Set the version property that Spring Boot uses for that library, for example log4j2.version in a Maven POM, then rebuild and test. Spring Boot manages versions through its spring-boot-dependencies BOM, so a property is the supported lever. Do not override the Spring Framework version.
Definition
Each Spring Boot release ships a curated list of supported dependencies, published as the spring-boot-dependencies Bill of Materials. You usually declare no version for them. When you upgrade Spring Boot, the managed set moves together.
Starters bundle related dependencies with a supported set of transitive versions. Official starters follow the spring-boot-starter pattern.
Why override
A security advisory may name a fixed version of a managed library before your Boot line picks it up. The documentation says you can still specify a version and override the recommendations if needed.
The property names
The Spring Boot version properties appendix lists names such as these.
| Library | Property |
|---|---|
| Log4j2 | log4j2.version |
| Tomcat | tomcat.version |
| SnakeYAML | snakeyaml.version |
| Netty | netty.version |
| Jackson 2 BOM | jackson-2-bom.version |
Check the appendix for your Boot version, because properties can change between lines.
How to override
Maven
<properties>
<log4j2.version>2.25.0</log4j2.version>
</properties>
Gradle
ext['log4j2.version'] = '2.25.0'
The Gradle form is the common pattern, but confirm it against the build tool plugin documentation for your version. The number above is an example, not a recommendation. Take the fixed version from the advisory.
What to be careful about
Spring Boot highly recommends that you do not specify the Spring Framework version, since each Boot release is tied to a base version. Overriding any managed version can break compatibility, because the curated set is designed to work together.
Steps
- Read the advisory and note the fixed version.
- Find the property in the appendix.
- Set it and rebuild.
- Print the tree and confirm the resolved version. See how to see why a dependency is on your classpath.
- Run integration tests, not just unit tests.
- Remove the override when a Boot upgrade makes it redundant, and leave a dated comment so you remember.
Try it yourself
Click through it at your own pace, or open it full screen.
Pick a finding with a fix version. That version is what you would place in the property.
Where Safeguard fits
Safeguard's dependency scanning reports fixed versions, and policies and gates can stop a build that still carries a known vulnerable library. Try the free scan.
Quick check
Do I need a version in the POM for managed dependencies?
No. The Boot BOM supplies it. Add a version or property only to change it.
Can I override the Spring Framework version?
You can, but the documentation highly recommends that you do not.
Sources
Last reviewed: 19 October 2026.
