Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix CVEs for Spring Boot 3 #297

Merged
merged 2 commits into from
Aug 3, 2023
Merged

Fix CVEs for Spring Boot 3 #297

merged 2 commits into from
Aug 3, 2023

Conversation

JoergSiebahn
Copy link
Contributor

No description provided.

@JoergSiebahn JoergSiebahn requested a review from a team August 3, 2023 14:41
JoergSiebahn
JoergSiebahn commented Aug 3, 2023
View reviewed changes
sda-commons-dependencies/build.gradle Outdated
Comment on lines 49 to 50
api 'org.yaml:snakeyaml:2.0', {
because 'fix CVE-2022-25857'
}
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The next Spring Boot Minor Version 3.2.x will upgrade Snakeyaml for us. The deleted test indicates, that Spring itself should not have an issue with the new version. According to this comment it should be safe if we only use application.properties. However, I've seen some closed issues of (unclear) transitive libraries or custom code of the issuer that failed. Should we try to force the update and see what happens or should we wait?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since we are busy with the migration, I would just accept this and then when renovate update to the new version we can check if the problem still exists

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@preethivenkatesh-sdase fyi

@JoergSiebahn JoergSiebahn force-pushed the plp-1057/fix-cves-for-spring-boot-3 branch from 5248c2f to c59e9f2 Compare August 3, 2023 14:53
@JoergSiebahn JoergSiebahn marked this pull request as ready for review August 3, 2023 15:11
@sonarcloud
Copy link

sonarcloud bot commented Aug 3, 2023

Kudos, SonarCloud Quality Gate passed!    Quality Gate passed

Bug A 0 Bugs
Vulnerability A 0 Vulnerabilities
Security Hotspot A 0 Security Hotspots
Code Smell A 12 Code Smells

93.3% 93.3% Coverage
0.0% 0.0% Duplication

@JoergSiebahn JoergSiebahn merged commit 2be733b into spring-boot-3 Aug 3, 2023
5 of 7 checks passed
@JoergSiebahn JoergSiebahn deleted the plp-1057/fix-cves-for-spring-boot-3 branch August 3, 2023 15:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@elbiocaetano elbiocaetano elbiocaetano left review comments

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@JoergSiebahn @elbiocaetano