[bot] Merge 26.9 to develop

dependencyCheckSuppression.xml

@@ -544,4 +544,23 @@
         <cpe>cpe:/a:protobuf:protobuf</cpe>
     </suppress>
 
+    <!--
+    Azure Identity pulls in reactor-netty 1.2.18 which has DOS CVE-2026-47874. The Graph Email Transport isn't
+    deployed anywhere (yet) and medium-level DOS vulnerabilities have not been a big concern. Suppress for now,
+    until a newer Azure Identity that pulls in a fixed reactor-netty is available.
+    -->
+    <suppress>
+        <notes><![CDATA[
+    file name: reactor-netty-core-1.2.18.jar
+    ]]></notes>
+        <packageUrl regex="true">^pkg:maven/io\.projectreactor\.netty/reactor-netty-core@.*$</packageUrl>
+        <cpe>cpe:/a:pivotal:reactor_netty</cpe>
+    </suppress>
+    <suppress>
+        <notes><![CDATA[
+    file name: reactor-netty-http-1.2.18.jar
+    ]]></notes>
+        <packageUrl regex="true">^pkg:maven/io\.projectreactor\.netty/reactor-netty-http@.*$</packageUrl>
+        <cpe>cpe:/a:pivotal:reactor_netty</cpe>
+    </suppress>
 </suppressions>

gradle.properties

@@ -175,7 +175,7 @@ grpcVersion=1.83.1
 # "java.lang.NoSuchMethodError: 'void com.google.gson.internal.ConstructorConstructor.<init>(java.util.Map)'" errors
 gsonVersion=2.8.9
 
-guavaVersion=33.6.0-jre
+guavaVersion=33.7.1-jre
 
 # force hadoop-hdfs-client for CVE-2021-37404, CVE-2022-25168, CVE-2022-26612, CVE-2021-25642, CVE-2021-33036, CVE-2023-26031,
 hadoopHdfsClientVersion=3.4.1
@@ -308,8 +308,8 @@ snappyJavaVersion=1.1.10.8
 # Also, update apacheTomcatVersion above to match Spring Boot's Tomcat dependency version
 springBootVersion=4.1.0
 # This usually matches the Spring Framework version dictated by springBootVersion
-springVersion=7.0.8
-springAiVersion=2.0.0
+springVersion=7.0.9
+springAiVersion=2.0.1
 
 sqliteJdbcVersion=3.53.2.1
 

server/configs/application.properties

@@ -120,6 +120,19 @@ mail.smtpUser=@@smtpUser@@
 # HTTP session timeout for users - defaults to 30 minutes
 #server.servlet.session.timeout=30m
 
+# SAML IdPs return authentication assertions via a cross-site POST. Without an explicit SameSite value,
+# Chromium-based browsers treat JSESSIONID as Lax and withhold it from that POST, except during a grace period
+# covering cookies less than two minutes old. Reauthentication deliberately never replaces the session -- the
+# signed-in session is what it verifies against -- so the cookie only ages, and any reauthentication more
+# than a couple of minutes after sign-in arrives with no session cookie. That fails two ways: the server sees
+# a guest on that request and rejects the reauthentication, and the response mints a guest session whose
+# Set-Cookie overwrites the signed-in JSESSIONID, logging the user out. SameSite=None
+# keeps the session attached to the callback and is only honored on Secure cookies,
+# so this requires HTTPS.
+#server.servlet.session.cookie.same-site=none
+#server.servlet.session.cookie.secure=true
+#server.servlet.session.cookie.http-only=true
+
 ## Turn on JSON-formatted HTTP access logging to stdout. See issue 48565
 ## https://tomcat.apache.org/tomcat-9.0-doc/config/valve.html#JSON_Access_Log_Valve
 #jsonaccesslog.enabled=true