search

camunda-community-hub / zeebe-simple-monitor

A monitoring application to show insides of Zeebe for developers
Apache License 2.0
169 stars 105 forks source link

Upgrade spring boot to 3.2.8 or newer #729

Open mattieserver opened 3 months ago

mattieserver commented 3 months ago

The current spring version (3.2.5) includes spring-boot-starter-tomcat (from spring-boot-starter-web) which has a security issue (CVE-2024-34750).

This CVE relates to a issue when using HTTP2. Reading the documentation from spring it seems like HTTP2 is not enabled by default so this does not impact the project directly.

However some security scanning tools only check the version and raise an issue, so we might as well just upgrade the spring version. Upgrading to 3.2.8 should 'fix' the issue and you stay within the same minor version of spring.

mattieserver commented 3 months ago

If https://github.com/camunda-community-hub/zeebe-simple-monitor/pull/713 is merged the issue would still be there. Upgrade should be done to 3.3.1 or 3.3.2