Upgrade to SnakeYAML 2.0

This commit raises the SnakeYAML baseline version to 2.0.
While most Spring applications are not affected by CVE-2022-1471,
upgrading this version should prevent automated tools from raising this
as a security issue. Such tools usually do not understand that YAML
parsing in Spring is about reading configuration, not parsing untrusted
content.

Closes gh-30048
This commit is contained in:
Andrey Somov
2023-05-22 14:31:27 +02:00
committed by Brian Clozel
parent 96a429a561
commit 097758baf3
3 changed files with 14 additions and 23 deletions

View File

@@ -144,6 +144,6 @@ dependencies {
api("org.webjars:webjars-locator-core:0.52")
api("org.xmlunit:xmlunit-assertj:2.9.1")
api("org.xmlunit:xmlunit-matchers:2.9.1")
api("org.yaml:snakeyaml:1.33")
api("org.yaml:snakeyaml:2.0")
}
}