observability: prometheus metrics + k8s probes), 2026-04-10 (v0.1.25.8 spec alignment), 2026-04-09 (v0.1.25.7 admin wildcard fallback), 2026-04-08 (v0.1.25.6 freeze/unfreeze + admin fund), 2026-04-08 (v0.1.25.5 dashboard support release), 2026-04-06 (v0.1.25.4 spec compliance + replay lock), 2026-04-01 (spec compliance review), 2026-04-01 (TTL retention + release prep), 2026-04-01 (integration audit + encryption), 2026-03-31 (v0.1.25 Pillar 4: Events & Webhooks spec), 2026-03-31 (dynamic version), 2026-03-24 (Round 6: spec compliance audit), 2026-03-24 (Round 5: pre-release audit), 2026-03-24 (v0.1.24 update), 2026-03-23 (updated), 2026-03-14 (initial)
 **Spec:** [`cycles-governance-admin-v0.1.25.yaml`](https://github.com/runcycles/cycles-protocol/blob/main/cycles-governance-admin-v0.1.25.yaml) (OpenAPI 3.1.0, info.version `0.1.25.34`; adds CASCADE SEMANTICS — Rule 1 `POST /admin/tenants/{id}` PATCH→CLOSED cascades owned budgets (→CLOSED), webhook subscriptions (→DISABLED), and API keys (→REVOKED) under a shared correlation_id — Rule 1 permits **Mode A (atomic)** or **Mode B (flip-first-with-guarded-cascade)** as of v0.1.25.31, and Rule 2 rejects any mutating operation against an object whose owning tenant is CLOSED with 409 `TENANT_CLOSED`; adds the `TENANT_CLOSED` error code to the shared enum and the four `*_via_tenant_cascade` event kinds: `budget.closed_via_tenant_cascade`, `webhook.disabled_via_tenant_cascade`, `api_key.revoked_via_tenant_cascade`, `reservation.released_via_tenant_cascade`; v0.1.25.32 adds per-row Event emission requirements to `bulkActionBudgets` + `bulkActionTenants`; v0.1.25.33 introduces six webhook lifecycle EventTypes (`webhook.created` / `.updated` / `.paused` / `.resumed` / `.disabled` / `.deleted`), an `EventDataWebhookLifecycle` schema, and documents per-row Event emission on `bulkActionWebhooks` + the three single-op webhook operations + the dispatcher auto-disable path; v0.1.25.34 closes a same-release enum gap by adding `webhook` to the `EventCategory` enum so Event responses carrying the new EventTypes validate) in [cycles-protocol](https://github.com/runcycles/cycles-protocol)
-**Server:** Spring Boot 3.5.13 / Java 21 / Redis · Tomcat 10.1.54 pin · commons-lang3 3.18.0 pin
+**Server:** Spring Boot 3.5.14 / Java 21 / Jedis 6.2.0 · commons-lang3 3.18.0 pin (SB 3.5.14 still manages 3.17.0)
 
 ### 2026-04-23 — v0.1.25.39: Webhook lifecycle events (spec v0.1.25.33)
 

CHANGELOG.md

@@ -14,6 +14,43 @@ changes to request/response bodies or Lua-script semantics would require a
 minor bump. Additive fields (new optional response fields, new enum values,
 new optional request fields) are **not** considered breaking.
 
+## [0.1.25.41] — 2026-04-26
+
+Dependency hygiene aligning all three Cycles services (events / server /
+admin) on the same Spring Boot patch and Redis client major. No code or
+wire-format changes — pom-only patch.
+
+### Changed
+
+- **Spring Boot 3.5.13 → 3.5.14.** Patch upgrade picking up upstream
+  security hardening (constant-time comparison for remote DevTools
+  secret, `RandomValuePropertySource` switched to `SecureRandom`,
+  hostname verification applied consistently for Cassandra/RabbitMQ
+  SSL) plus symlink-handling fixes in `ApplicationPidFileWriter` /
+  `ApplicationTemp`. Mirrors the events-server bump shipped in
+  `cycles-server-events` v0.1.25.12 and the protocol-server bump
+  shipped in `cycles-server` v0.1.25.18.
+- **Drop `<tomcat.version>10.1.54</tomcat.version>` override.** Spring
+  Boot 3.5.14's BOM now manages Tomcat 10.1.54 directly (verified
+  against `spring-boot-dependencies-3.5.14.pom`), so the explicit pin
+  added in v0.1.25.33 to close CVE-2026-34483 / CVE-2026-34487 is
+  redundant. Same effective Tomcat version, smaller pom diff for
+  future Spring Boot bumps.
+- **Jedis 5.2.0 → 6.2.0** (major). Aligns with `cycles-server-events`
+  (6.2.0 since v0.1.25.12) and `cycles-server` (6.2.0 in v0.1.25.18)
+  on a single Redis-client major across the fleet. Jedis 6.1.0
+  explicitly restored binary compatibility for `SetParams` (#4225
+  upstream); all call sites use stable APIs and all 782 tests pass
+  on 6.2.0.
+
+### Retained
+
+- `<commons-lang3.version>3.18.0</commons-lang3.version>` override
+  stays — Spring Boot 3.5.14's BOM still manages commons-lang3 at
+  3.17.0 (CVE-2025-48924 unfixed there), so the explicit 3.18.0 pin
+  added in v0.1.25.34 is still required. Override comment updated to
+  reference SB 3.5.14.
+
 ## [0.1.25.40] — 2026-04-23
 
 Post-review correctness pass on v0.1.25.39 webhook lifecycle Events. No new

cycles-admin-service/pom.xml

@@ -4,7 +4,7 @@
     <parent>
         <groupId>org.springframework.boot</groupId>
         <artifactId>spring-boot-starter-parent</artifactId>
-        <version>3.5.13</version>
+        <version>3.5.14</version>
     </parent>
     <groupId>io.runcycles</groupId>
     <artifactId>cycles-admin-service</artifactId>
@@ -18,16 +18,11 @@
         <module>cycles-admin-service-api</module>
     </modules>
     <properties>
-        <revision>0.1.25.40</revision>
+        <revision>0.1.25.41</revision>
         <java.version>21</java.version>
         <maven.compiler.source>21</maven.compiler.source>
         <maven.compiler.target>21</maven.compiler.target>
-        <!-- Override Spring Boot 3.5.13's managed tomcat 10.1.53 to pick up
-             CVE-2026-34483 (HIGH) and CVE-2026-34487 (HIGH) fixes which
-             landed in 10.1.54. Remove this override once Spring Boot 3.5.14
-             ships with 10.1.54+ as its managed version. -->
-        <tomcat.version>10.1.54</tomcat.version>
-        <!-- Override Spring Boot 3.5.13's managed commons-lang3 3.17.0 to pick
+        <!-- Override Spring Boot 3.5.14's managed commons-lang3 3.17.0 to pick
              up CVE-2025-48924 (Trivy HIGH) fix in 3.18.0. commons-lang3 enters
              the image transitively via swagger-core-jakarta (OpenAPI UI).
              Remove once Spring Boot ships with 3.18.0+ as its managed version. -->
@@ -38,7 +33,7 @@
             <dependency>
                 <groupId>redis.clients</groupId>
                 <artifactId>jedis</artifactId>
-                <version>5.2.0</version>
+                <version>6.2.0</version>
             </dependency>
             <dependency>
                 <groupId>org.springdoc</groupId>