We have a Spring Boot based project that uses Maven as the build tool. We recently encountered that the Spring-Beans(5.2.13) which is a transitive dependency has been reported to have the vulnerability CVE-22-2965
The parent pom contains the spring-boot-starter-parent
<parent>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-parent</artifactId>
<version>2.3.9.RELEASE</version>
</parent>
The transitive dependency of Spring-Beans(5.2.13.RELEASE) is getting added by spring-boot-starter-web-2.3.9.RELEASE.jar
To fix the vulnerability we have tried following two approach :
1) Added a new spring-beans version in the dependency section of parent pom.xml
<dependency>
<groupId>org.springframework</groupId>
<artifactId>spring-beans</artifactId>
<version>5.2.22.RELEASE</version>
</dependency>
<dependency>
<groupId>org.springframework</groupId>
<artifactId>spring-core</artifactId>
<version>5.3.20</version>
</dependency>
Also, we had to update the Spring-core to 5.3.20 from 5.2.13 as we were getting
incompatibility issues
2) Updating the spring-boot-starter-parent to latest version
<parent>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-parent</artifactId>
<version>2.7.0</version>
<type>pom</type>
</parent>
In the second approach we are facing following error and build failure
java.lang.NoSuchMethodError: org.mockito.Answers.get()Lorg/mockito/stubbing/Answer;
java.lang.NoClassDefFoundError: Could not initialize class org.mockito.Mockito
at org.apache.maven.surefire.junit4.JUnit4Provider.execute(JUnit4Provider.java:365)
at org.apache.maven.surefire.junit4.JUnit4Provider.executeWithRerun(JUnit4Provider.java:273)
at org.apache.maven.surefire.junit4.JUnit4Provider.executeTestSet(JUnit4Provider.java:238)
at org.apache.maven.surefire.junit4.JUnit4Provider.invoke(JUnit4Provider.java:159)
Which is the better approach and is there another way in which we can update the version and remove the Vulnerability .What is the correct method to do it?
Related
I have a spring batch dependency in my pom.xml declared as below:
<dependency>
<groupId>org.springframework.batch</groupId>
<artifactId>spring-batch-core</artifactId>
<version>3.0.9.RELEASE</version>
</dependency>
There is one artifact xstream that is included by above with version 1.4.7 and it needs to be updated to 1.4.11.
It can be added as follow:
<groupId>com.thoughtworks.xstream</groupId>
<artifactId>xstream</artifactId>
<version>1.4.11</version>
</dependency>
What is the correct way for this?I am thinking of following approach:
Both above pieces of code will be there but do I need to use < exclusions > to specifically exclude xstream artifact old version from spring-batch-core or does maven takes care of this automatically?
Better way will be using <dependencyManagement/> tag. Dependency management will make sure the version will be maintained even if some other transitive dependency brings higher version of the dependency.
Usage:
<dependencyManagement>
<dependencies>
<dependency>
<groupId>com.thoughtworks.xstream</groupId>
<artifactId>xstream</artifactId>
<version>1.4.11</version>
</dependency>
</dependencies>
</dependencyManagement>
Note: dependencyManagement tag is used for defining the version and scope (if not in the default scope which is compile) of a dependency it does not add the dependencies in it to you project, you must define separate <dependencies/> section in your pom.xml for adding dependencies to your project.
In your case it will be like.
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
...
<dependencyManagement>
<dependencies>
<dependency>
<groupId>com.thoughtworks.xstream</groupId>
<artifactId>xstream</artifactId>
<version>1.4.11</version>
</dependency>
</dependencies>
...
</dependencyManagement>
<dependencies>
<dependency>
<groupId>org.springframework.batch</groupId>
<artifactId>spring-batch-core</artifactId>
<version>3.0.9.RELEASE</version>
</dependency>
...
</dependencies>
...
</project>
In this case spring-batch-core is added as a direct dependency and if it has xstream as dependecny you project will use 1.4.11 version even spring-batch-core has a different version of xstream as dependency.
Ref: Dependency Management
In my Spring Boot(2.0.5) project I was using Elasticsearch(5.6.9). However, due to some bugs in testing environment we are moving to Spring boot(2.1.0).
When I run the application the following message comes up:
***************************
APPLICATION FAILED TO START
***************************
Description:
An attempt was made to call the method org.elasticsearch.action.admin.indices.mapping.put.PutMappingRequestBuilder.execute()Lorg/elasticsearch/action/ActionFuture; but it does not exist. Its class, org.elasticsearch.action.admin.indices.mapping.put.PutMappingRequestBuilder, is available from the following locations:
jar:file:/C:/Users/User/.m2/repository/org/elasticsearch/elasticsearch/5.6.9/elasticsearch-5.6.9.jar!/org/elasticsearch/action/admin/indices/mapping/put/PutMappingRequestBuilder.class
It was loaded from the following location:
file:/C:/Users/User/.m2/repository/org/elasticsearch/elasticsearch/5.6.9/elasticsearch-5.6.9.jar
Action:
Correct the classpath of your application so that it contains a single, compatible version of org.elasticsearch.action.admin.indices.mapping.put.PutMappingRequestBuilder
Process finished with exit code 0
Current pom.xml file
<parent>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-parent</artifactId>
<version>2.1.0.RELEASE</version>
<relativePath/>
</parent>
<properties>
<elasticsearch.version>5.6.9</elasticsearch.version>
</properties>
<dependencies>
<!--...others...-->
<!--ELASTICSEARCH-->
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-data-elasticsearch</artifactId>
</dependency>
<dependency>
<groupId>org.elasticsearch.client</groupId>
<artifactId>transport</artifactId>
<version>${elasticsearch.version}</version>
</dependency>
<dependency>
<groupId>org.elasticsearch.plugin</groupId>
<artifactId>transport-netty4-client</artifactId>
<version>${elasticsearch.version}</version>
</dependency>
</dependencies>
Previous pom.xml file which worked fine:
<parent>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-parent</artifactId>
<version>2.0.5.RELEASE</version>
<relativePath/>
</parent>
<properties>
<elasticsearch.version>5.6.9</elasticsearch.version>
</properties>
<dependencies>
<!--...others...-->
<!--ELASTICSEARCH-->
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-data-elasticsearch</artifactId>
</dependency>
<dependency>
<groupId>org.elasticsearch.client</groupId>
<artifactId>transport</artifactId>
<version>${elasticsearch.version}</version>
</dependency>
<dependency>
<groupId>org.elasticsearch.plugin</groupId>
<artifactId>transport-netty4-client</artifactId>
<version>${elasticsearch.version}</version>
</dependency>
</dependencies>
Can someone tell which version of elasticsearch is compatible with Spring Boot 2.1.0?
I read through similar questions which were outdated.
Compatible versions of Spring boot,elasticsearch and spring data elasticsearch
You can go to Spring Boot project Github repository and check any dependency version:
In Spring Boot 2.0.x Elasticsearch version is defined as 5.6.16 (link)
In Spring Boot 2.1.x Elasticsearch version is defined as 6.4.3
(link)
Not sure if it's still actual, but the first thing you need to try is to add core Elasticsearch library, because REST client depends on it.
<dependency>
<groupId>org.elasticsearch</groupId>
<artifactId>elasticsearch</artifactId>
<version>6.7.0</version>
</dependency>
I am making a new springboot- maven project. The compiler is unable to resolve #RestController when I use below pom.xml
<parent>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-parent</artifactId>
<version>2.0.3.RELEASE</version>
</parent>
<dependencies>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-web</artifactId>
</dependency>
</dependencies>
However, when I change the version to 1.5.13, the compiler is able to resolve #RestController
<parent>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-parent</artifactId>
<version>1.5.13.RELEASE</version>
</parent>
<dependencies>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-web</artifactId>
</dependency>
</dependencies>
I want to be using the latest version of spring boot, and use #RestController.
#RestController doesn't come from org.springframework.boot:spring-boot-starter-web, it comes from org.springframework:spring-web. Different versions of spring-boot-starter-web must probably have some transient dependency that provides it, but it's a bad practice to rely on it. If you use #RestController in your code, you should explicitly require the artifact that provides it:
<dependency>
<groupId>org.springframework</groupId>
<artifactId>spring-web</artifactId>
<version>5.0.7.RELEASE</version>
</dependency>
since i can't add a comment, i think the maven config is not your problem, check your #Configuration and #SpringBootApplication classes and their path scanning settings
another problem you could have: maybe one of your other dependencies still depends on springboot 1.5, you have to have a clean springboot 2.0 classpath
i run in problems like this as well, so keep on diggin, you'll find it ;-)
I had somewhat a similar issue and it was because I named my class RestController. Once I renamed it Controller, I could import the #RestController packages without issues.
I have been trying for several days to get the spring boot 15 minute hello world working. I keep encountering the following error:
Exception in thread "main" java.lang.NoSuchMethodError: org.slf4j.spi.LocationAwareLogger.log(Lorg/slf4j/Marker;Ljava/lang/String;ILjava/lang/String;[Ljava/lang/Object;Ljava/lang/Throwable;)V
at org.apache.commons.logging.impl.SLF4JLocationAwareLog.warn(SLF4JLocationAwareLog.java:179)
at org.springframework.boot.SpringApplicationRunListeners.callFinishedListener(SpringApplicationRunListeners.java:91)
at org.springframework.boot.SpringApplicationRunListeners.finished(SpringApplicationRunListeners.java:72)
at org.springframework.boot.SpringApplication.handleRunFailure(SpringApplication.java:810)
at org.springframework.boot.SpringApplication.run(SpringApplication.java:324)
at org.springframework.boot.SpringApplication.run(SpringApplication.java:1185)
at org.springframework.boot.SpringApplication.run(SpringApplication.java:1174)
at com.symphony.Application.main(Application.java:11)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:497)
at com.intellij.rt.execution.application.AppMain.main(AppMain.java:147)
I know this question appears elsewhere on the site, I have tried countless things and nothing works. I am using IntelliJ 2016.1.3, Java version 1.8.0._60.
My pom.xml is:
<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
<modelVersion>4.0.0</modelVersion>
<groupId>com.spring</groupId>
<artifactId>com.spring</artifactId>
<version>1.0-SNAPSHOT</version>
<parent>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-parent</artifactId>
<version>1.3.7.RELEASE</version>
</parent>
<properties>
<java.version>1.8</java.version>
</properties>
<dependencies>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter</artifactId>
</dependency>
<dependency>
<groupId>org.springframework</groupId>
<artifactId>spring-web</artifactId>
</dependency>
<dependency>
<groupId>com.fasterxml.jackson.core</groupId>
<artifactId>jackson-databind</artifactId>
</dependency>
</dependencies>
<build>
<plugins>
<plugin>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-maven-plugin</artifactId>
</plugin>
</plugins>
</build>
</project>
I have tried maven clean from IntelliJ and no luck.
EDIT: Screenshot added to show everything being pulled into project.
Maven Dependencies
UPDATE: Completely uninstalled maven 3.3.9 and only have the built in maven from IntelliJ ultimate. Still not working, extremely frustrating. Over a week into this and can't get the 15 minute demo working.
You appear to have an incompatibility with versions of logging frameworks. See if replacing the spring-boot-starter and spring-web artifacts with spring-boot-starter-web helps, as per the current Getting Started guide.
Update
I was able to configure and build the Spring Getting Started guide down to the Add Unit Tests heading without error on Intellij Ultimate 2016.2 using its own embedded Maven 3, and on the command-line using Maven 3.1.1 and Java 8 (1.8.0_31-b13).
I found significant build errors and/or execution errors when I:
changed the Maven configuration in Intellij to use Maven 2
compiled with the spring-boot-starter and spring-web artifacts rather than spring-boot-starter-web.
I think your problem is a build configuration error. Whenever I get these, I go back to command-line to build and run just to be sure the problem isn't an artifact of some IDE bug.
I've run in the same problem, but got it solved by excluding logback-classic
So my pom now Looks like this:
<dependencies>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-web</artifactId>
<exclusions>
<exclusion>
<groupId>ch.qos.logback</groupId>
<artifactId>logback-classic</artifactId>
</exclusion>
</exclusions>
</dependency>
</dependencies>
If you're in Eclipse (idk, if IntelliJ has this Feature too) and look at the dependency hierarchy tab, you'll see, spring-boot itself implements multiple slf4j-apis.
Visualization of the dependency hierarchy filtered by "slf4j"
I know it may be too late for you, but your post was one of the first result by Google, so maybe it'll help someone else.
your pom lists java 8, but you said you are using java 6 for the project. make sure your project is pointing to a Java 8 ddk.
I'm trying to get a spring bean in a web application using it:
WebApplicationContext wac = WebApplicationContextUtils.getRequiredWebApplicationContext(getServletContext());
AClass aClass = (aClass) wac.getBean("aClass");
And, when I run compile/test/package with maven, an error occurs:
cannot access org.springframework.core.env.EnvironmentCapable
[ERROR] class file for org.springframework.core.env.EnvironmentCapable not found
The most strange is that org.springframework.core.env.EnvironmentCapable exists! :/
Basic Project Configuration:
Spring 3.1.1.RELEASE (There isn't other spring version in classpath)
Maven 3
JSF 2.1
Servlet API 2.5
Any idea is welcome!
Finally, I've solved it! :)
In the pom.xml file, I had to define the scope of spring's dependencies to compile. (Yes, I know that is the default scope of dependencies but for some reason maven was not capable of the job). See a piece of my pom.xml that made the problem disapear:
<dependency>
<groupId>org.springframework</groupId>
<artifactId>spring-core</artifactId>
<version>${spring.version}</version>
<scope>compile</scope>
</dependency>
<dependency>
<groupId>org.springframework</groupId>
<artifactId>spring-beans</artifactId>
<version>${spring.version}</version>
<scope>compile</scope>
</dependency>
<dependency>
<groupId>org.springframework</groupId>
<artifactId>spring-context</artifactId>
<version>${spring.version}</version>
<scope>compile</scope>
</dependency>
<dependency>
<groupId>org.springframework</groupId>
<artifactId>spring-orm</artifactId>
<version>${spring.version}</version>
<scope>compile</scope>
</dependency>
<dependency>
<groupId>org.springframework</groupId>
<artifactId>spring-tx</artifactId>
<version>${spring.version}</version>
<scope>compile</scope>
</dependency>
Note that:
If you're having this problem, make sure that you're using a spring
version 3.1 or higher.
Remember that ${spring.version}, in my case, is 3.1.1.RELEASE.
I hope that it helps more people.
I was facing the exact same issue, maven complains from org.springframework.core.env.EnvironmentCapable, even with the file there, inside the jar: C:\Users\fabio\.m2\repository\org\springframework\spring-core\4.3.12.RELEASE\spring-core-4.3.12.RELEASE.jar.
The solution im my case was delete the .m2 folder, so maven downloaded all the jars again. Maybe it was some currupted file.
I hope it helps some one!
Me too face this issue. I used Spring 4.1.6 with maven 3 along with RabbitMQ.
<dependency>
<groupId>org.springframework.amqp</groupId>
<artifactId>spring-amqp</artifactId>
<version>1.1.4.RELEASE</version>
</dependency>
This dependency forced tomcat to die and showing these issue. I havn't gotten why it is making trouble. but finally I explicitly include jar in lib folder and this is how I resolved this issue.
Add this dependency to the pom.xml .You can fixed it.
<dependency>
<groupId>org.springframework</groupId>
<artifactId>spring-core</artifactId>
<version>1.4.2.RELEASE</version>
</dependency>
As I imported a project from GitHub without checking its spring-boot version had caused me the same problem, thus changing spring-boot version has resolved my problem, I was using version 1.1.4 moving to 2.2.5 (or latest releases ) will download all the needed dependencies
<parent>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-parent</artifactId>
<version>2.2.5.RELEASE</version>
<relativePath /> <!-- lookup parent from repository -->
</parent>