Reverting spring-boot version changes and inoring: CVE-2024-38821 as …

…only relevant for WebFlex apps.
aehrc · Jan 31, 2025 · e33d78e · e33d78e
1 parent 7f75508
commit e33d78e
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 2 deletions.
diff --git a/.trivyignore b/.trivyignore
@@ -64,3 +64,7 @@ CVE-2022-1471
 # This vulnerability relates to privilege management using spark-submit, which is outside of the
 # scope of this solution.
 CVE-2023-22946
+
+
+# This vulnerability relates to WebFlex applications, which are not used in Pathling.
+CVE-2024-38821
diff --git a/pom.xml b/pom.xml
@@ -79,8 +79,8 @@
     <pathling.hadoopVersion>3.3.4</pathling.hadoopVersion>
     <pathling.hadoopMajorVersion>3</pathling.hadoopMajorVersion>
     <pathling.hapiFhirVersion>7.0.2</pathling.hapiFhirVersion>
-    <pathling.springBootVersion>3.2.12</pathling.springBootVersion>
-    <pathling.springSecurityVersion>6.2.8</pathling.springSecurityVersion>
+    <pathling.springBootVersion>3.2.0</pathling.springBootVersion>
+    <pathling.springSecurityVersion>6.2.0</pathling.springSecurityVersion>
     <pathling.antlrVersion>4.9.3</pathling.antlrVersion>
     <pathling.dockerJavaVersion>3.3.4</pathling.dockerJavaVersion>
     <pathling.awsSdkVersion>1.12.603</pathling.awsSdkVersion>