Skip to content

SNYK: fix for com.azure.spring:spring-cloud-azure-appconfiguration-config-web #1435

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
kissalk wants to merge 2 commits into
base: dev
Choose a base branch
from
Open

SNYK: fix for com.azure.spring:spring-cloud-azure-appconfiguration-config-web #1435

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5b6b6e2
fix: Java/pom.xml to reduce vulnerabilities
snyk-bot Feb 15, 2026
1cd4305
Merge branch 'dev' into snyk-fix-475b6b93241bc0ed94e12e1b6d971999
seanmcilvenna Feb 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion Java/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -95,7 +95,7 @@
<dependency>
<groupId>com.azure.spring</groupId>
<artifactId>spring-cloud-azure-appconfiguration-config-web</artifactId>
<version>5.11.0</version>
<version>7.0.0</version>
</dependency>
Comment on lines 95 to 99

@coderabbitai coderabbitai Bot Feb 15, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🏁 Script executed:

head -20 Java/pom.xml | cat -n

Repository: lantanagroup/link-cloud

Length of output: 961

🏁 Script executed:

grep -n "spring-boot-starter-parent\|springboot4_\|spring-cloud-azure" Java/pom.xml | head -20

Repository: lantanagroup/link-cloud

Length of output: 219

🌐 Web query:

Spring Cloud Azure 7.0.0 Spring Boot compatibility spring-cloud-azure-appconfiguration-config-web

💡 Result:

com.azure.spring:spring-cloud-azure-appconfiguration-config-web:7.0.0 (part of Spring Cloud Azure 7.0.0) is compatible with:

  • Spring Boot: 4.0.0–4.0.2 (later 4.0.x likely works but wasn’t tested in that release) [1]
  • Spring Cloud: 2025.1.0 (later 2025.1.x likely works but wasn’t tested in that release) [1]
  • The official mapping also places Spring Cloud Azure 7.x on the Spring Boot 4.0.x / Spring Cloud 2025.1.x line [2].
  • Artifact release date (Maven Central): Feb 03, 2026 [3]

Sources: [1] [2] [3]

🌐 Web query:

spring-cloud-azure-appconfiguration-config-web 5.24.1 Spring Boot 3.2.5 compatibility matrix

💡 Result:

For Spring Boot 3.2.5, the compatible combination is:

  • Spring Boot: 3.2.x (includes 3.2.5)
  • Spring Cloud release train: 2023.0.x (Leyton) (mapped to Boot 3.2.x / 3.3.x) (spring.io)
  • Spring Cloud Azure (SCA): 5.7.0 – 5.24.1 (so 5.24.1 is compatible) (github.com)
  • Therefore spring-cloud-azure-appconfiguration-config-web:5.24.1 is compatible with Spring Boot 3.2.5 as part of Spring Cloud Azure 5.24.1 (github.com)

Citations:

Critical: Version 7.0.0 is incompatible with Spring Boot 3.2.5 — will fail at compile or startup.

Spring Cloud Azure 7.0.0 requires Spring Boot 4.0.0 or later. This project uses Spring Boot 3.2.5, which requires Spring Cloud Azure 5.24.1 for compatibility. The Snyk fix jumped two major versions without considering the Spring Boot compatibility matrix.

Fix: upgrade to the latest Spring Boot 3.x–compatible version 
             <groupId>com.azure.spring</groupId>
             <artifactId>spring-cloud-azure-appconfiguration-config-web</artifactId>
-            <version>7.0.0</version>
+            <version>5.24.1</version>
         </dependency>

After updating to 5.24.1, verify that the Netty transitive dependency resolves the reported Snyk vulnerability (SNYK-JAVA-IONETTY-14423947) by running mvn dependency:tree -Dincludes=io.netty.

Per coding guidelines, this PR is not TECH_DEBT; include testing details in the PR description.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
<dependency>
<groupId>com.azure.spring</groupId>
<artifactId>spring-cloud-azure-appconfiguration-config-web</artifactId>
<version>5.11.0</version>
<version>7.0.0</version>
</dependency>
<dependency>
<groupId>com.azure.spring</groupId>
<artifactId>spring-cloud-azure-appconfiguration-config-web</artifactId>
<version>5.24.1</version>
</dependency>
🤖 Prompt for AI Agents 
In `@Java/pom.xml` around lines 95 - 99, Replace the incompatible Spring Cloud
Azure dependency version 7.0.0 with the Spring Boot 3.2.5–compatible version
5.24.1 for the artifact
com.azure.spring:spring-cloud-azure-appconfiguration-config-web; update the
<version> entry in the dependency block accordingly, then run mvn
dependency:tree -Dincludes=io.netty to verify the Netty transitive dependency
(and confirm the SNYK-JAVA-IONETTY-14423947 issue is addressed), and include the
test/verification steps in the PR description per guidelines.


<dependency>
Expand Down
Loading