Replies: 1 comment 11 replies
-
|
Hello @zangcc
It looks like you use modules in your main
Regards, Dmitriy |
Beta Was this translation helpful? Give feedback.
-
|
I seem to have found the reason why the org.springframework.boot:spring-boot-autoconfigure version is scanned out as 2.5.3.The result says that it is a dependency of com.baomidou:mybatis-plus-boot-starter:3.5.3.1.
I found com.baomidou:mybatis-plus-boot-starter:3.5.3.1, the org.springframework.boot.. version inside is 2.5.3, this may be the reason. But why does 2.5.3 overwrite the 2.7.12 I declared in the outer layer? 
I have specified the version of ${spring-boot.version} in the outermost pom.xml 
Why does Trivy still use 2.5.3 as the version of org.springframework.boot:spring-boot-autoconfigure? |
Beta Was this translation helpful? Give feedback.
-
|
Possibly the wrong priority for properties resolve. |
Beta Was this translation helpful? Give feedback.
-
|
By the way, upload the scan results. The scan results here are still that the org.springframework.boot:spring-boot-autoconfigure version is 2.5.3, but the real version is not this. |
Beta Was this translation helpful? Give feedback.
-
|
This is so strange... I created test image with your files: FROM aquasec/trivy:0.47.0
RUN mkdir /app
COPY ./pom.xml /app/pom.xml
COPY ./zangccDemo-bm-policy-dao/pom.xml /app/zangccDemo-bm-policy-dao/pom.xml
COPY ./zangccDemo-bm-policy-service/pom.xml /app/zangccDemo-bm-policy-service/pom.xml
COPY ./zangccDemo-bm-policy-web/pom.xml /app/zangccDemo-bm-policy-web/pom.xmlTest: ➜ docker run -it --rm 5510 fs -f json --list-all-pkgs ./app | grep '"ID": "org.springframework.boot:spring-boot-autoconfigure'
"ID": "org.springframework.boot:spring-boot-autoconfigure:2.7.12",
"ID": "org.springframework.boot:spring-boot-autoconfigure:2.7.12",
"ID": "org.springframework.boot:spring-boot-autoconfigure:2.7.12",
"ID": "org.springframework.boot:spring-boot-autoconfigure:2.7.12",
"ID": "org.springframework.boot:spring-boot-autoconfigure:2.7.12",
"ID": "org.springframework.boot:spring-boot-autoconfigure:2.7.12",Can you update this Dockerfile to get wrong version? |
Beta Was this translation helpful? Give feedback.
-
|
Thanks for the reply. I scanned again using trivy:0.47.0 and found that the dependency version problem of "org.springframework.boot:spring-boot-autoconfigure" was solved. Thank you |
Beta Was this translation helpful? Give feedback.
-
Description
The version of "org.springframework.boot:spring-boot-autoconfigure" is 2.7.12, and the version scanned by Trivy is 2.5.3
This is another project and this problem still exists
The version of "org.springframework.boot:spring-boot-autoconfigure" is 2.4.5, and the version scanned by Trivy is 2.5.3
Desired Behavior
Dependency versions remain accurate
Actual Behavior
The dependency version in the scan results does not match the actual version。org.springframework.boot:spring-boot-autoconfigure，Its versions are all 2.5.3。
Reproduction Steps
Target
None
Scanner
None
Output Format
None
Mode
None
Debug Output
Operating System
Ubuntu SMP Fri Mar 18 12:42:08 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux
Version
Checklist
trivy image --resetBeta Was this translation helpful? Give feedback.
All reactions