How to override version of libraries included automatically under spring-boot-starter

Question

I have spring-boot-starter in my POM and versions are automatically resolved by Camden dependency management system.

    <dependencyManagement>
        <dependencies>
            <dependency>
                <groupId>org.springframework.cloud</groupId>
                <artifactId>spring-cloud-dependencies</artifactId>
                <version>Camden.SR6</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
        </dependencies>
    </dependencyManagement>

  <dependencies>    
    <!-- Spring Boot -->
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter</artifactId>
    </dependency>
 </dependencies>

This gives me version 1.4.3.RELEASE of spring-boot-starter.

One of the jars spring boot starter includes automatically in the maven dependencies is logback-classic: 1.1.18

ch.qos.logback_logback-core version 1.1.8 has a vulnerability because of which I want to switch over to logback version 1.2 This vulnerability is explained in the link below

https://nvd.nist.gov/vuln/detail/CVE-2017-5929

Now, is there a way to override the logback version to 1.2 from what spring-boot-starter automatically resolves it to so that I am not exposed to this vulnerability ?

It depends. If you use the spring-boot-starter-parent as the parent of your project it is as easy as defining the version you want in the properties section else add it in the dependencyManagement section to override the other versions set. — M. Deinum

LHCHIN LHCHIN · Accepted Answer · 2017-10-16T09:06:34

Based on your pom file, you can achieve this by excluding the dependency of 1.1.8 first then add the dependency of 1.2.0.
For example:

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter</artifactId>
    <exclusions>
        <exclusion>
            <groupId>ch.qos.logback</groupId>
            <artifactId>logback-classic</artifactId>
        </exclusion>
    </exclusions>
</dependency>

<dependency>
    <groupId>ch.qos.logback</groupId>
    <artifactId>logback-classic</artifactId>
    <version>1.2.0</version>
</dependency>

How to override version of libraries included automatically under spring-boot-starter

2 Answers