Skip to content

Updated pom.xml by Safer #203

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Updated pom.xml by Safer #203

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 2 additions & 3 deletions pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@

<groupId>com.github.piomin</groupId>
<artifactId>spring-boot-logging</artifactId>
<version>2.1.0</version>
<version>2.0.3</version>
<packaging>pom</packaging>
<name>spring-boot-logging</name>
<description>Library for HTTP logging with Spring Boot</description>
Expand All @@ -18,7 +18,7 @@
<javax-servlet.version>4.0.1</javax-servlet.version>
<logstash-logback.version>5.3</logstash-logback.version>
<spring.version>6.2.8</spring.version>
<spring.boot.version>3.5.3</spring.boot.version>
<spring.boot.version>3.3.2</spring.boot.version>
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Verification agent

🧩 Analysis chain

Verify that Spring Boot 3.3.2 actually exists and matches Spring Framework 6.2.8

<spring.boot.version>3.3.2</spring.boot.version> is currently unreleased (the latest GA as of July 2025 is 3.2.x).
If 3.3.2 is not available on Maven Central, the build will fail.
Even if it exists, ensure its managed Spring Framework version aligns with the manually-pinned <spring.version>6.2.8; overriding Boot’s BOM can cause classpath drift and security regressions.

🏁 Script executed:

#!/bin/bash
# Quick availability check – returns HTTP 200 only if the artifact exists
set -e
url="https://repo1.maven.org/maven2/org/springframework/boot/spring-boot-starter/3.3.2/"
status=$(curl -o /dev/null -s -w "%{http_code}" "$url")
echo "HTTP status for Spring Boot 3.3.2: $status (expect 200)"

Length of output: 348

🏁 Script executed:

#!/bin/bash
set -e

BOM_URL="https://repo1.maven.org/maven2/org/springframework/boot/spring-boot-dependencies/3.3.2/spring-boot-dependencies-3.3.2.pom"
echo "Fetching Spring Boot BOM from $BOM_URL"
pom=$(curl -s "$BOM_URL")

spring_framework_version=$(echo "$pom" |
  sed -n 's:.*<spring-framework.version>\(.*\)</spring-framework.version>.*:\1:p'
)

echo "Spring Framework version managed by Spring Boot 3.3.2: $spring_framework_version"

Length of output: 207718

Align Spring Framework version with Spring Boot BOM

  • Spring Boot 3.3.2 is available on Maven Central.
  • Its spring-boot-dependencies BOM pins <spring-framework.version> to 6.1.11.
  • Your manual override <spring.version>6.2.8</spring.version> will override the BOM, causing classpath drift and risking incompatibilities or security regressions.

Suggested fixes:

  • Remove the manual <spring.version> override and rely on the BOM’s 6.1.11, or
  • Upgrade to a Spring Boot release that manages Spring Framework 6.2.x (e.g. 3.4.x when available) if you require 6.2.8.
🤖 Prompt for AI Agents 
In pom.xml at line 21, the Spring Framework version is manually overridden to
6.2.8, which conflicts with the Spring Boot 3.3.2 BOM that manages version
6.1.11. To fix this, remove the manual <spring.version> override from the
pom.xml and rely on the Spring Boot BOM to manage the Spring Framework version,
ensuring compatibility and avoiding classpath issues.

<slf4j.version>2.0.17</slf4j.version>
<sonar.projectKey>piomin_spring-boot-logging</sonar.projectKey>
<sonar.organization>piomin</sonar.organization>
Expand All @@ -34,7 +34,6 @@
<module>reactive-logging-spring-tests</module>
<module>loki-logging-spring-boot-starter</module>
<module>logging-spring-commons</module>
<module>loki-logging-spring-tests</module>
</modules>

</project>