Skip to content

[MS-43510] remediate tomcat vulnerability

VidyaDharani Lokam requested to merge az/vl-update-corelib-azure into master
  • update spring-boot version to 3.3.1 to remediate tomcat vulnerability.
  • update core-lib-azure-spring6 to 0.27.0-rc3 and remove Duration bean as we are handling it from core-lib-azure-spring6.

mvn dependency:tree before changes:

[INFO] |  |  +- org.springframework.boot:spring-boot-starter-web:jar:3.2.5:compile
[INFO] |  |  |  +- org.springframework.boot:spring-boot-starter-json:jar:3.2.5:compile
[INFO] |  |  |  \- org.springframework.boot:spring-boot-starter-tomcat:jar:3.2.5:compile
[INFO] |  |  |     +- org.apache.tomcat.embed:tomcat-embed-core:jar:10.1.20:compile
[INFO] |  |  |     \- org.apache.tomcat.embed:tomcat-embed-websocket:jar:10.1.20:compile

mvn dependency:tree after changes:

[INFO] |  |  +- org.springframework.boot:spring-boot-starter-web:jar:3.3.1:compile
[INFO] |  |  |  +- org.springframework.boot:spring-boot-starter-json:jar:3.3.1:compile
[INFO] |  |  |  \- org.springframework.boot:spring-boot-starter-tomcat:jar:3.3.1:compile
[INFO] |  |  |     +- org.apache.tomcat.embed:tomcat-embed-core:jar:10.1.25:compile
[INFO] |  |  |     \- org.apache.tomcat.embed:tomcat-embed-websocket:jar:10.1.25:compile
Edited by VidyaDharani Lokam

Merge request reports