diff --git a/framework-platform/framework-platform.gradle b/framework-platform/framework-platform.gradle
index 30a3bfe2f7..8da1e42d4b 100644
--- a/framework-platform/framework-platform.gradle
+++ b/framework-platform/framework-platform.gradle
@@ -9,7 +9,7 @@ javaPlatform {
 dependencies {
 	api(platform("com.fasterxml.jackson:jackson-bom:2.15.2"))
 	api(platform("io.micrometer:micrometer-bom:1.12.0-M1"))
-	api(platform("io.netty:netty-bom:4.1.95.Final"))
+	api(platform("io.netty:netty-bom:4.1.96.Final"))
 	api(platform("io.netty:netty5-bom:5.0.0.Alpha5"))
 	api(platform("io.projectreactor:reactor-bom:2023.0.0-M1"))
 	api(platform("io.rsocket:rsocket-bom:1.1.3"))
diff --git a/spring-web/spring-web.gradle b/spring-web/spring-web.gradle
index 098b18c0a6..8f74029c8c 100644
--- a/spring-web/spring-web.gradle
+++ b/spring-web/spring-web.gradle
@@ -11,7 +11,6 @@ dependencies {
 	optional(project(":spring-aop"))
 	optional(project(":spring-context"))
 	optional(project(":spring-oxm"))
-	optional("com.fasterxml:aalto-xml")
 	optional("com.fasterxml.jackson.core:jackson-databind")
 	optional("com.fasterxml.jackson.dataformat:jackson-dataformat-cbor")
 	optional("com.fasterxml.jackson.dataformat:jackson-dataformat-smile")
@@ -65,6 +64,7 @@ dependencies {
 	optional("org.jetbrains.kotlinx:kotlinx-serialization-cbor")
 	optional("org.jetbrains.kotlinx:kotlinx-serialization-json")
 	optional("org.jetbrains.kotlinx:kotlinx-serialization-protobuf")
+	optional("com.fasterxml:aalto-xml")  // out of order to avoid XML parser override
 	testFixturesApi("jakarta.servlet:jakarta.servlet-api")
 	testFixturesApi("org.junit.jupiter:junit-jupiter-api")
 	testFixturesApi("org.junit.jupiter:junit-jupiter-params")