INS-1644 CVE Fixes#166
Conversation
- spring-boot from 3.4.5 to 3.5.14 - io.netty_netty-codec from 4.1.125.Final to 4.1.133.Final - org.apache.logging.log4j_log4j-core from 2.25.3 to 2.25.4 - spring-webmvc from 6.2.17 to 6.2.18
amattu2
temporarily deployed
to
ccdi-manager-nonprod
GitHub Actions
Inactive
Not up to standards ⛔
|
There was a problem hiding this comment.
Pull request overview
Routine CVE remediation PR that bumps several dependency and runtime versions. Spring Boot parent goes from 3.4.5 to 3.5.14, Spring Framework override from 6.2.17 to 6.2.18, Netty 4.1.125→4.1.133, Log4j 2.25.3→2.25.4, embedded Tomcat 11.0.21→11.0.22 (matching the Tomcat base image), and Spring REST Docs 3.0.3→3.0.5. The explicit version on spring-boot-starter-log4j2 is removed so it inherits from the (now newer) parent.
Changes:
- Upgrade Spring Boot parent to 3.5.14 and align Spring Framework, REST Docs, Log4j, Netty, and embedded Tomcat versions for CVE fixes.
- Drop the hardcoded version on
spring-boot-starter-log4j2, deferring to the Spring Boot parent BOM. - Bump the Tomcat runtime base image to
tomcat:11.0.22-jdk17to match the embedded Tomcat dependency.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| pom.xml | Version bumps for Spring Boot parent, Spring Framework, REST Docs, Log4j, Netty, and embedded Tomcat; removes explicit version on spring-boot-starter-log4j2. |
| Dockerfile | Updates Tomcat base image from 11.0.21-jdk17 to 11.0.22-jdk17. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Overview
N/A
Change Details (Specifics)
N/A
Related Ticket(s)
INS-1644 (Task)