search

amaybaum-dev / verademo

A deliberately insecure Java web application
MIT License
0 stars 3 forks source link

Update dependency org.springframework.boot:spring-boot-starter-web to v2.3.2.RELEASE - autoclosed #37

Closed dev-mend-for-github-com[bot] closed 10 months ago

dev-mend-for-github-com[bot] commented 1 year ago

This PR contains the following updates:

Package Type Update Change
org.springframework.boot:spring-boot-starter-web (source) compile patch 2.3.1.RELEASE -> 2.3.2.RELEASE

By merging this PR, the issue #36 will be automatically resolved and closed:

Severity CVSS Score CVE Reachability
High High 7.5 CVE-2020-13935

Release Notes

spring-projects/spring-boot (org.springframework.boot:spring-boot-starter-web) ### [`v2.3.2.RELEASE`](https://togithub.com/spring-projects/spring-boot/releases/tag/v2.3.2.RELEASE) [Compare Source](https://togithub.com/spring-projects/spring-boot/compare/v2.3.1.RELEASE...v2.3.2.RELEASE) #### :star: New Features - Improve Liveness/Readiness health indicators and probes configuration [#​22107](https://togithub.com/spring-projects/spring-boot/issues/22107) - Add run-image option for image building [#​21534](https://togithub.com/spring-projects/spring-boot/issues/21534) - Add support for reactive Elasticsearch healthcheck [#​21042](https://togithub.com/spring-projects/spring-boot/pull/21042) #### :beetle: Bug Fixes - AbstractRepositoryConfigurationSourceSupport does not override registerBeanDefinitions(AnnotationMetadata, BeanDefinitionRegistry) [#​22480](https://togithub.com/spring-projects/spring-boot/issues/22480) - ConditionMessage#items throws an NPE with a null list of items although the Javadoc states it is tolerated [#​22344](https://togithub.com/spring-projects/spring-boot/pull/22344) - ConfigurationPropertiesBeanDefinitionValidator interferes with EclipseLink load-time weaving [#​22325](https://togithub.com/spring-projects/spring-boot/issues/22325) - Image building fails when DOCKER_HOST is set to a local socket prefixed with unix:// [#​22300](https://togithub.com/spring-projects/spring-boot/issues/22300) - OnClassCondition tries to determine the outcome for single auto-configuration classes in parallel [#​22294](https://togithub.com/spring-projects/spring-boot/pull/22294) - A WebFlux app that depends on com.amazonaws:DynamoDBLocal fails to start [#​22282](https://togithub.com/spring-projects/spring-boot/issues/22282) - NullPointerException in ErrorPageFilter when a MissingServletRequestParameterException is thrown and there's no DefaultHandlerExceptionResolver [#​22249](https://togithub.com/spring-projects/spring-boot/issues/22249) - Numerous logs mentioning a failed JNDI lookup when using Jetty [#​22241](https://togithub.com/spring-projects/spring-boot/issues/22241) - OAuth2ResourceServerAutoConfiguration does not back off completely when spring-security-oauth2-resource-server is not on the classpath [#​22233](https://togithub.com/spring-projects/spring-boot/issues/22233) - Period conversion does not support a ChronoUnit of WEEKS but supports weeks in ISO-8601 (e.g. P2W) and simple (e.g. 2w) formats [#​22225](https://togithub.com/spring-projects/spring-boot/issues/22225) - Image building fails with an unhelpful error message when building an image from a jar that includes the launch script [#​22223](https://togithub.com/spring-projects/spring-boot/issues/22223) - Layered bootJar task causes warnings when custom source set is present in the project [#​22200](https://togithub.com/spring-projects/spring-boot/issues/22200) - [@​ConditionalOnSingleCandidate](https://togithub.com/ConditionalOnSingleCandidate) does not match when there is a single candidate that is a scoped bean [#​22197](https://togithub.com/spring-projects/spring-boot/issues/22197) - NPE in spring-boot-maven-plugin:build-image when setting custom builder that is not a builder [#​22179](https://togithub.com/spring-projects/spring-boot/issues/22179) - Accept empty filter dispatcher types in auto-configurations [#​22175](https://togithub.com/spring-projects/spring-boot/issues/22175) - TomcatMetricsBinder may log a warning for an NPE if the context is closed before the ApplicationStartedEvent is published [#​22167](https://togithub.com/spring-projects/spring-boot/issues/22167) - Resource loading fails in Tomcat when Spring Boot is loaded from the common class loader [#​22119](https://togithub.com/spring-projects/spring-boot/issues/22119) - Temporary files not cleaned up after Maven plugin execution [#​22112](https://togithub.com/spring-projects/spring-boot/pull/22112) - RedisReactiveHealthIndicator is broken with Redis cluster mode [#​22096](https://togithub.com/spring-projects/spring-boot/issues/22096) - Management health group does not inherit show-details property [#​22063](https://togithub.com/spring-projects/spring-boot/issues/22063) - layertools with a wrong option seems to fail silently [#​22042](https://togithub.com/spring-projects/spring-boot/issues/22042) - NamedPipeSocket does not handle FileSystemException when establishing the file channel [#​22035](https://togithub.com/spring-projects/spring-boot/pull/22035) - In a context hierarchy, timeout-per-shutdown-phase is only honoured in the root context [#​22014](https://togithub.com/spring-projects/spring-boot/issues/22014) - LOGBACK: No context given for c.q.l.core.rolling.SizeAndTimeBasedRollingPolicy [#​22010](https://togithub.com/spring-projects/spring-boot/issues/22010) - MockBean does not resolve the right type for abstract test class [#​22006](https://togithub.com/spring-projects/spring-boot/issues/22006) - The failure when spring.redis.url is configured with a redis-sentinel:// URL is hard to diagnose [#​21999](https://togithub.com/spring-projects/spring-boot/issues/21999) - spring-boot-starter-parent contains elements that must be overridden and aren't documented as such [#​21989](https://togithub.com/spring-projects/spring-boot/issues/21989) - Projects using Maven and spring-security-oauth2-client end up with a downgraded version of json-smart that isn't compatible with the managed version of json-path [#​21939](https://togithub.com/spring-projects/spring-boot/issues/21939) - Kafka Stream consumer metrics were lost in the move away from KafkaConsumerMetrics [#​21921](https://togithub.com/spring-projects/spring-boot/pull/21921) - Dependencies enforced without applying plugin [#​21911](https://togithub.com/spring-projects/spring-boot/issues/21911) - Welcome page support bypasses controllers mapped to / [#​21909](https://togithub.com/spring-projects/spring-boot/issues/21909) - AvailabilityChangeEvent does not carry generic information [#​21898](https://togithub.com/spring-projects/spring-boot/issues/21898) - Property spring.autoconfigure.exclude ignored by test slices [#​21736](https://togithub.com/spring-projects/spring-boot/issues/21736) - Image references passed to a CNB builder are not validated [#​21495](https://togithub.com/spring-projects/spring-boot/issues/21495) #### :notebook_with_decorative_cover: Documentation - Update the documentation to avoid trivialising what the reader's learning about [#​22410](https://togithub.com/spring-projects/spring-boot/issues/22410) - Clarify the effect of ordering auto-configuration [#​22339](https://togithub.com/spring-projects/spring-boot/issues/22339) - Restructure "Building Container Images" section [#​22296](https://togithub.com/spring-projects/spring-boot/pull/22296) - Update documentation to reflect the web server now being started immediately before the ContextRefreshedEvent is published [#​22277](https://togithub.com/spring-projects/spring-boot/issues/22277) - Clarify locations inside and outside the jar from which properties are loaded [#​22264](https://togithub.com/spring-projects/spring-boot/issues/22264) - Rename NoneOfNestedConditions to NoneNestedConditions in example docs [#​22246](https://togithub.com/spring-projects/spring-boot/issues/22246) - Add package info for org.springframework.boot.autoconfigure.elasticsearch.rest [#​22147](https://togithub.com/spring-projects/spring-boot/issues/22147) - Document how to exclude an annotation processor with Maven [#​22023](https://togithub.com/spring-projects/spring-boot/issues/22023) - Remove Javadoc throw for ConfigurationPropertyName.ofIfValid() [#​22018](https://togithub.com/spring-projects/spring-boot/pull/22018) - Fix wrong property reference to keys-to-sanitize in Javadoc [#​21916](https://togithub.com/spring-projects/spring-boot/issues/21916) - Document Kafka metrics support [#​21910](https://togithub.com/spring-projects/spring-boot/issues/21910) - Fix formatting of `@Bean` in reference documentation [#​21908](https://togithub.com/spring-projects/spring-boot/issues/21908) - Update layers.idx file example in docs [#​21510](https://togithub.com/spring-projects/spring-boot/issues/21510) #### :hammer: Dependency Upgrades - Upgrade to Micrometer 1.5.3 [#​22553](https://togithub.com/spring-projects/spring-boot/issues/22553) - Upgrade to MariaDB 2.6.2 [#​22541](https://togithub.com/spring-projects/spring-boot/issues/22541) - Upgrade to AspectJ 1.9.6 [#​22540](https://togithub.com/spring-projects/spring-boot/issues/22540) - Upgrade to Groovy 2.5.13 [#​22526](https://togithub.com/spring-projects/spring-boot/issues/22526) - Upgrade to Tomcat 9.0.37 [#​22478](https://togithub.com/spring-projects/spring-boot/issues/22478) - Upgrade to Solr 8.5.2 [#​22477](https://togithub.com/spring-projects/spring-boot/issues/22477) - Upgrade to Netty 4.1.51.Final [#​22476](https://togithub.com/spring-projects/spring-boot/issues/22476) - Upgrade to Neo4j OGM 3.2.14 [#​22475](https://togithub.com/spring-projects/spring-boot/issues/22475) - Upgrade to MySQL 8.0.21 [#​22474](https://togithub.com/spring-projects/spring-boot/issues/22474) - Upgrade to MongoDB 4.0.5 [#​22473](https://togithub.com/spring-projects/spring-boot/issues/22473) - Upgrade to Lettuce 5.3.2.RELEASE [#​22470](https://togithub.com/spring-projects/spring-boot/issues/22470) - Upgrade to Kotlin Coroutines 1.3.8 [#​22469](https://togithub.com/spring-projects/spring-boot/issues/22469) - Upgrade to jOOQ 3.13.3 [#​22468](https://togithub.com/spring-projects/spring-boot/issues/22468) - Upgrade to Johnzon 1.2.8 [#​22467](https://togithub.com/spring-projects/spring-boot/issues/22467) - Upgrade to Jetty 9.4.30.v20200611 [#​22466](https://togithub.com/spring-projects/spring-boot/issues/22466) - Upgrade to Jetty Reactive HTTPClient 1.1.4 [#​22465](https://togithub.com/spring-projects/spring-boot/issues/22465) - Upgrade to Jakarta Servlet 4.0.4 [#​22464](https://togithub.com/spring-projects/spring-boot/issues/22464) - Upgrade to Jackson Bom 2.11.1 [#​22463](https://togithub.com/spring-projects/spring-boot/issues/22463) - Upgrade to HSQLDB 2.5.1 [#​22462](https://togithub.com/spring-projects/spring-boot/issues/22462) - Upgrade to Hibernate 5.4.18.Final [#​22461](https://togithub.com/spring-projects/spring-boot/issues/22461) - Upgrade to Hazelcast 3.12.8 [#​22460](https://togithub.com/spring-projects/spring-boot/issues/22460) - Upgrade to Flatten Maven Plugin 1.2.4 [#​22459](https://togithub.com/spring-projects/spring-boot/issues/22459) - Upgrade to Dropwizard Metrics 4.1.11 [#​22458](https://togithub.com/spring-projects/spring-boot/issues/22458) - Upgrade to DB2 JDBC 11.5.4.0 [#​22457](https://togithub.com/spring-projects/spring-boot/issues/22457) - Upgrade to Couchbase Client 3.0.6 [#​22456](https://togithub.com/spring-projects/spring-boot/issues/22456) - Upgrade to Caffeine 2.8.5 [#​22455](https://togithub.com/spring-projects/spring-boot/issues/22455) - Upgrade to Byte Buddy 1.10.13 [#​22454](https://togithub.com/spring-projects/spring-boot/issues/22454) - Upgrade to AppEngine SDK 1.9.81 [#​22453](https://togithub.com/spring-projects/spring-boot/issues/22453) - Upgrade to ActiveMQ 5.15.13 [#​22452](https://togithub.com/spring-projects/spring-boot/issues/22452) - Upgrade to R2DBC Arabba-SR6 [#​22394](https://togithub.com/spring-projects/spring-boot/issues/22394) - Upgrade to Spring Kafka 2.5.4 [#​22390](https://togithub.com/spring-projects/spring-boot/issues/22390) - Upgrade to Spring Integration 5.3.2 [#​22389](https://togithub.com/spring-projects/spring-boot/issues/22389) - Upgrade to Spring Data Neumann-SR2 [#​22388](https://togithub.com/spring-projects/spring-boot/issues/22388) - Upgrade to Spring AMQP 2.2.9 [#​22387](https://togithub.com/spring-projects/spring-boot/issues/22387) - Upgrade to Reactor Dysprosium-SR10 [#​22376](https://togithub.com/spring-projects/spring-boot/issues/22376) - Upgrade to Spring Framework 5.2.8 [#​22375](https://togithub.com/spring-projects/spring-boot/issues/22375) - Upgrade to Maven Shade Plugin 3.2.4 [#​22227](https://togithub.com/spring-projects/spring-boot/pull/22227) #### :heart: Contributors We'd like to thank all the contributors who worked on this release! - [@​izeye](https://togithub.com/izeye) - [@​dreis2211](https://togithub.com/dreis2211) - [@​fernandezseb](https://togithub.com/fernandezseb) - [@​anshlykov](https://togithub.com/anshlykov) - [@​eddumelendez](https://togithub.com/eddumelendez) - [@​aleksanderlech](https://togithub.com/aleksanderlech)