Lab for an article on finding, prioritizing and fixing vulnerable dependencies in Spring Boot without breaking production, using SnakeYAML (CVE-2022-1471) as the running example.
Working title: Fixing CVEs in Spring Boot Without Breaking Production
Java 21 · Maven · Spring Boot 2.7.18 (manages SnakeYAML 1.30)
| Stage | Topic | Status | Doc | Git tag |
|---|---|---|---|---|
| 01 | Vulnerable baseline | Built, not yet verified (needs Maven + JDK 21) | 01-vulnerable-baseline | 01-vulnerable |
| 02 | Scan and compare scores | Todo | ||
| 03 | Triage and prioritization | Todo | ||
| 04 | Naive fix (bump version) | Todo | ||
| 05 | Safe fix | Todo | ||
| 06 | Guardrails (tests, enforcer, CI) | Todo |
- Article outline: structure of the final article, filled in as stages complete
- Decisions log: why each choice was made
- Glossary: terms used in the article
- Evidence: raw outputs (scan reports, dependency trees, stack traces)
Rule: every claim in the article must point to evidence in docs/evidence/ or be marked to verify.
mvn test
mvn spring-boot:run
curl -X POST localhost:8080/yaml/parse -d $'name: test\nversion: 1'
mvn dependency:tree -Dincludes=org.yaml:snakeyamlRequires a JDK 21 (newer JDKs may not work with Spring Boot 2.7).