Ring 1.15

Apply the Clojure 1.12 prompt and its Java 25 baseline first. These rules cover Ring 1.15 core and its Jetty adapter, and were checked against 1.15.5. Ring's upstream minimums are Clojure 1.9.0, Java 11 for core, and Java 17 for the Jetty adapter; these rules target Clojure 1.12 on Java 25. Optional middleware guidance targets Ring-Defaults 0.7.1, Ring-Anti-Forgery 1.4.0, Ring-SSL 0.4.0, and Ring-Headers 0.4.0.

Version and dependency boundaries

• Keep every Ring artifact on the same release and check the resolved dependency graph, including Ring-Defaults, for an older ring/ring-core selected transitively.
• Don't treat the Ring release as proof that its Jetty is patched: ring-jetty-adapter 1.15.5 declares a Jetty 12.1 release inside the affected ranges of Jetty's 2026 path-parameter, authority, trailer, Digest, WebSocket-opcode, chunk-extension, and HTTP/2 reset advisories. Check the resolved Jetty modules against Jetty's security page or a scanner run of the resolved tree, override them as one aligned Jetty 12.1 set that the advisories list as fixed, and test the EE9 servlet and WebSocket integration. Ring's own patch does not fix Jetty's path handling, trailer leakage, WebSocket allocation, or HTTP parser vulnerabilities.
• Keep HTTP parsing strict when customizing Jetty through :configurator; do not relax compliance to accept malformed chunk extensions. WebSocket message limits do not replace the Jetty parser fix, and HTTP/2 advisory coverage is necessary if custom connectors enable HTTP/2, which this adapter does not configure by default.
• Authorize in the