Pedestal 0.6.5

Apply the Clojure 1.12 prompt and its Java 25 baseline first. These rules cover Pedestal 0.6.5's javax.servlet service, Ring 1.10.0 adapters, Jetty 9 connector, SSE, and Jetty-specific WebSockets. Use http for io.pedestal.http and route for io.pedestal.http.route in the configuration keys below.

Release and dependency boundary

• Keep every Pedestal module on one release and move them together while applying compatible dependency security fixes. Check the Commons FileUpload each connector resolves: the service module declares a release with the configurable part-header limit for CVE-2025-48976, the Immutant module still declares 1.5, which predates it, and alternative connectors have their own dependency trees. The multipart part-count and total-body limits below bound that header memory on any FileUpload release.
• Treat Java 11 and Servlet 3.1 as this release's documented compatibility floors. Explicitly select and compatibility-test Clojure 1.12/Java 25; the published modules declare Clojure 1.11.4. Do not mix javax.servlet and Jakarta servlet APIs.
• Don't treat Pedestal's release as proof that its Jetty is patched. Pedestal 0.6.5 bundles Jetty 9.4.58.v20250814, the last Jetty 9.4 release on Maven Central; Jetty 9.4 is end of life, and its later security builds come only from lifecycle-support suppliers. That bundled release is inside the affected ranges of Jetty's HTTP/1.1 chunk-extension request-smuggling advisories and its HTTP/2 reset/GOAWAY thread-exhaustion advisory, so before production use replace the Jetty modules with a supplier's compatible