Skip to content

Commit 9b6538d

Browse files
committed
Upgrade to Groovy 2.4.4
Typically, a Spring Boot maintenance release would not move to a new minor version of a dependency. However there is a security vulnerability in Groovy [1] and 2.4.4 is the only release which contains a fix for it. The commit upgrades to 2.4.4, thereby ensuring that users of Groovy are not vulnerable by default. Users of Groovy whose applications are not affected by the vulnerability may choose to downgrade back to 2.3.11 by overriding Spring Boot's dependency management. Closes gh-3540 [1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3253
1 parent d2d7193 commit 9b6538d

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

spring-boot-dependencies/pom.xml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@
6666
<gemfire.version>7.0.2</gemfire.version>
6767
<glassfish-el.version>3.0.0</glassfish-el.version>
6868
<gradle.version>1.6</gradle.version>
69-
<groovy.version>2.3.11</groovy.version>
69+
<groovy.version>2.4.4</groovy.version>
7070
<gson.version>2.3.1</gson.version>
7171
<h2.version>1.4.187</h2.version>
7272
<hamcrest.version>1.3</hamcrest.version>

0 commit comments

Comments
 (0)