Skip to content

Commit e64d2bc

Browse files
javier-aliagajavier-aliaga
authored
fix(deps): Upgrade dependencies to address critical CVEs (#1716)
* fix: bump jackson to 2.21.2 to address CVE (SNYK-JAVA-COMFASTERXMLJACKSONCORE-15907551) Upgrade jackson-bom from 2.16.2 to 2.21.2 to fix the high-severity Allocation of Resources Without Limits or Throttling vulnerability in jackson-core reported in #1714. Signed-off-by: Javier Aliaga <javier@diagrid.io> * fix(deps): upgrade dependencies to address multiple CVEs - Spring Boot 3.4.10 → 3.4.13 - Spring Framework 6.2.11 → 6.2.17 (CVE injection) - Jackson 3.x BOM 3.1.0 → 3.1.1 (SNYK-JAVA-TOOLSJACKSONCORE-15907550) - Logback 1.5.18 → 1.5.25 (SNYK-JAVA-CHQOSLOGBACK-13169722, -15062482) - Commons Compress 1.24.0 → 1.26.0 (SNYK-JAVA-ORGAPACHECOMMONS-6254296, -6254297) - Tomcat Embed 10.1.46 → 10.1.52 (SNYK-JAVA-ORGAPACHETOMCATEMBED-15307781, -15307822) Note: spring-boot-actuator auth bypass CVEs remain in example apps only — requires Spring Boot 3.5.x which is a breaking change. Signed-off-by: Javier Aliaga <javier@diagrid.io> * fix(deps): upgrade Spring Boot to 3.5.12 and remove redundant overrides Spring Boot 3.5.12 natively manages logback 1.5.32, tomcat 10.1.52, and spring-framework 6.2.17 — removing all manual overrides that are now unnecessary. This also resolves the spring-boot-actuator auth bypass CVEs that required SB 3.5.x. Only commons-compress 1.26.0 override remains (testcontainers transitive). Signed-off-by: Javier Aliaga <javier@diagrid.io> * chore(deps): remove unnecessary Jackson 3.x BOM overrides Only dapr-spring-boot-4-autoconfigure and spring-boot-4-examples actually use Jackson 3.x (tools.jackson.core). Removed the override from 4 modules that don't pull it in transitively. Signed-off-by: Javier Aliaga <javier@diagrid.io> * fix(deps): add commons-codec dependency for commons-compress 1.26.0 Commons-compress 1.26.0 declares commons-codec as optional, but testcontainers uses it at runtime causing ClassNotFoundException for org.apache.commons.codec.Charsets. Signed-off-by: Javier Aliaga <javier@diagrid.io> * fix(deps): add commons-codec as direct dependency in testcontainers-dapr The dependencyManagement entry alone doesn't pull in optional transitive deps. commons-codec must be declared as a direct dependency so it's available at runtime for commons-compress/testcontainers. Signed-off-by: Javier Aliaga <javier@diagrid.io> --------- Signed-off-by: Javier Aliaga <javier@diagrid.io>
1 parent 14c41cf commit e64d2bc

4 files changed

Lines changed: 39 additions & 5 deletions

File tree

‎dapr-spring/dapr-spring-boot-4-autoconfigure/pom.xml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,14 @@
2323

2424
<dependencyManagement>
2525
<dependencies>
26+
<!-- Override Jackson 3.x for CVE SNYK-JAVA-TOOLSJACKSONCORE-15907550 (must precede SB BOM) -->
27+
<dependency>
28+
<groupId>tools.jackson</groupId>
29+
<artifactId>jackson-bom</artifactId>
30+
<version>3.1.1</version>
31+
<type>pom</type>
32+
<scope>import</scope>
33+
</dependency>
2634
<dependency>
2735
<groupId>org.springframework.boot</groupId>
2836
<artifactId>spring-boot-dependencies</artifactId>

‎pom.xml‎

Lines changed: 18 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@
4242
<maven.compiler.target>11</maven.compiler.target>
4343
<maven.compiler.release>11</maven.compiler.release>
4444
<maven.deploy.skip>true</maven.deploy.skip>
45-
<jackson.version>2.18.6</jackson.version>
45+
<jackson.version>2.21.2</jackson.version>
4646
<gpg.skip>true</gpg.skip>
4747
<spotbugs.fail>true</spotbugs.fail>
4848
<spotbugs.exclude.filter.file>${maven.multiModuleProjectDirectory}/spotbugs-exclude.xml</spotbugs.exclude.filter.file>
@@ -52,10 +52,7 @@
5252
<junit-bom.version>5.11.4</junit-bom.version>
5353
<snakeyaml.version>2.0</snakeyaml.version>
5454
<testcontainers.version>1.21.4</testcontainers.version>
55-
<!-- Do NOT UPGRADE spring.version without checking springboot.version alignment -->
56-
<springboot.version>3.4.10</springboot.version>
57-
<springframework.version>6.2.11</springframework.version>
58-
<!-- Do NOT UPGRADE springframework.version without checking springboot.version alignment -->
55+
<springboot.version>3.5.12</springboot.version>
5956
<nexus-staging-maven-plugin.version>1.7.0</nexus-staging-maven-plugin.version>
6057
<assertj.version>3.27.7</assertj.version>
6158
<opentelemetry.version>1.41.0</opentelemetry.version>
@@ -84,6 +81,8 @@
8481
<rest-assured.version>5.5.1</rest-assured.version>
8582
<!-- TODO: Remove netty-bom override once gRPC ships with Netty >= 4.1.132 (CVE-2026-33871, CVE-2026-33870) -->
8683
<netty.version>4.1.132.Final</netty.version>
84+
<!-- TODO: Remove commons-compress override once testcontainers ships with >= 1.26.0 -->
85+
<commons-compress.version>1.26.0</commons-compress.version>
8786
</properties>
8887

8988
<distributionManagement>
@@ -164,6 +163,20 @@
164163
<scope>import</scope>
165164
</dependency>
166165

166+
<!-- ====================================================================== -->
167+
<!-- Security overrides - Transitive dependency version fixes for CVEs -->
168+
<!-- ====================================================================== -->
169+
<dependency>
170+
<groupId>org.apache.commons</groupId>
171+
<artifactId>commons-compress</artifactId>
172+
<version>${commons-compress.version}</version>
173+
</dependency>
174+
<dependency>
175+
<groupId>commons-codec</groupId>
176+
<artifactId>commons-codec</artifactId>
177+
<version>1.17.2</version>
178+
</dependency>
179+
167180
<!-- ====================================================================== -->
168181
<!-- Direct dependencies - Only versions not managed by BOMs above -->
169182
<!-- ====================================================================== -->

‎spring-boot-4-examples/pom.xml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,14 @@
2828

2929
<dependencyManagement>
3030
<dependencies>
31+
<!-- Override Jackson 3.x for CVE SNYK-JAVA-TOOLSJACKSONCORE-15907550 (must precede SB BOM) -->
32+
<dependency>
33+
<groupId>tools.jackson</groupId>
34+
<artifactId>jackson-bom</artifactId>
35+
<version>3.1.1</version>
36+
<type>pom</type>
37+
<scope>import</scope>
38+
</dependency>
3139
<dependency>
3240
<groupId>org.springframework.boot</groupId>
3341
<artifactId>spring-boot-dependencies</artifactId>

‎testcontainers-dapr/pom.xml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,11 @@
2424
<groupId>org.testcontainers</groupId>
2525
<artifactId>testcontainers</artifactId>
2626
</dependency>
27+
<!-- Required at runtime by commons-compress (optional transitive from testcontainers) -->
28+
<dependency>
29+
<groupId>commons-codec</groupId>
30+
<artifactId>commons-codec</artifactId>
31+
</dependency>
2732
<dependency>
2833
<groupId>com.fasterxml.jackson.core</groupId>
2934
<artifactId>jackson-databind</artifactId>

0 commit comments

Comments
 (0)