Skip to content

[MS-39466] fix high vulnerabilities in azure and core

VidyaDharani Lokam requested to merge az/vl-fix-high-vul into master

Reference Issues:

Changes:

  • update os-core-common-spring6 to 0.27.0-rc1
  • update core-lib-azure-spring6 to 0.27.0-rc2
  • update spring-boot to 3.2.5 to remediate spring-web vulnerability
  • remove unused cobertura-maven-plugin to remediate transitive dependencies - plexus-utils, xercesImpl, maven-core, apache.velocity, jdom

mvn dependency:tree before changes for crs-catalog-service:

[INFO] |  |  +- org.springframework.boot:spring-boot-starter-json:jar:3.2.4:compile
[INFO] |  |  +- org.springframework.boot:spring-boot-starter-tomcat:jar:3.2.4:compile
[INFO] |  |  |  +- org.apache.tomcat.embed:tomcat-embed-core:jar:10.1.19:compile
[INFO] |  |  |  \- org.apache.tomcat.embed:tomcat-embed-websocket:jar:10.1.19:compile
[INFO] |  |  \- org.springframework:spring-web:jar:6.1.5:compile

mvn dependency:tree after changes for crs-catalog-service:

[INFO] |  |  \- org.springframework:spring-webmvc:jar:6.1.6:compile
[INFO] |  |     +- org.springframework:spring-aop:jar:6.1.6:compile
[INFO] |  |     +- org.springframework:spring-beans:jar:6.1.6:compile
[INFO] |  |     +- org.springframework:spring-context:jar:6.1.6:compile
[INFO] |  |     |  \- io.micrometer:micrometer-observation:jar:1.12.5:compile
[INFO] |  |     |     \- io.micrometer:micrometer-commons:jar:1.12.5:compile
[INFO] |  |     +- org.springframework:spring-core:jar:6.1.6:compile
[INFO] |  |     |  \- org.springframework:spring-jcl:jar:6.1.6:compile
[INFO] |  |     +- org.springframework:spring-expression:jar:6.1.6:compile
[INFO] |  |     \- org.springframework:spring-web:jar:6.1.6:compile
Edited by VidyaDharani Lokam

Merge request reports