[Snyk] Upgrade org.thymeleaf.extras:thymeleaf-extras-springsecurity5 from 3.0.4.RELEASE to 3.1.3.RELEASE#6
Conversation
…om 3.0.4.RELEASE to 3.1.3.RELEASE Snyk has created this PR to upgrade org.thymeleaf.extras:thymeleaf-extras-springsecurity5 from 3.0.4.RELEASE to 3.1.3.RELEASE. See this package in maven: org.thymeleaf.extras:thymeleaf-extras-springsecurity5 See this project in Snyk: https://app.snyk.io/org/r4devopsdotcom/project/4288e90f-f21f-499f-9be2-cbb7492d3f78?utm_source=github&utm_medium=referral&page=upgrade-pr
There was a problem hiding this comment.
Pull request overview
Updates a Maven dependency version to address a reported vulnerability in the Thymeleaf Spring Security extras module used by this Spring Boot application.
Changes:
- Bumps
org.thymeleaf.extras:thymeleaf-extras-springsecurity5from3.0.4.RELEASEto3.1.3.RELEASE.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| <dependency> | ||
| <groupId>org.thymeleaf.extras</groupId> | ||
| <artifactId>thymeleaf-extras-springsecurity5</artifactId> | ||
| <version>3.0.4.RELEASE</version> | ||
| <version>3.1.3.RELEASE</version> | ||
| </dependency> |
There was a problem hiding this comment.
Project is on Spring Boot 3.0.6 (Spring Security 6), but this dependency is the springsecurity5 dialect. Upgrading its version may still leave you with an incompatible dialect or introduce classpath conflicts (e.g., pulling Spring Security 5 artifacts alongside Security 6). Consider switching to org.thymeleaf.extras:thymeleaf-extras-springsecurity6 (and ideally rely on Spring Boot dependency management for the version) to match the Spring Security major used by Boot 3.
2 participants
Snyk has created this PR to upgrade org.thymeleaf.extras:thymeleaf-extras-springsecurity5 from 3.0.4.RELEASE to 3.1.3.RELEASE.
ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.
The recommended version is 8 versions ahead of your current version.
The recommended version was released a year ago.
Issues fixed by the recommended upgrade:
SNYK-JAVA-ORGTHYMELEAFEXTRAS-572299
Important
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.
For more information: