apache / apache/linkis

[Feature][Linkis] Security Work Order Repair - Spring Framework Related Dependency Version Upgrade

Open
#5,315 1 comment 0 reactions 0 assignees View on GitHub
feature
Dominant language
Java
Stars
3.4k
Forks
1.2k
PR merge metrics
No merged PRs in 30d

Description

### Search before asking


- [x] I had searched in the `https://github.com/apache/linkis/issues` and found no similar feature requirement.



### Problem Description


Linkis使用的Spring框架相关依赖版本存在安全漏洞,需要升级Spring Framework、Spring Security和Spring Boot到安全版本。

### Description


1. spring-framework.version: 从5.3.27升级到5.3.34,修复已知安全漏洞
2. spring-security.version: 从5.7.8升级到5.7.11,修复已知安全漏洞
3. spring.boot.version: 从2.7.11升级到2.7.12,修复已知安全漏洞
4. 确保升级后的依赖与现有代码兼容

### Use case


确保Linkis系统在生产环境中的安全性,修复已知的Spring框架相关漏洞。

### Solutions


1. 升级spring-framework.version到5.3.34
2. 升级spring-security.version到5.7.11
3. 升级spring.boot.version到2.7.12
4. 验证所有依赖升级后的兼容性和稳定性
5. 进行全面的测试验证

### Anything else


none

### Are you willing to submit a PR?


- [ ] Yes I am willing to submit a PR!

Contributor guide

Open the contributing guide

Research direction

Locate the declarations for spring-framework.version, spring-security.version, and spring.boot.version in the project build configuration. Update them to 5.3.34, 5.7.11, and 2.7.12, then run the existing test suite and verify that the dependency upgrades remain compatible and stable.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, spring, spring-boot
Domain
build-system, security
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.