Skip to content

[Security] Bump spring.version from 4.3.18.RELEASE to 5.3.0 in /EIDAS-Parent#114

Closed
dependabot-preview[bot] wants to merge 1 commit into
masterfrom
dependabot/maven/EIDAS-Parent/spring.version-5.3.0
Closed

[Security] Bump spring.version from 4.3.18.RELEASE to 5.3.0 in /EIDAS-Parent#114
dependabot-preview[bot] wants to merge 1 commit into
masterfrom
dependabot/maven/EIDAS-Parent/spring.version-5.3.0

Conversation

@dependabot-preview

Copy link
Copy Markdown

Bumps spring.version from 4.3.18.RELEASE to 5.3.0.
Updates spring-core from 4.3.18.RELEASE to 5.3.0 This update includes a security fix.

Vulnerabilities fixed

Sourced from The GitHub Security Advisory Database.

Denial of Service in Spring Framework Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through the ResourceHttpRequestHandler, or starting in 5.0 when an annotated controller returns an org.springframework.core.io.Resource. A malicious user (or attacker) can add a range header with a high number of ranges, or with wide ranges that overlap, or both, for a denial of service attack. This vulnerability affects applications that depend on either spring-webmvc or spring-webflux. Such applications must also have a registration for serving static resources (e.g. JS, CSS, images, and others), or have an annotated controller that returns an org.springframework.core.io.Resource. Spring Boot applications that depend on spring-boot-starter-web or spring-boot-starter-webflux are ready to serve static resources out of the box and are therefore vulnerable.

Affected versions: < 4.3.20

Release notes

Sourced from spring-core's releases.

v5.3.0

⭐ New Features

  • Allow cache eviction for ConcurrentLruCache #25963
  • Support Optional for query parameters in UriBuilder and UriComponentsBuilder #25951
  • Deprecate StringUtils.isEmpty(Object) and replace remaining usage (e.g. with ObjectUtils.isEmpty) #25945
  • Introduce RouterFunction attributes #25938
  • Discover @Sql, @SqlConfig, @SqlGroup, & @SqlMergeMode on enclosing class for nested test class #25913
  • Support Propagation.NEVER for disabling test-managed transactions #25909
  • Extensible invocation of TcpClient in ReactorNettyTcpClient #25889
  • Ignore duplicate configuration metadata for cache key in the TestContext framework #25800
  • Avoid use of String's for ContentDisposition type #25647
  • Expose access to STOMP SimpleMessageBroker sessions user Principal #25191
  • Allow programmatic registration of completion and error callbacks to transactional event listeners #24163
  • Support suspending functions annotated with @Transactional #23575
  • StompBrokerRelay doesn't send heartbeats to broker when @MessageMapping handles received messages #22822

🪲 Bug Fixes

  • @NestedTestConfiguration should not be discovered on enclosing class for nested interface #25917
  • UriComponentsBuilder controller method argument has no path #25822
  • Support multiple matchers in MockMvc Kotlin DSL #24103

📔 Documentation

  • Document @NestedTestConfiguration support #25912
  • Improve R2DBC DatabaseClient documentation regarding array/Collection-like bind parameters #25860
  • Document @DynamicPropertySource use cases that require @DirtiesContext #25850
  • Use lowercase property names in SpEL examples #25538

🔨 Dependency Upgrades

  • Upgrade to Kotlin Coroutines 1.4.0 #25969
  • Upgrade to RSocket 1.1.0 #25956
  • Upgrade to Reactor 2020.0.0 #25947
  • Upgrade to Gradle 6.7 #25918

❤️ Contributors

We'd like to thank all the contributors who worked on this release!

v5.3.0-RC2

Commits

Updates spring-beans from 4.3.18.RELEASE to 5.3.0

Release notes

Sourced from spring-beans's releases.

v5.3.0

⭐ New Features

  • Allow cache eviction for ConcurrentLruCache #25963
  • Support Optional for query parameters in UriBuilder and UriComponentsBuilder #25951
  • Deprecate StringUtils.isEmpty(Object) and replace remaining usage (e.g. with ObjectUtils.isEmpty) #25945
  • Introduce RouterFunction attributes #25938
  • Discover @Sql, @SqlConfig, @SqlGroup, & @SqlMergeMode on enclosing class for nested test class #25913
  • Support Propagation.NEVER for disabling test-managed transactions #25909
  • Extensible invocation of TcpClient in ReactorNettyTcpClient #25889
  • Ignore duplicate configuration metadata for cache key in the TestContext framework #25800
  • Avoid use of String's for ContentDisposition type #25647
  • Expose access to STOMP SimpleMessageBroker sessions user Principal #25191
  • Allow programmatic registration of completion and error callbacks to transactional event listeners #24163
  • Support suspending functions annotated with @Transactional #23575
  • StompBrokerRelay doesn't send heartbeats to broker when @MessageMapping handles received messages #22822

🪲 Bug Fixes

  • @NestedTestConfiguration should not be discovered on enclosing class for nested interface #25917
  • UriComponentsBuilder controller method argument has no path #25822
  • Support multiple matchers in MockMvc Kotlin DSL #24103

📔 Documentation

  • Document @NestedTestConfiguration support #25912
  • Improve R2DBC DatabaseClient documentation regarding array/Collection-like bind parameters #25860
  • Document @DynamicPropertySource use cases that require @DirtiesContext #25850
  • Use lowercase property names in SpEL examples #25538

🔨 Dependency Upgrades

  • Upgrade to Kotlin Coroutines 1.4.0 #25969
  • Upgrade to RSocket 1.1.0 #25956
  • Upgrade to Reactor 2020.0.0 #25947
  • Upgrade to Gradle 6.7 #25918

❤️ Contributors

We'd like to thank all the contributors who worked on this release!

v5.3.0-RC2

Commits

Updates spring-context from 4.3.18.RELEASE to 5.3.0

Release notes

Sourced from spring-context's releases.

v5.3.0

⭐ New Features

  • Allow cache eviction for ConcurrentLruCache #25963
  • Support Optional for query parameters in UriBuilder and UriComponentsBuilder #25951
  • Deprecate StringUtils.isEmpty(Object) and replace remaining usage (e.g. with ObjectUtils.isEmpty) #25945
  • Introduce RouterFunction attributes #25938
  • Discover @Sql, @SqlConfig, @SqlGroup, & @SqlMergeMode on enclosing class for nested test class #25913
  • Support Propagation.NEVER for disabling test-managed transactions #25909
  • Extensible invocation of TcpClient in ReactorNettyTcpClient #25889
  • Ignore duplicate configuration metadata for cache key in the TestContext framework #25800
  • Avoid use of String's for ContentDisposition type #25647
  • Expose access to STOMP SimpleMessageBroker sessions user Principal #25191
  • Allow programmatic registration of completion and error callbacks to transactional event listeners #24163
  • Support suspending functions annotated with @Transactional #23575
  • StompBrokerRelay doesn't send heartbeats to broker when @MessageMapping handles received messages #22822

🪲 Bug Fixes

  • @NestedTestConfiguration should not be discovered on enclosing class for nested interface #25917
  • UriComponentsBuilder controller method argument has no path #25822
  • Support multiple matchers in MockMvc Kotlin DSL #24103

📔 Documentation

  • Document @NestedTestConfiguration support #25912
  • Improve R2DBC DatabaseClient documentation regarding array/Collection-like bind parameters #25860
  • Document @DynamicPropertySource use cases that require @DirtiesContext #25850
  • Use lowercase property names in SpEL examples #25538

🔨 Dependency Upgrades

  • Upgrade to Kotlin Coroutines 1.4.0 #25969
  • Upgrade to RSocket 1.1.0 #25956
  • Upgrade to Reactor 2020.0.0 #25947
  • Upgrade to Gradle 6.7 #25918

❤️ Contributors

We'd like to thank all the contributors who worked on this release!

v5.3.0-RC2

Commits

Updates spring-context-support from 4.3.18.RELEASE to 5.3.0

Release notes

Sourced from spring-context-support's releases.

v5.3.0

⭐ New Features

  • Allow cache eviction for ConcurrentLruCache #25963
  • Support Optional for query parameters in UriBuilder and UriComponentsBuilder #25951
  • Deprecate StringUtils.isEmpty(Object) and replace remaining usage (e.g. with ObjectUtils.isEmpty) #25945
  • Introduce RouterFunction attributes #25938
  • Discover @Sql, @SqlConfig, @SqlGroup, & @SqlMergeMode on enclosing class for nested test class #25913
  • Support Propagation.NEVER for disabling test-managed transactions #25909
  • Extensible invocation of TcpClient in ReactorNettyTcpClient #25889
  • Ignore duplicate configuration metadata for cache key in the TestContext framework #25800
  • Avoid use of String's for ContentDisposition type #25647
  • Expose access to STOMP SimpleMessageBroker sessions user Principal #25191
  • Allow programmatic registration of completion and error callbacks to transactional event listeners #24163
  • Support suspending functions annotated with @Transactional #23575
  • StompBrokerRelay doesn't send heartbeats to broker when @MessageMapping handles received messages #22822

🪲 Bug Fixes

  • @NestedTestConfiguration should not be discovered on enclosing class for nested interface #25917
  • UriComponentsBuilder controller method argument has no path #25822
  • Support multiple matchers in MockMvc Kotlin DSL #24103

📔 Documentation

  • Document @NestedTestConfiguration support #25912
  • Improve R2DBC DatabaseClient documentation regarding array/Collection-like bind parameters #25860
  • Document @DynamicPropertySource use cases that require @DirtiesContext #25850
  • Use lowercase property names in SpEL examples #25538

🔨 Dependency Upgrades

  • Upgrade to Kotlin Coroutines 1.4.0 #25969
  • Upgrade to RSocket 1.1.0 #25956
  • Upgrade to Reactor 2020.0.0 #25947
  • Upgrade to Gradle 6.7 #25918

❤️ Contributors

We'd like to thank all the contributors who worked on this release!

v5.3.0-RC2

Commits

Updates spring-web from 4.3.18.RELEASE to 5.3.0

Release notes

Sourced from spring-web's releases.

v5.3.0

⭐ New Features

  • Allow cache eviction for ConcurrentLruCache #25963
  • Support Optional for query parameters in UriBuilder and UriComponentsBuilder #25951
  • Deprecate StringUtils.isEmpty(Object) and replace remaining usage (e.g. with ObjectUtils.isEmpty) #25945
  • Introduce RouterFunction attributes #25938
  • Discover @Sql, @SqlConfig, @SqlGroup, & @SqlMergeMode on enclosing class for nested test class #25913
  • Support Propagation.NEVER for disabling test-managed transactions #25909
  • Extensible invocation of TcpClient in ReactorNettyTcpClient #25889
  • Ignore duplicate configuration metadata for cache key in the TestContext framework #25800
  • Avoid use of String's for ContentDisposition type #25647
  • Expose access to STOMP SimpleMessageBroker sessions user Principal #25191
  • Allow programmatic registration of completion and error callbacks to transactional event listeners #24163
  • Support suspending functions annotated with @Transactional #23575
  • StompBrokerRelay doesn't send heartbeats to broker when @MessageMapping handles received messages #22822

🪲 Bug Fixes

  • @NestedTestConfiguration should not be discovered on enclosing class for nested interface #25917
  • UriComponentsBuilder controller method argument has no path #25822
  • Support multiple matchers in MockMvc Kotlin DSL #24103

📔 Documentation

  • Document @NestedTestConfiguration support #25912
  • Improve R2DBC DatabaseClient documentation regarding array/Collection-like bind parameters #25860
  • Document @DynamicPropertySource use cases that require @DirtiesContext #25850
  • Use lowercase property names in SpEL examples #25538

🔨 Dependency Upgrades

  • Upgrade to Kotlin Coroutines 1.4.0 #25969
  • Upgrade to RSocket 1.1.0 #25956
  • Upgrade to Reactor 2020.0.0 #25947
  • Upgrade to Gradle 6.7 #25918

❤️ Contributors

We'd like to thank all the contributors who worked on this release!

v5.3.0-RC2

Commits

Updates spring-test from 4.3.18.RELEASE to 5.3.0

Release notes

Sourced from spring-test's releases.

v5.3.0

⭐ New Features

  • Allow cache eviction for ConcurrentLruCache #25963
  • Support Optional for query parameters in UriBuilder and UriComponentsBuilder #25951
  • Deprecate StringUtils.isEmpty(Object) and replace remaining usage (e.g. with ObjectUtils.isEmpty) #25945
  • Introduce RouterFunction attributes #25938
  • Discover @Sql, @SqlConfig, @SqlGroup, & @SqlMergeMode on enclosing class for nested test class #25913
  • Support Propagation.NEVER for disabling test-managed transactions #25909
  • Extensible invocation of TcpClient in ReactorNettyTcpClient #25889
  • Ignore duplicate configuration metadata for cache key in the TestContext framework #25800
  • Avoid use of String's for ContentDisposition type #25647
  • Expose access to STOMP SimpleMessageBroker sessions user Principal #25191
  • Allow programmatic registration of completion and error callbacks to transactional event listeners #24163
  • Support suspending functions annotated with @Transactional #23575
  • StompBrokerRelay doesn't send heartbeats to broker when @MessageMapping handles received messages #22822

🪲 Bug Fixes

  • @NestedTestConfiguration should not be discovered on enclosing class for nested interface #25917
  • UriComponentsBuilder controller method argument has no path #25822
  • Support multiple matchers in MockMvc Kotlin DSL #24103

📔 Documentation

  • Document @NestedTestConfiguration support #25912
  • Improve R2DBC DatabaseClient documentation regarding array/Collection-like bind parameters #25860
  • Document @DynamicPropertySource use cases that require @DirtiesContext #25850
  • Use lowercase property names in SpEL examples #25538

🔨 Dependency Upgrades

  • Upgrade to Kotlin Coroutines 1.4.0 #25969
  • Upgrade to RSocket 1.1.0 #25956
  • Upgrade to Reactor 2020.0.0 #25947
  • Upgrade to Gradle 6.7 #25918

❤️ Contributors

We'd like to thank all the contributors who worked on this release!

v5.3.0-RC2

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  • @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
  • @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
  • @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
  • @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language
  • @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

  • Update frequency (including time of day and day of week)
  • Pull request limits (per update run and/or open at any time)
  • Out-of-range updates (receive only lockfile updates, if desired)
  • Security updates (receive only security updates, if desired)

Bumps `spring.version` from 4.3.18.RELEASE to 5.3.0.

Updates `spring-core` from 4.3.18.RELEASE to 5.3.0
- [Release notes](https://github.com/spring-projects/spring-framework/releases)
- [Commits](spring-projects/spring-framework@v4.3.18.RELEASE...v5.3.0)

Updates `spring-beans` from 4.3.18.RELEASE to 5.3.0
- [Release notes](https://github.com/spring-projects/spring-framework/releases)
- [Commits](spring-projects/spring-framework@v4.3.18.RELEASE...v5.3.0)

Updates `spring-context` from 4.3.18.RELEASE to 5.3.0
- [Release notes](https://github.com/spring-projects/spring-framework/releases)
- [Commits](spring-projects/spring-framework@v4.3.18.RELEASE...v5.3.0)

Updates `spring-context-support` from 4.3.18.RELEASE to 5.3.0
- [Release notes](https://github.com/spring-projects/spring-framework/releases)
- [Commits](spring-projects/spring-framework@v4.3.18.RELEASE...v5.3.0)

Updates `spring-web` from 4.3.18.RELEASE to 5.3.0
- [Release notes](https://github.com/spring-projects/spring-framework/releases)
- [Commits](spring-projects/spring-framework@v4.3.18.RELEASE...v5.3.0)

Updates `spring-test` from 4.3.18.RELEASE to 5.3.0
- [Release notes](https://github.com/spring-projects/spring-framework/releases)
- [Commits](spring-projects/spring-framework@v4.3.18.RELEASE...v5.3.0)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
@dependabot-preview dependabot-preview Bot added dependencies Pull requests that update a dependency file security Pull requests that address a security vulnerability labels Oct 28, 2020
@dependabot-preview

Copy link
Copy Markdown
Author

Superseded by #117.

@dependabot-preview
dependabot-preview Bot deleted the dependabot/maven/EIDAS-Parent/spring.version-5.3.0 branch November 11, 2020 05:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file security Pull requests that address a security vulnerability

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants