Is snakeyaml 2.0 added in the new Spring boot versions?

Question

I see there is reference to snakeyaml 2.0 in the bugfixes of the new SPringBoot release 3.10-M2 & the older version, but when we look at the source code, we see that the snakeyaml library version is still 1.33

Is there a way to get more information on this?

Answer 1

Spring Boot 2.7.x (since 2.7.10) and 3.0.x (since 3.0.5) releases are compatible with SnakeYAML 2.0 but do not use it by default. They do not use 2.0 by default for backwards compatibility. SnakeYAML 2.0 was released after Spring Boot 2.7.0 and 3.0.0 were released and Spring Boot does not upgrade to new major versions of dependencies in its maintenance releases as doing so could be a breaking change depending on how an application itself and other dependencies are using SnakeYAML.

Spring Boot 3.2.0 (release date TBA as of November 9, 2023) will update SnakeYaml from 1.33 to 2.2.