Replies: 1 comment 11 replies
-
|
Hello @zangcc
It looks like you use modules in your main
Regards, Dmitriy |
Beta Was this translation helpful? Give feedback.
-
|
I seem to have found the reason why the org.springframework.boot:spring-boot-autoconfigure version is scanned out as 2.5.3.The result says that it is a dependency of com.baomidou:mybatis-plus-boot-starter:3.5.3.1.
I found com.baomidou:mybatis-plus-boot-starter:3.5.3.1, the org.springframework.boot.. version inside is 2.5.3, this may be the reason. But why does 2.5.3 overwrite the 2.7.12 I declared in the outer layer? 
I have specified the version of ${spring-boot.version} in the outermost pom.xml 
Why does Trivy still use 2.5.3 as the version of org.springframework.boot:spring-boot-autoconfigure? |
Beta Was this translation helpful? Give feedback.
-
|
Possibly the wrong priority for properties resolve. |
Beta Was this translation helpful? Give feedback.
-
|
By the way, upload the scan results. The scan results here are still that the org.springframework.boot:spring-boot-autoconfigure version is 2.5.3, but the real version is not this. |
Beta Was this translation helpful? Give feedback.
-
|
This is so strange... I created test image with your files: FROM aquasec/trivy:0.47.0
RUN mkdir /app
COPY ./pom.xml /app/pom.xml
COPY ./zangccDemo-bm-policy-dao/pom.xml /app/zangccDemo-bm-policy-dao/pom.xml
COPY ./zangccDemo-bm-policy-service/pom.xml /app/zangccDemo-bm-policy-service/pom.xml
COPY ./zangccDemo-bm-policy-web/pom.xml /app/zangccDemo-bm-policy-web/pom.xmlTest: ➜ docker run -it --rm 5510 fs -f json --list-all-pkgs ./app | grep '"ID": "org.springframework.boot:spring-boot-autoconfigure'
"ID": "org.springframework.boot:spring-boot-autoconfigure:2.7.12",
"ID": "org.springframework.boot:spring-boot-autoconfigure:2.7.12",
"ID": "org.springframework.boot:spring-boot-autoconfigure:2.7.12",
"ID": "org.springframework.boot:spring-boot-autoconfigure:2.7.12",
"ID": "org.springframework.boot:spring-boot-autoconfigure:2.7.12",
"ID": "org.springframework.boot:spring-boot-autoconfigure:2.7.12",Can you update this Dockerfile to get wrong version? |
Beta Was this translation helpful? Give feedback.
-
|
Thanks for the reply. I scanned again using trivy:0.47.0 and found that the dependency version problem of "org.springframework.boot:spring-boot-autoconfigure" was solved. Thank you |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
-
Description
The version of "org.springframework.boot:spring-boot-autoconfigure" is 2.7.12, and the version scanned by Trivy is 2.5.3
This is another project and this problem still exists
The version of "org.springframework.boot:spring-boot-autoconfigure" is 2.4.5, and the version scanned by Trivy is 2.5.3
Desired Behavior
Dependency versions remain accurate
Actual Behavior
The dependency version in the scan results does not match the actual version。org.springframework.boot:spring-boot-autoconfigure，Its versions are all 2.5.3。
Reproduction Steps
Target
None
Scanner
None
Output Format
None
Mode
None
Debug Output
Operating System
Ubuntu SMP Fri Mar 18 12:42:08 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux
Version
Checklist
trivy image --resetBeta Was this translation helpful? Give feedback.
All reactions