Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bump Spring framework's version #753

Merged
merged 2 commits into from
Mar 6, 2024
Merged

Bump Spring framework's version #753

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
bd73d5c
Bump Spring framework's version
labkey-ians Mar 4, 2024
f188bc1
Expanded comment
labkey-ians Mar 4, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
42 changes: 42 additions & 0 deletions server/embedded/build.gradle
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,6 +59,48 @@ dependencies {
}
}

// TODO these shouldn't be merged forward
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why should this not be merged forward?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The force statements aren't needed with the spring-boot version used in develop, AFICT. Also, going forward as we move towards Embbedded do want to keep the standalone Spring version?

implementation('org.springframework:spring-web') {
version {
strictly "${springVersion}"
}
}
implementation('org.springframework:spring-core') {
version {
strictly "${springVersion}"
}
}
implementation('org.springframework:spring-jcl') {
version {
strictly "${springVersion}"
}
}
implementation('org.springframework:spring-context') {
version {
strictly "${springVersion}"
}
}
implementation('org.springframework:spring-aop') {
version {
strictly "${springVersion}"
}
}
implementation('org.springframework:spring-beans') {
version {
strictly "${springVersion}"
}
}
implementation('org.springframework:spring-expression') {
version {
strictly "${springVersion}"
}
}
implementation('org.springframework:spring-webmvc') {
version {
strictly "${springVersion}"
}
}

// This is a transitive dependency from spring-boot-starter that we're forcing to pick up CVE hotfixes. We're not
// vulnerable since we're not accepting untrusted Spring Boot config files, but this cleans up the reporting.
// At some point Spring Boot should update its preferred version and we can yank this
Expand Down