Add constraints on spring-boot-starter-undertow dependency to use io.undertow:undertow-core 2.3.14.Final instead of 2.3.12.Final (CVE-2024-6162)

jreynard-code · jreynard-code · commit 7ff465e5f452 · 2024-07-03T17:44:39.000+02:00
diff --git a/build.gradle.kts b/build.gradle.kts
@@ -279,7 +279,10 @@ subprojects {
       exclude(group = "org.springframework.boot", module = "spring-boot-starter-tomcat")
     }
     implementation("org.springframework.boot:spring-boot-starter-undertow") {
-      constraints { implementation("org.jboss.xnio:xnio-api:3.8.16.Final") }
+      constraints {
+        implementation("org.jboss.xnio:xnio-api:3.8.16.Final")
+        implementation("io.undertow:undertow-core:2.3.14.Final")
+      }
     }
     implementation("com.fasterxml.jackson.module:jackson-module-kotlin")
     // https://mvnrepository.com/artifact/jakarta.validation/jakarta.validation-api

Original file line number	Diff line number	Diff line change
`@@ -279,7 +279,10 @@ subprojects {`
`279`	`279`	`exclude(group = "org.springframework.boot", module = "spring-boot-starter-tomcat")`
`280`	`280`	`}`
`281`	`281`	`implementation("org.springframework.boot:spring-boot-starter-undertow") {`
`282`		`- constraints { implementation("org.jboss.xnio:xnio-api:3.8.16.Final") }`
	`282`	`+ constraints {`
	`283`	`+ implementation("org.jboss.xnio:xnio-api:3.8.16.Final")`
	`284`	`+ implementation("io.undertow:undertow-core:2.3.14.Final")`
	`285`	`+ }`
`283`	`286`	`}`
`284`	`287`	`implementation("com.fasterxml.jackson.module:jackson-module-kotlin")`
`285`	`288`	`// https://mvnrepository.com/artifact/jakarta.validation/jakarta.validation-api`