Upgrade to SnakeYAML 2.0
This commit raises the SnakeYAML baseline version to 2.0. While most Spring applications are not affected by CVE-2022-1471, upgrading this version should prevent automated tools from raising this as a security issue. Such tools usually do not understand that YAML parsing in Spring is about reading configuration, not parsing untrusted content. Closes gh-30048
This commit is contained in:
committed by
Brian Clozel
parent
96a429a561
commit
097758baf3
@@ -144,6 +144,6 @@ dependencies {
|
||||
api("org.webjars:webjars-locator-core:0.52")
|
||||
api("org.xmlunit:xmlunit-assertj:2.9.1")
|
||||
api("org.xmlunit:xmlunit-matchers:2.9.1")
|
||||
api("org.yaml:snakeyaml:1.33")
|
||||
api("org.yaml:snakeyaml:2.0")
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user