Upgrade to SnakeYAML 2.0 #30048
Closed
Upgrade to SnakeYAML 2.0 #30048
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
spring-projects-issues
added
the
status: waiting-for-triage
|
@bclozel Spring is not affected by CVE-2022-1471, but yes the tooling should stop complaining after this PR |
bclozel
added
type: enhancement
|
This change makes SnakeYaml 2.0+ a requirement for all Spring applications. We're scheduling this for 6.1.0 right now, but we might upgrade Spring Boot 3.1.0 to SnakeYaml 2.0 before that if the source/runtime compatibility is fine. |
|
Any plan to apply this fix to Spring Boot 2.x version? Thanks. |
|
@bclozel I can also contribute a PR to Spring Boot |
|
Is it possible to update the code such that Spring only uses a subset of snakeyaml, that is not affected by backwards-incompatible changes? |
sbrannen
added
the
in: core
|
this PR fixes failing YamlProcessorTests |
jhoeller
added
type: dependency-upgrade
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
bclozel
added a commit
that referenced
this pull request
May 22, 2023
nidhi-nair
added a commit
to appsmithorg/appsmith
that referenced
this pull request
Jun 8, 2023
## Description Upgrades SnakeYaml dependency version forcefully to 2.0 to overcome [this issue](spring-projects/spring-boot#33457), as advised [here](spring-projects/spring-boot#34405 (comment)). This version tag can be reverted when we upgrade to Spring 6.1, which is when the library [aims](spring-projects/spring-framework#30048 (comment)) to upgrade the version themselves. Fixes appsmithorg/appsmith-ee#1233 #### Type of change - Chore (housekeeping or task changes that don't impact user perception) ## Testing This PR will be tested during regression. --------- Co-authored-by: Arpit Mohan <mohanarpit@users.noreply.github.com> Co-authored-by: Shrikant Sharat Kandula <shrikant@appsmith.com>
mdeinum
pushed a commit
to mdeinum/spring-framework
that referenced
this pull request
Jun 29, 2023
This commit raises the SnakeYAML baseline version to 2.0. While most Spring applications are not affected by CVE-2022-1471, upgrading this version should prevent automated tools from raising this as a security issue. Such tools usually do not understand that YAML parsing in Spring is about reading configuration, not parsing untrusted content. Closes spring-projectsgh-30048
mdeinum
pushed a commit
to mdeinum/spring-framework
that referenced
this pull request
Jun 29, 2023
1 task
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
SnakeYAML 2.0 deliveres backwards incompatible changes
https://bitbucket.org/snakeyaml/snakeyaml/wiki/Changes