Pedestal 0.7.2

Apply the Clojure 1.12 prompt first. These rules cover Pedestal 0.7.2, Jakarta Servlet 5.0, the Jetty 11 adapter, and Jakarta WebSocket 2.0. Upstream documents Clojure 1.10+ and Java 11+ compatibility; test the Clojure 1.12 and Java 25 baseline with the deployed dependencies.

Release and dependency boundary

• Keep every Pedestal module on the same release and inspect the resolved dependency graph. Override the published Clojure 1.11.2 dependency deliberately when applying the included baseline; keep servlet integrations on jakarta.servlet and remove dependencies on the old Jetty-specific WebSocket API.
• Don't treat Pedestal's release as proof that its Jetty is patched. Pedestal 0.7.2 declares a Jetty 11 release inside the affected ranges of Jetty's HTTP/2 reset, HTTP/2 authority, chunk-extension request-smuggling, and WebSocket reserved-opcode advisories, and Jetty 11 is end of life: new Jetty 11 security builds come through lifecycle-support suppliers rather than Maven Central. Before production exposure, replace the Jetty modules with a supported supplier's compatible Jetty 11 security build that carries the fixes those advisories list, or migrate the whole Pedestal/container integration to a maintained line; substituting Jetty 12 JARs is not a drop-in adapter upgrade.
• Check the transitive Ring and commons-fileupload2-core against their advisories or a scanner run of the resolved tree too. The FileUpload milestone that Pedestal 0.7.2 brings in is inside the affected range of the multipart part-header denial-of-service advisory, and its Ring predates Ring's