Skip to content

Commit

Permalink
fix: Override snakeyaml version to fix vulnerabilities
Browse files Browse the repository at this point in the history
  • Loading branch information
rsenden committed Apr 7, 2023
1 parent 26cde1b commit af22f02
Showing 1 changed file with 5 additions and 0 deletions.
5 changes: 5 additions & 0 deletions build.gradle
Original file line number Diff line number Diff line change
Expand Up @@ -82,6 +82,11 @@ allprojects {
implementation 'org.hibernate:hibernate-validator-annotation-processor:6.2.5.Final'
implementation 'org.jsoup:jsoup:1.14.3'
implementation 'com.google.code.findbugs:jsr305:3.0.2'
// Spring Boot declares dependency on snakeyaml 1.30, which contains known
// vulnerabilities. According to https://stackoverflow.com/a/75875594, our
// Spring Boot version is compatible with snakeyaml 2.0, which doesn't have
// any known vulnerabilities, so we override the version here.
implementation 'org.yaml:snakeyaml:2.0'
}
}
}
Expand Down

0 comments on commit af22f02

Please sign in to comment.