[PRMT-4325] - Added snakeyaml as a dependency constraint

nhsconnect · Jan 5, 2024 · 06ee7f9 · 06ee7f9
1 parent dec55cc
commit 06ee7f9
Showing 1 changed file with 5 additions and 1 deletion.
diff --git a/build.gradle b/build.gradle
@@ -28,8 +28,12 @@ jar {
 }
 
 dependencies {
-    implementation 'org.yaml:snakeyaml:2.2'
     implementation 'org.springframework.boot:spring-boot-starter'
+    constraints {
+        implementation('org.yaml:snakeyaml:2.2') {
+            because 'snakeyaml < 2.0 is vulnerable'
+        }
+    }
     implementation 'org.springframework.boot:spring-boot-starter-web'