chore: fix SBOM failure in 24.1 (#4445)

vaadin · Sep 1, 2023 · 9bf1a3b · 9bf1a3b
1 parent edb12d6
commit 9bf1a3b
Showing 1 changed file with 19 additions and 1 deletion.
diff --git a/vaadin-spring-boot-starter/pom.xml b/vaadin-spring-boot-starter/pom.xml
@@ -65,9 +65,27 @@
                     <groupId>org.yaml</groupId>
                     <artifactId>snakeyaml</artifactId>
                 </exclusion>
+            <exclusion>
+                    <groupId>org.apache.tomcat.embed</groupId>
+                    <artifactId>tomcat-embed-core</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>org.apache.tomcat.embed</groupId>
+                    <artifactId>tomcat-embed-websocket</artifactId>
+                </exclusion>
             </exclusions>
         </dependency>
+        <!-- CVE-2023-41080 UNTIL new Springboot with tomcat version bump -->
+        <dependency>
+            <groupId>org.apache.tomcat.embed</groupId>
+            <artifactId>tomcat-embed-core</artifactId>
+            <version>10.1.13</version>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.tomcat.embed</groupId>
+            <artifactId>tomcat-embed-websocket</artifactId>
+            <version>10.1.13</version>
+        </dependency>
         <!-- End Spring -->
-
     </dependencies>
 </project>