Skip to content

Commit

Permalink
chore(deps): specify version 1.29 of org.yaml:snakeyaml to stay parti…
Browse files Browse the repository at this point in the history
…ally up to date

It would be nice to jump all the way to 1.33 to get all the way up to date, and to resolve these CVEs:

CVE-2022-25857 (1.31), CVE-2022-38749 (1.31), CVE-2022-38750 (1.31), CVE-2022-38751 (1.32) and CVE-2022-38752 (1.32).

However, spring-projects/spring-boot#32228 (comment) says
to stick with 1.29 until >= 2.6.12, as the commit that resolved that issue
(spring-projects/spring-boot@724f9eb)
went in to 2.6.12.

Note that spring boot 2.4.13 brings in version 1.27 (see https://repo.maven.apache.org/maven2/org/springframework/boot/spring-boot-dependencies/2.4.13/spring-boot-dependencies-2.4.13.pom).

2.5.14 brings in 1.28 (see https://repo.maven.apache.org/maven2/org/springframework/boot/spring-boot-dependencies/2.5.14/spring-boot-dependencies-2.5.14.pom)
2.6.13 brings in 1.29 (see https://repo.maven.apache.org/maven2/org/springframework/boot/spring-boot-dependencies/2.6.13/spring-boot-dependencies-2.6.13.pom)
2.7.5 brings in 1.30 (see https://repo.maven.apache.org/maven2/org/springframework/boot/spring-boot-dependencies/2.7.5/spring-boot-dependencies-2.7.5.pom)

Note also that snakeyaml 1.32 introduces a default 3MB limit (see https://bitbucket.org/snakeyaml/snakeyaml/pull-requests/22).  If, for example, clouddriver-local.yml is bigger than that, perhaps due to a large number of accounts,  clouddriver fails to start.
  • Loading branch information
dbyron-sf committed Dec 2, 2022
1 parent c23b788 commit da402ec
Showing 1 changed file with 1 addition and 0 deletions.
1 change: 1 addition & 0 deletions spinnaker-dependencies/spinnaker-dependencies.gradle
Expand Up @@ -157,6 +157,7 @@ dependencies {
api("org.objenesis:objenesis:2.5.1")
api("org.pf4j:pf4j:3.2.0")
api("org.pf4j:pf4j-update:2.3.0")
api("org.yaml:snakeyaml:1.29") // safe to upgrade beyond 1.29 with spring boot >= 2.6.12. See https://github.com/spring-projects/spring-boot/issues/32228#issue-1361858500.
api("org.springdoc:springdoc-openapi-webmvc-core:${versions.openapi}")
api("org.springdoc:springdoc-openapi-kotlin:${versions.openapi}")
api("org.springframework.boot:spring-boot-configuration-processor:${versions.springBoot}")
Expand Down

0 comments on commit da402ec

Please sign in to comment.