[Snyk] Security upgrade org.apache.struts:struts2-core from 2.3.20 to 2.3.32#27
[Snyk] Security upgrade org.apache.struts:struts2-core from 2.3.20 to 2.3.32#27sharmyn-snyk-test wants to merge 1 commit into
Conversation
The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JAVA-ORGAPACHESTRUTS-30207
|
This is a patch version upgrade within the same minor series (2.3.x). The versions between 2.3.20 and the target version 2.3.32 consist of multiple security fixes. The release notes for version 2.3.32 specifically address a remote code execution vulnerability (S2-045) and do not indicate any breaking API changes. Such updates within the Struts 2.3.x line were intended as drop-in replacements. Given that the Struts 2.3.x line reached its end-of-life in 2019, a migration to a currently supported version (like Struts 6.x) is highly recommended to ensure security. Recommendation: This upgrade is safe to merge as it contains important security patches without known breaking changes. However, a plan should be made to migrate off the EOL Struts 2.3.x series entirely.
|
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
Snyk has created this PR to fix 1 vulnerabilities in the maven dependencies of this project.
Snyk changed the following file(s):
pom.xmlVulnerabilities that will be fixed with an upgrade:
SNYK-JAVA-ORGAPACHESTRUTS-30207
2.3.20->2.3.32No Path FoundMatureBreaking Change Risk
Important
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.
For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic
Learn how to fix vulnerabilities with free interactive lessons:
🦉 Arbitrary Code Execution