The jira macro install the vulnerable dependency spring-core 5.3.25

spring-core 5.3.25 dependency is attached to a CVE. See https://spring.io/security/cve-2025-41249 for the CVE.

No fixed version is available publicly for 5.3.45 (public versions stop at 5.3.39) and the first available public version which is fixed is 6.2.11. So it will probably require an upgrade of the jira REST API (which seems to be lacking pretty far behind, so it would not be a bad idea anyway).