From e51ab0136cc25dc9d531ed13d6417694707973be Mon Sep 17 00:00:00 2001
From: art <artbiit@naver.com>
Date: Mon, 29 Jun 2026 19:10:42 +0900
Subject: [PATCH] =?UTF-8?q?chore(deps):=20Spring=20Boot=203.5.16=20?=
 =?UTF-8?q?=EA=B3=A0=EC=A0=95=20+=20=EC=84=B8=EC=85=98=EC=BF=A0=ED=82=A4?=
 =?UTF-8?q?=C2=B7=EB=A1=9C=EA=B7=B8=20=ED=95=98=EB=93=9C=EB=8B=9D=20+=20OW?=
 =?UTF-8?q?ASP=20DC?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- spring-boot 3.5.14-SNAPSHOT → 3.5.16(GA), spring-snapshots repo/pluginRepo 제거
- OWASP dependency-check-maven 12.2.2 plugin(executions 없음=빌드 phase 비bind)
- 세션쿠키: base http-only=true·same-site=lax / application-live.properties secure=true
- MyBatis 로그 TRACE→WARN(base), application-dev.properties 만 TRACE

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01K3FeMrbtxfTScjrwUukyHD
---
 pom.xml                                       | 33 +++++++------------
 src/main/resources/application-dev.properties |  3 ++
 .../resources/application-live.properties     |  3 ++
 src/main/resources/application.properties     |  6 +++-
 4 files changed, 23 insertions(+), 22 deletions(-)
 create mode 100644 src/main/resources/application-dev.properties
 create mode 100644 src/main/resources/application-live.properties

diff --git a/pom.xml b/pom.xml
index c135592..aafe34c 100644
--- a/pom.xml
+++ b/pom.xml
@@ -26,7 +26,7 @@
         <maven.compiler.release>${java.version}</maven.compiler.release>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
-        <spring-boot.version>3.5.14-SNAPSHOT</spring-boot.version>
+        <spring-boot.version>3.5.16</spring-boot.version>
         <mybatis-spring-boot.version>3.0.5</mybatis-spring-boot.version>
         <lombok.version>1.18.44</lombok.version>
         <maven-clean-plugin.version>3.4.1</maven-clean-plugin.version>
@@ -205,28 +205,19 @@
                     </execution>
                 </executions>
             </plugin>
+            <plugin>
+                <groupId>org.owasp</groupId>
+                <artifactId>dependency-check-maven</artifactId>
+                <version>12.2.2</version>
+                <configuration>
+                    <autoUpdate>false</autoUpdate>
+                    <failBuildOnCVSS>7</failBuildOnCVSS>
+                    <skipProvidedScope>true</skipProvidedScope>
+                </configuration>
+            </plugin>
         </plugins>
     </build>
-    <repositories>
-        <repository>
-            <id>spring-snapshots</id>
-            <name>Spring Snapshots</name>
-            <url>https://repo.spring.io/snapshot</url>
-            <releases>
-                <enabled>false</enabled>
-            </releases>
-        </repository>
-    </repositories>
-    <pluginRepositories>
-        <pluginRepository>
-            <id>spring-snapshots</id>
-            <name>Spring Snapshots</name>
-            <url>https://repo.spring.io/snapshot</url>
-            <releases>
-                <enabled>false</enabled>
-            </releases>
-        </pluginRepository>
-    </pluginRepositories>
+
 
     <profiles>
         <profile>
diff --git a/src/main/resources/application-dev.properties b/src/main/resources/application-dev.properties
new file mode 100644
index 0000000..074828d
--- /dev/null
+++ b/src/main/resources/application-dev.properties
@@ -0,0 +1,3 @@
+# dev 전용 오버라이드 (spring.profiles.active=dev 시 자동 로드)
+# MyBatis SQL/파라미터 디버깅 — dev 한정
+logging.level.org.apache.ibatis=TRACE
diff --git a/src/main/resources/application-live.properties b/src/main/resources/application-live.properties
new file mode 100644
index 0000000..250a8d6
--- /dev/null
+++ b/src/main/resources/application-live.properties
@@ -0,0 +1,3 @@
+# live(운영) 전용 오버라이드 (spring.profiles.active=live 시 자동 로드)
+# HTTPS 운영 — 세션 쿠키 Secure 강제
+server.servlet.session.cookie.secure=true
diff --git a/src/main/resources/application.properties b/src/main/resources/application.properties
index 3207daa..524b0b2 100644
--- a/src/main/resources/application.properties
+++ b/src/main/resources/application.properties
@@ -25,6 +25,10 @@ app.webgl.frame-ancestors=self
 # upload storage (static 트리 밖 — 웹서버 직접 서빙 차단, 컨트롤러 권한게이트 경유)
 app.upload.game-storage-path=${user.home}/.bibimbap/uploads
 
+# session cookie hardening
+server.servlet.session.cookie.http-only=true
+server.servlet.session.cookie.same-site=lax
+
 # log
 mybatis.configuration.log-impl=org.apache.ibatis.logging.slf4j.Slf4jImpl
-logging.level.org.apache.ibatis=TRACE
+logging.level.org.apache.ibatis=WARN