From f54d820f2ddd6244d6c25e07a5824de25d1a7b99 Mon Sep 17 00:00:00 2001
From: Michael Folz <folz@med.uni-frankfurt.de>
Date: Tue, 23 Apr 2024 13:55:00 +0200
Subject: [PATCH] #282 - Update Spring Boot

- update spring boot to 3.2.5
- remove manual netty-codec-http dependency inclusion since the vulnerable version is addressed in the spring boot update
- remove manual snakeyaml depdendency inclusion since it was also updated in spring boot in the meantime
---
 pom.xml | 23 +----------------------
 1 file changed, 1 insertion(+), 22 deletions(-)

diff --git a/pom.xml b/pom.xml
index 29a355d3..e116173f 100644
--- a/pom.xml
+++ b/pom.xml
@@ -5,7 +5,7 @@
   <parent>
     <groupId>org.springframework.boot</groupId>
     <artifactId>spring-boot-starter-parent</artifactId>
-    <version>3.2.4</version>
+    <version>3.2.5</version>
     <relativePath /> <!-- lookup parent from repository -->
   </parent>
 
@@ -61,22 +61,9 @@
       <artifactId>spring-boot-starter-data-jpa</artifactId>
     </dependency>
 
-    <!-- Fix CVE-2024-29025. Remove exclusion and manual inclusion when update is included in spring-boot-starter-webflux -->
     <dependency>
       <groupId>org.springframework.boot</groupId>
       <artifactId>spring-boot-starter-webflux</artifactId>
-      <exclusions>
-        <exclusion>
-          <groupId>io.netty</groupId>
-          <artifactId>netty-codec-http</artifactId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-
-    <dependency>
-      <groupId>io.netty</groupId>
-      <artifactId>netty-codec-http</artifactId>
-      <version>4.1.108.Final</version>
     </dependency>
 
     <dependency>
@@ -293,14 +280,6 @@
       <scope>test</scope>
     </dependency>
 
-    <!-- This dependency is only added to address a vulnerability in  org.springframework.boot-->
-    <!-- Remove this once the vulnerability is adressed in the next version -->
-    <dependency>
-      <groupId>org.yaml</groupId>
-      <artifactId>snakeyaml</artifactId>
-      <version>2.0</version>
-    </dependency>
-
     <dependency>
       <groupId>io.projectreactor</groupId>
       <artifactId>reactor-test</artifactId>