如何在 spring 启动时升级 spring 框架版本

Question

我正在使用 spring-boot 2.3.3.RELEASE 以及 maven 中相应的 spring-boot-starter-parent.

<parent>
   <groupId>org.springframework.boot</groupId>
   <artifactId>spring-boot-starter-parent</artifactId>
   <version>2.3.3.RELEASE</version>
   <relativePath/> <!-- lookup parent from repository -->
 </parent>

由于 spring4shell CVE，我想将 spring-框架升级到 5.2.20.RELEASE 而不是已经包含的 5.2.8.RELEASE。我尝试从 spring-boot-dependencies.

覆盖 spring-framework.version 属性

    <spring-framework.version>5.2.20.RELEASE</spring-framework.version>

但是没有用。我还查找了 spring-boot-starter-web-2.3.3.RELEASE.pom，它的 spring-web 依赖硬编码为 5.2.8.RELEASE.

除了将所有新版本作为依赖项添加到 dependencyManagement 部分之外，还有其他方法可以升级 spring-boot 中的 spring-framework 版本吗？感谢

完整 POM：

<?xml version="1.0"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" 
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
  xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 
  http://maven.apache.org/xsd/maven-4.0.0.xsd">
<modelVersion>4.0.0</modelVersion>

<parent>
  <groupId>org.springframework.boot</groupId>
  <artifactId>spring-boot-starter-parent</artifactId>
  <version>2.3.3.RELEASE</version>
  <relativePath/> <!-- lookup parent from repository -->
</parent>

<groupId>group</groupId>
<artifactId>app</artifactId>
<version>3.1.0-SNAPSHOT</version>
<packaging>war</packaging>

<properties>
  <flyway.version>4.1.2</flyway.version>
  <groovy.version>2.4.20</groovy.version>
  <spring-framework.version>5.2.20.RELEASE</spring-framework.version>
  <spring-cloud.version>Hoxton.SR7</spring-cloud.version>
  <h2.version>1.4.196</h2.version>
</properties>

<dependencyManagement>
<dependencies>

  <dependency>
    <groupId>org.springframework.cloud</groupId>
    <artifactId>spring-cloud-dependencies</artifactId>
    <version>${spring-cloud.version}</version>
    <type>pom</type>
    <scope>import</scope>
  </dependency>

</dependencies>
</dependencyManagement>

<dependencies>

<dependency>
  <groupId>org.springframework.boot</groupId>
  <artifactId>spring-boot-starter-actuator</artifactId>
</dependency>

<dependency>
  <groupId>org.springframework.boot</groupId>
  <artifactId>spring-boot-starter-jdbc</artifactId>
</dependency>

<dependency>
  <groupId>org.springframework.boot</groupId>
  <artifactId>spring-boot-starter-data-rest</artifactId>
</dependency>

<dependency>
  <groupId>org.springframework.boot</groupId>
  <artifactId>spring-boot-starter-webflux</artifactId>
</dependency>

<dependency>
  <groupId>org.springframework.boot</groupId>
  <artifactId>spring-boot-starter-web</artifactId>
</dependency>

<dependency>
  <groupId>org.springframework.boot</groupId>
  <artifactId>spring-boot-starter-test</artifactId>
  <scope>test</scope>
</dependency>

<dependency>
  <groupId>org.springframework.boot</groupId>
  <artifactId>spring-boot-starter-tomcat</artifactId>
  <scope>provided</scope>
</dependency>

<dependency>
  <groupId>org.springframework.boot</groupId>
  <artifactId>spring-boot-configuration-processor</artifactId>
  <optional>true</optional>
</dependency>

<dependency>
  <groupId>org.mockito</groupId>
  <artifactId>mockito-core</artifactId>
</dependency>


<dependency>
  <groupId>org.codehaus.groovy</groupId>
  <artifactId>groovy-all</artifactId>
  <version>${groovy.version}</version>
</dependency>

<!-- https://mvnrepository.com/artifact/com.fasterxml.jackson.dataformat/jackson-dataformat-xml -->
<dependency>
  <groupId>com.fasterxml.jackson.dataformat</groupId>
  <artifactId>jackson-dataformat-xml</artifactId>
</dependency>

</dependencies>
<build>
<finalName>app</finalName>
<resources>
  <resource>
    <directory>src/main/resources</directory>
    <filtering>true</filtering>
    <includes>
      <include>**/version.json</include>
      <include>**/**.properties</include>
    </includes>
  </resource>

  <resource>
    <directory>src/main/resources</directory>
    <filtering>false</filtering>
    <includes>
      <include>**/*.*</include>
    </includes>
    <excludes>
      <exclude>**/version.json</exclude>
      <exclude>**/**.properties</exclude>
    </excludes>
  </resource>
</resources>
</build>
</project>

编辑： 这是 mvn dependency:tree:

的一部分

+- org.springframework.boot:spring-boot-starter-webflux:jar:2.3.3.RELEASE:compile
[INFO] |  +- org.springframework.boot:spring-boot-starter-json:jar:2.3.3.RELEASE:compile
[INFO] |  |  +- com.fasterxml.jackson.datatype:jackson-datatype-jdk8:jar:2.11.2:compile
[INFO] |  |  \- com.fasterxml.jackson.module:jackson-module-parameter-names:jar:2.11.2:compile
[INFO] |  +- org.springframework.boot:spring-boot-starter-reactor-netty:jar:2.3.3.RELEASE:compile
[INFO] |  +- org.springframework:spring-web:jar:5.2.8.RELEASE:compile
[INFO] |  +- org.springframework:spring-webflux:jar:5.2.8.RELEASE:compile
[INFO] |  \- org.synchronoss.cloud:nio-multipart-parser:jar:1.1.0:compile
[INFO] |     \- org.synchronoss.cloud:nio-stream-storage:jar:1.1.3:compile

如果您查看包含有问题的 spring-web 5.2 的 spring-boot-starter-webflux-2.3.3.RELEASE.pom。8.RELEASE 您会发现 spring 版本被硬编码为 5.2 .8.RELEASE。所以在maven中设置spring.framework 属性是没有效果的。

    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-web</artifactId>
      <version>5.2.8.RELEASE</version>
      <scope>compile</scope>
    </dependency>

mvn 的输出 help:effective-pom:

 <dependency>
        <groupId>org.springframework</groupId>  <!-- org.springframework:spring-framework-bom:5.2.8.RELEASE, line 126 -->
        <artifactId>spring-web</artifactId>  <!-- org.springframework:spring-framework-bom:5.2.8.RELEASE, line 127 -->
        <version>5.2.8.RELEASE</version>  <!-- org.springframework:spring-framework-bom:5.2.8.RELEASE, line 128 -->
      </dependency>
      <dependency>
        <groupId>org.springframework</groupId>  <!-- org.springframework:spring-framework-bom:5.2.8.RELEASE, line 131 -->
        <artifactId>spring-webflux</artifactId>  <!-- org.springframework:spring-framework-bom:5.2.8.RELEASE, line 132 -->
        <version>5.2.8.RELEASE</version>  <!-- org.springframework:spring-framework-bom:5.2.8.RELEASE, line 133 -->
      </dependency>

@Inthai2002 解决方案后编辑： 我的 pom.xml

中还导入了一个内部 lib pom

<dependencyManagement>
        <dependencies>
            <dependency>
                <groupId>internal</groupId>
                <artifactId>lib</artifactId>
                <version>4.4.0</version>
                <scope>import</scope>
                <type>pom</type>
            </dependency>

            <dependency>
                <groupId>org.springframework.cloud</groupId>
                <artifactId>spring-cloud-dependencies</artifactId>
                <version>${spring-cloud.version}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>

        </dependencies>
    </dependencyManagement>

并且此内部库直接导入了 spring-boot-dependencies pom，这导致 spring-framework.version 属性被忽略：

          <dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-dependencies</artifactId>
                <version>2.3.3.RELEASE</version>
                <scope>import</scope>
                <type>pom</type>
            </dependency>

Answer 1

只需将父节点更改如下

<parent>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-parent</artifactId>
    <version>2.6.6</version>
</parent>

Answer 2

根据官方文档：https://docs.spring.io/spring-boot/docs/current/reference/html/dependency-versions.html#appendix.dependency-versions.properties

<spring-framework.version>5.2.20.RELEASE</spring-framework.version>

只会覆盖组 ID org.springframework 的版本，而不会覆盖 org.springframework.boot。我没有看到 spring 引导的版本属性，因此可能必须在依赖项中包含该版本。

Answer 3

我刚刚在干净的 m2 存储库上尝试了您的 pom（有和没有 spring-framework.version 属性）。没有属性，spring-framework就是5.2.8，有属性就是5.2.20。你能试试干净的回购吗？

版本 X 的 spring-framework-bom 被硬编码到版本 X 的所有 spring 包中（参见 https://repo1.maven.org/maven2/org/springframework/spring-framework-bom/5.2.8.RELEASE/spring-framework-bom-5.2.8.RELEASE.pom）

spring-framework.version 属性声明并用于拉取 spring-framework-bom 在 spring-boot-dependencies 中并由其后代继承（参见 https://repo1.maven.org/maven2/org/springframework/boot/spring-boot-dependencies/2.3.3.RELEASE/spring-boot-dependencies-2.3.3.RELEASE.pom）。

spring-boot-dependencies 是 spring-boot-starter-parent 的父级（参见 https://repo1.maven.org/maven2/org/springframework/boot/spring-boot-starter-parent/2.3.3.RELEASE/spring-boot-starter-parent-2.3.3.RELEASE.pom）。

因为属性由后代继承，您可以在应用程序的 pom 中覆盖它的值。通过用 5.2.20 覆盖它，您将 spring-framework-bom 5.2.8 换成 5.2.20，这有效地为 5.2.20

提取了大部分 spring 包

如何在 spring 启动时升级 spring 框架版本

How to upgrade spring framework version in spring boot

java

spring

maven

spring-boot