From 0382b33a35e95f9f9d04b8e596311fdcea8ae96f Mon Sep 17 00:00:00 2001
From: Andrea De Lella <Andrea.De.Lella-CIC@ibm.com>
Date: Thu, 14 Nov 2024 15:36:07 +0100
Subject: [PATCH] build(fix): vulnerabilities

---
 pom.xml | 23 ++++++++++++++++++++++-
 1 file changed, 22 insertions(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 1edfb3e..ba9a58d 100644
--- a/pom.xml
+++ b/pom.xml
@@ -11,7 +11,7 @@
 	<parent>
 		<groupId>org.springframework.boot</groupId>
 		<artifactId>spring-boot-starter-parent</artifactId>
-		<version>2.7.3</version>
+		<version>2.7.18</version>
 		<relativePath />
 		<!-- lookup parent from repository -->
 	</parent>
@@ -33,6 +33,7 @@
 			src/main/java/it/finanze/sanita/fse2/ms/gtw/rulesmanager/logging/*,
 			src/main/java/it/finanze/sanita/fse2/ms/gtw/rulesmanager/config/**/*,
 		</sonar.exclusions>
+		<logback.version>1.2.13</logback.version>
 	</properties>
 
 	<dependencies>
@@ -40,6 +41,12 @@
 		<dependency>
 			<groupId>org.springframework.boot</groupId>
 			<artifactId>spring-boot-starter-web</artifactId>
+			<exclusions>
+				<exclusion>
+					<groupId>org.yaml</groupId>
+					<artifactId>snakeyaml</artifactId>
+				</exclusion>
+			</exclusions>
 		</dependency>
 		<dependency>
 			<groupId>org.apache.httpcomponents</groupId>
@@ -73,6 +80,12 @@
 			<groupId>org.springdoc</groupId>
 			<artifactId>springdoc-openapi-ui</artifactId>
 			<version>1.6.11</version>
+			<exclusions>
+				<exclusion>
+					<groupId>org.yaml</groupId>
+					<artifactId>snakeyaml</artifactId>
+				</exclusion>
+			</exclusions>
 		</dependency>
 
 		<!-- LOGBACK JSON -->
@@ -126,10 +139,12 @@
 		<dependency>
 			<groupId>org.springframework.kafka</groupId>
 			<artifactId>spring-kafka</artifactId>
+			<version>2.9.11</version>
 		</dependency>
 		<dependency>
 			<groupId>org.springframework.kafka</groupId>
 			<artifactId>spring-kafka-test</artifactId>
+			<version>2.9.11</version>
 			<scope>test</scope>
 		</dependency>
 
@@ -174,6 +189,12 @@
 				<type>pom</type>
 				<scope>import</scope>
 			</dependency>
+			<dependency>
+				<groupId>org.xerial.snappy</groupId>
+				<artifactId>snappy-java</artifactId>
+				<version>1.1.10.4</version>
+				<scope>runtime</scope>
+			</dependency>
 		</dependencies>
 	</dependencyManagement>