Skip to content

Update dependency org.springframework.boot:spring-boot-starter-log4j2 to v2.6.3#1

Open
mend-for-github-com[bot] wants to merge 1 commit into
mainfrom
whitesource-remediate/org.springframework.boot-spring-boot-starter-log4j2-2.x
Open

Update dependency org.springframework.boot:spring-boot-starter-log4j2 to v2.6.3#1
mend-for-github-com[bot] wants to merge 1 commit into
mainfrom
whitesource-remediate/org.springframework.boot-spring-boot-starter-log4j2-2.x

Conversation

@mend-for-github-com

@mend-for-github-com mend-for-github-com Bot commented Jul 9, 2023 •
edited
Loading

Copy link
Copy Markdown

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
org.springframework.boot:spring-boot-starter-log4j2 (source) 2.6.1 -> 2.6.3 age adoption passing confidence

By merging this PR, the below vulnerabilities will be automatically resolved:

Severity CVSS Score CVE Reachability
Critical Critical 10.0 CVE-2021-44228

Reachable
Critical Critical 9.0 CVE-2021-45046

Reachable
Medium Medium 6.6 CVE-2021-44832

Reachable
Medium Medium 5.9 CVE-2021-45105

Reachable

Release Notes

spring-projects/spring-boot (org.springframework.boot:spring-boot-starter-log4j2)

v2.6.3

🐞 Bug Fixes

  • 'spring.config.import' placeholders can resolve from profile-specific documents when they should fail #​29459
  • Warning from AprLifecycleListener when using Tomcat Native and Tomcat 9.0.55 or later #​29454
  • ConfigurationPropertySources.attach will always reattach when called multiple times #​29410
  • @SpringBootTest does not use spring.main.web-application-type properties declared in test resource files #​29374
  • Embedded launch script fails if jar is owned by an unknown user #​29371
  • ResponseStatusException no longer returning response body in 2.6.2 using Spring Security when application has a custom context path #​29299
  • Maven repackaging of a jar with a deeply nested package is prohibitively slow #​29268
  • Health contributor exclusion rules aren't applied to child contributors #​29251
  • Default value for management.info.env.enabled is outdated #​29187

📔 Documentation

  • Refer to Maven Resolver rather than Aether #​29480
  • Clarify documentation for RestTemplate customization #​29401
  • Learning About Spring Boot Features has "logging" link twice #​29380

🔨 Dependency Upgrades

❤️ Contributors

We'd like to thank all the contributors who worked on this release!

v2.6.2

🐞 Bug Fixes

  • The getter and setter that's used during configuration property binding varies when a getter or setter has been overridden to use a subclass of the property's type #​29143
  • DatabaseInitializationDependencyConfigurer triggers eager initialization of factory beans #​29103
  • Spring boot 2.6.0 Quartz mysql/mariadb tables are not created #​29095
  • Platform used for Quartz, Session, Integration, and Batch schema initialization cannot be configured #​29002
  • App fails to start when it depends on thymeleaf-extras-springsecurity5 but does not have Spring Security on the classpath #​28979
  • ResponseStatusException no longer returning response body in 2.6.1 using spring security #​28953
  • DataSourceScriptDatabaseInitializer may still try to access the database even though its initialization mode is never #​28931
  • Hibernate validation messages broken in spring boot 2.6.1 when setUseCodeAsDefaultMessage set to true #​28930
  • Image buildpack references without tag do not default to latest version #​28922
  • Invalid classpath index manifest attribute in war files built with Maven #​28904
  • AbstractMethodError in org.springframework.boot.web.servlet.filter.ErrorPageSecurityFilter when deployed to a Servlet 3.1-compatible container #​28902
  • Setting cache time-to-live for the health endpoint has no effect #​28882
  • server.servlet.session.cookie.same-site isn't applied to Spring Session's SESSION cookie #​28784

📔 Documentation

  • 2.5.x snapshot documentation links to source code on the main branch #​29141
  • Document that using DevTools with a remote application is not supported with WebFlux #​29138
  • Polish Creating Your Own Auto-configuration section in Core Features reference doc #​29133
  • Polish CacheManager customization section in reference doc #​29098
  • Polish README.adoc #​28948
  • Fix documented default value for property spring.mvc.pathmatch.matching-strategy #​28936
  • Add consistent quotes in YAML samples of reference doc #​28911

🔨 Dependency Upgrades

❤️ Contributors

We'd like to thank all the contributors who worked on this release!

  • If you want to rebase/retry this PR, check this box

@mend-for-github-com mend-for-github-com Bot added the security fix Security fix generated by Mend label Jul 9, 2023
@skim-amplify

skim-amplify commented Jul 9, 2023

Copy link
Copy Markdown

Logo
Checkmarx One – Scan Summary & Details – cb965f81-6069-4035-b862-38f1997e3ff1

No New Or Fixed Issues Found

@mend-for-github-com mend-for-github-com Bot changed the title Update dependency org.springframework.boot:spring-boot-starter-log4j2 to v2.6.3 Update dependency org.springframework.boot:spring-boot-starter-log4j2 to v2.6.3 - autoclosed Apr 2, 2024
@mend-for-github-com mend-for-github-com Bot deleted the whitesource-remediate/org.springframework.boot-spring-boot-starter-log4j2-2.x branch April 2, 2024 18:28
@mend-for-github-com mend-for-github-com Bot changed the title Update dependency org.springframework.boot:spring-boot-starter-log4j2 to v2.6.3 - autoclosed Update dependency org.springframework.boot:spring-boot-starter-log4j2 to v2.6.3 Apr 4, 2024
@mend-for-github-com mend-for-github-com Bot reopened this Apr 4, 2024
@mend-for-github-com mend-for-github-com Bot restored the whitesource-remediate/org.springframework.boot-spring-boot-starter-log4j2-2.x branch April 4, 2024 06:44
@mend-for-github-com mend-for-github-com Bot force-pushed the whitesource-remediate/org.springframework.boot-spring-boot-starter-log4j2-2.x branch from cc476cf to d67f929 Compare April 4, 2024 06:45
@amplify-bot

amplify-bot Bot commented Apr 4, 2024

Copy link
Copy Markdown
Check Name Conclusion Summary Output
Mend Security Check success Security Report output
Mend License Check success License Report output

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

security fix Security fix generated by Mend

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@skim-amplify