Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update dependency org.springframework.boot:spring-boot-starter-log4j2 to v2.6.3 #1

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Update dependency org.springframework.boot:spring-boot-starter-log4j2 to v2.6.3 #1

wants to merge 1 commit into from

Conversation

mend-for-github-com[bot]
Copy link

@mend-for-github-com mend-for-github-com bot commented Jul 9, 2023 •
edited

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
org.springframework.boot:spring-boot-starter-log4j2 (source) 2.6.1 -> 2.6.3 age adoption passing confidence

By merging this PR, the below vulnerabilities will be automatically resolved:

Severity CVSS Score CVE Reachability
Critical Critical 10.0 CVE-2021-44228
Critical Critical 9.0 CVE-2021-45046
Medium Medium 6.6 CVE-2021-44832
Medium Medium 5.9 CVE-2021-45105

Release Notes

spring-projects/spring-boot (org.springframework.boot:spring-boot-starter-log4j2)

v2.6.3

🐞 Bug Fixes

  • 'spring.config.import' placeholders can resolve from profile-specific documents when they should fail #​29459
  • Warning from AprLifecycleListener when using Tomcat Native and Tomcat 9.0.55 or later #​29454
  • ConfigurationPropertySources.attach will always reattach when called multiple times #​29410
  • @SpringBootTest does not use spring.main.web-application-type properties declared in test resource files #​29374
  • Embedded launch script fails if jar is owned by an unknown user #​29371
  • ResponseStatusException no longer returning response body in 2.6.2 using Spring Security when application has a custom context path #​29299
  • Maven repackaging of a jar with a deeply nested package is prohibitively slow #​29268
  • Health contributor exclusion rules aren't applied to child contributors #​29251
  • Default value for management.info.env.enabled is outdated #​29187

📔 Documentation

  • Refer to Maven Resolver rather than Aether #​29480
  • Clarify documentation for RestTemplate customization #​29401
  • Learning About Spring Boot Features has "logging" link twice #​29380

🔨 Dependency Upgrades

❤️ Contributors

We'd like to thank all the contributors who worked on this release!

v2.6.2

🐞 Bug Fixes

  • The getter and setter that's used during configuration property binding varies when a getter or setter has been overridden to use a subclass of the property's type #​29143
  • DatabaseInitializationDependencyConfigurer triggers eager initialization of factory beans #​29103
  • Spring boot 2.6.0 Quartz mysql/mariadb tables are not created #​29095
  • Platform used for Quartz, Session, Integration, and Batch schema initialization cannot be configured #​29002
  • App fails to start when it depends on thymeleaf-extras-springsecurity5 but does not have Spring Security on the classpath #​28979
  • ResponseStatusException no longer returning response body in 2.6.1 using spring security #​28953
  • DataSourceScriptDatabaseInitializer may still try to access the database even though its initialization mode is never #​28931
  • Hibernate validation messages broken in spring boot 2.6.1 when setUseCodeAsDefaultMessage set to true #​28930
  • Image buildpack references without tag do not default to latest version #​28922
  • Invalid classpath index manifest attribute in war files built with Maven #​28904
  • AbstractMethodError in org.springframework.boot.web.servlet.filter.ErrorPageSecurityFilter when deployed to a Servlet 3.1-compatible container #​28902
  • Setting cache time-to-live for the health endpoint has no effect #​28882
  • server.servlet.session.cookie.same-site isn't applied to Spring Session's SESSION cookie #​28784

📔 Documentation

  • 2.5.x snapshot documentation links to source code on the main branch #​29141
  • Document that using DevTools with a remote application is not supported with WebFlux #​29138
  • Polish Creating Your Own Auto-configuration section in Core Features reference doc #​29133
  • Polish CacheManager customization section in reference doc #​29098
  • Polish README.adoc #​28948
  • Fix documented default value for property spring.mvc.pathmatch.matching-strategy #​28936
  • Add consistent quotes in YAML samples of reference doc #​28911

🔨 Dependency Upgrades

❤️ Contributors

We'd like to thank all the contributors who worked on this release!

  • If you want to rebase/retry this PR, check this box

@mend-for-github-com mend-for-github-com bot added the security fix Security fix generated by Mend label Jul 9, 2023
@skim-amplify
Copy link

Logo
Checkmarx One – Scan Summary & Details – cb965f81-6069-4035-b862-38f1997e3ff1

No New Or Fixed Issues Found

@mend-for-github-com mend-for-github-com bot changed the title Update dependency org.springframework.boot:spring-boot-starter-log4j2 to v2.6.3 Update dependency org.springframework.boot:spring-boot-starter-log4j2 to v2.6.3 - autoclosed Apr 2, 2024
@mend-for-github-com mend-for-github-com bot deleted the whitesource-remediate/org.springframework.boot-spring-boot-starter-log4j2-2.x branch April 2, 2024 18:28
@mend-for-github-com mend-for-github-com bot changed the title Update dependency org.springframework.boot:spring-boot-starter-log4j2 to v2.6.3 - autoclosed Update dependency org.springframework.boot:spring-boot-starter-log4j2 to v2.6.3 Apr 4, 2024
@mend-for-github-com mend-for-github-com bot reopened this Apr 4, 2024
@mend-for-github-com mend-for-github-com bot restored the whitesource-remediate/org.springframework.boot-spring-boot-starter-log4j2-2.x branch April 4, 2024 06:44
@mend-for-github-com mend-for-github-com bot force-pushed the whitesource-remediate/org.springframework.boot-spring-boot-starter-log4j2-2.x branch from cc476cf to d67f929 Compare April 4, 2024 06:45
@amplify-self-hosted-runners
Copy link

Check Name Conclusion Summary Output
Mend Security Check success Security Report output
Mend License Check success License Report output

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
security fix Security fix generated by Mend
Projects
None yet
Milestone
No milestone
1 participant
@skim-amplify