[Snyk] Fix for 1 vulnerabilities

[samsnyk]

Snyk has created this PR to fix 1 vulnerabilities in the maven dependencies of this project.

Snyk changed the following file(s):

• pom.xml

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score	Upgrade
	Allocation of Resources Without Limits or Throttling SNYK-JAVA-COMFASTERXMLJACKSONCORE-15907551	125	org.springdoc:springdoc-openapi-ui: 1.6.5 -> 1.7.0 Major version upgrade No Known Exploit

Breaking Change Risk

Notice: This assessment is enhanced by AI.

Vulnerabilities that could not be fixed

• Upgrade:
  • Could not upgrade com.fasterxml.jackson.core:jackson-databind@2.13.1 to com.fasterxml.jackson.core:jackson-databind@2.21.2; Reason could not apply upgrade, dependency is managed externally ; Location: https://maven-central.storage-download.googleapis.com/maven2/com/fasterxml/jackson/jackson-bom/2.13.1/jackson-bom-2.13.1.pom
• Could not upgrade com.fasterxml.jackson.datatype:jackson-datatype-jsr310@2.13.1 to com.fasterxml.jackson.datatype:jackson-datatype-jsr310@2.21.2; Reason could not apply upgrade, dependency is managed externally ; Location: https://maven-central.storage-download.googleapis.com/maven2/com/fasterxml/jackson/jackson-bom/2.13.1/jackson-bom-2.13.1.pom
• Could not upgrade org.springframework.boot:spring-boot-starter-web@2.6.3 to org.springframework.boot:spring-boot-starter-web@3.5.13; Reason could not apply upgrade, dependency is managed externally ; Location: https://maven-central.storage-download.googleapis.com/maven2/org/springframework/boot/spring-boot-dependencies/2.6.3/spring-boot-dependencies-2.6.3.pom

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Allocation of Resources Without Limits or Throttling

[samsnyk]

This upgrade includes a major version increase for Spring Boot from 2.x to 3.x, which introduces significant breaking changes. The other upgrades are minor and less likely to cause issues, but the Spring Boot migration requires careful attention.

org.springframework.boot:spring-boot-starter-web from 2.6.3 to 3.5.13 (HIGH RISK)

This is a major upgrade with several critical breaking changes that require developer action:

• Java 17 Baseline: Spring Boot 3.0 requires Java 17 or later. Applications must be upgraded from Java 8 or 11.
• Jakarta EE 9 Namespace: All Java EE APIs have been replaced with Jakarta EE equivalents. This requires changing package imports from javax.* to jakarta.* across the application. This is a significant source of breaking changes.
• Configuration Property Changes: Numerous configuration properties have been renamed or removed. For example, server.max.http.header.size is now server.max-http-request-header-size. It is recommended to use the spring-boot-properties-migrator module to help identify and temporarily migrate these properties.
• Spring Security 6.0: Spring Boot 3.0 uses Spring Security 6.0, which has its own set of breaking changes. The WebSecurityConfigurerAdapter has been removed in favor of a component-based security configuration. It is recommended to first migrate to Spring Security 5.8 within your Spring Boot 2.7 application before upgrading to Spring Boot 3.0.
• URL Matching Changes: The default strategy for trailing slash matching in Spring MVC has changed, which could affect how your application's endpoints are resolved.

com.fasterxml.jackson.core:jackson-databind from 2.13.1 to 2.21.2 (LOW RISK)

This is a minor version upgrade. While it spans several versions, there are no major breaking API changes documented. Key changes include:

• The JDK baseline was raised to Java 8 starting with version 2.14.
• New features and security constraints have been added, such as limits on maximum string length and nesting depth to prevent denial-of-service attacks.
• Version 2.17 introduced a new feature DeserializationFeature.FAIL_ON_UNEXPECTED_VIEW_PROPERTIES.

org.springdoc:springdoc-openapi-ui from 1.6.5 to 1.7.0 (LOW RISK)

This is a minor update. Version 1.7.0 is the last major open-source release that supports Spring Boot 2.x. For Spring Boot 3.x, you must migrate to the springdoc-openapi-starter-webmvc-ui artifact (or similar) in the 2.x line of springdoc. There was a bug in 1.7.0 related to using a provided spec which was fixed in a patch.

Recommendation:

This upgrade cannot be merged directly. A dedicated migration effort is required to address the breaking changes in Spring Boot 3. Start by upgrading your application to the latest Spring Boot 2.7.x release and Java 17. Then, follow the official Spring Boot 3.0 Migration Guide to address the Jakarta EE namespace changes, security configurations, and updated properties.

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.