How are you managing Spring CVEs and the ongoing upgrade churn?
I've been reading about the unusually large Spring security patch effort and wanted to compare how others are handling Spring-related CVEs. Are you mostly upgrading dependencies as fixes…