Skip to content

Fix dependencies and remove old overrides #3314

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
avgustinmm merged 1 commit into from
Aug 24, 2026
+5 −37
Merged

Fix dependencies and remove old overrides #3314

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 0 additions & 5 deletions hawkbit-sdk/hawkbit-sdk-commons/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,11 +25,6 @@
<description>SDK commons</description>

<dependencies>
<!-- CVE-2025-48976: excluded from spring-cloud-starter-openfeign, so add it explicitly, remove this if exclusion is removed -->
<dependency>
<groupId>commons-fileupload</groupId>
<artifactId>commons-fileupload</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.cloud</groupId>
<artifactId>spring-cloud-starter-openfeign</artifactId>
Expand Down
37 changes: 5 additions & 32 deletions pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,14 +41,9 @@
</scm>

<properties>
<!-- Overrides START - to be reviewed regularly -->
<!-- Spring boot version overrides (should be reviewed with every Spring boot upgrade) - START -->
<!-- Remove when upgrading to next spring-cloud-starter-stream-rabbit to 5.0.3 -->
<httpclient5.version>5.6.2</httpclient5.version>
<httpcore5.version>5.4.3</httpcore5.version>
<!-- Spring boot version overrides - END -->
<!-- Override vulnerable commons-fileupload used by feign-form-spring (via spring-cloud-starter-openfeign) -->
<commons-fileupload.version>1.6.0</commons-fileupload.version>
<!-- Overrides START - to be reviewed regularly current overrides against spring-boot 4.1.1-->
<!-- Override logback version since 1.5.38 from spring-boot 4.1.1 is vulnerable -->
<logback.version>1.6.3</logback.version>
<!-- Override commons-lang3 version since 3.17 is vulnerable -->
<commons-lang.version>3.20.0</commons-lang.version>
<!-- Overrides END -->
Expand All @@ -67,8 +62,8 @@
<springdoc-openapi.version>3.1.0</springdoc-openapi.version>

<!-- openfeign versions -->
<spring-cloud-openfeign.version>5.0.2</spring-cloud-openfeign.version>
<openfeign-hc5.version>13.13</openfeign-hc5.version>
<spring-cloud-openfeign.version>5.0.3</spring-cloud-openfeign.version>
<openfeign-hc5.version>13.14</openfeign-hc5.version>

<!-- Eclipselink - START -->
<!--
Expand Down Expand Up @@ -223,11 +218,6 @@
<dependencyManagement>
<dependencies>
<!-- Overrides START -->
<dependency>
<groupId>commons-fileupload</groupId>
<artifactId>commons-fileupload</artifactId>
<version>${commons-fileupload.version}</version>
</dependency>
<dependency>

@avgustinmm avgustinmm Aug 24, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

if we don't define here version - isn't this dependency management entry to be removed at all?

@vasilchev vasilchev Aug 24, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why should be removed ? version is just not overriden it will take whatever (1.6.0) version comes from openfeign. (in 5.0.3 and also 5.0.2 i think) it is already 1.6.0

@vasilchev vasilchev Aug 24, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yes, it is not needed anymore in dependency management, will remove

<groupId>org.apache.commons</groupId>
<artifactId>commons-lang3</artifactId>
Expand Down Expand Up @@ -301,23 +291,6 @@
<artifactId>springdoc-openapi-starter-webmvc-ui</artifactId>
<version>${springdoc-openapi.version}</version>
</dependency>

<dependency>
<groupId>org.springframework.cloud</groupId>
<artifactId>spring-cloud-starter-openfeign</artifactId>
<version>${spring-cloud-openfeign.version}</version>
<!--
CVE-2025-48976: override commons-fileupload dependency - 1.5 -> 1.6.0,
remove it when spring-cloud-openfeign start bringing it down,
commons-fileupload 1.6.0(+) shall be added explicitly if needed
-->
<exclusions>
<exclusion>
<groupId>commons-fileupload</groupId>
<artifactId>commons-fileupload</artifactId>
</exclusion>
</exclusions>
</dependency>
<dependency>
<groupId>io.github.openfeign</groupId>
<artifactId>feign-hc5</artifactId>
Expand Down
Loading