springdoc-openapi-starter 2.8.13 has a commons-lang3:3.17.0 is vulnerable

[zhaoxi2000]

https://www.mend.io/jetbrains-lp/?utm_source=JetBrains

[msamborski-orbis]

I'm wondering if this is a false positive report. swagger-core-jakarta:2.2.35 fixed this vulnerability when it upgraded to commons-lang3:3.18.0. but my IntelliJ is also throwing this vulnerability while saying that it is using swagger-core-jakarta:2.2.36

[msamborski-orbis]

I'm wondering if this is a false positive report. swagger-core-jakarta:2.2.35 fixed this vulnerability when it upgraded to commons-lang3:3.18.0. but my IntelliJ is also throwing this vulnerability while saying that it is using swagger-core-jakarta:2.2.36

I did a dependencies --scan and looked into what was going on with commons-lang being 3.17 and found that there are a bunch of version conflict in the build plugins that are causing 3.17 to be selected by rule instead of 3.18 like the actual version numbers suggest.

I'm finding that openapi generator and spring boot are the cause of the 3.17 fallback

[msamborski-orbis]

I'm wondering if this is a false positive report. swagger-core-jakarta:2.2.35 fixed this vulnerability when it upgraded to commons-lang3:3.18.0. but my IntelliJ is also throwing this vulnerability while saying that it is using swagger-core-jakarta:2.2.36

I did a dependencies --scan and looked into what was going on with commons-lang being 3.17 and found that there are a bunch of version conflict in the build plugins that are causing 3.17 to be selected by rule instead of 3.18 like the actual version numbers suggest.

I'm finding that openapi generator and spring boot are the cause of the 3.17 fallback

OpenAPITools/openapi-generator#21971 looks to be an open issue in the OpenAPITools repo to fix this problem.

And despite spring boot getting 3.5.6 yesterday, looks like Spring Boot Buildpack Platform is still using commons-compress 1.27.1 which uses commons-lang 3.16.0