What is the mybatis version in latest version of flowable 6.7.2

Flowable Engine
1

We currently use version 6.5 and the mybatis dependency version within flowable-spring-boot-starter-rest is 3.5.3. Our contrast vulnerability third party checker is stating this version has a high vulnerability and we should use 3.5.8

HIGH
CVSS 3.1 Score 8.1
MyBatis before 3.5.6 mishandles deserialization of object streams.

What version is 6.7.2 using and if still at 3.5.3 are there any plans to upgrade ?

2

You may be able to change (or add to) your pom.xml the newer version without having to upgrade Flowable itself.

3

Flowable 6.7.2 uses 3.5.7, you can look this up here: flowable-engine/pom.xml at flowable-6.7.2 · flowable/flowable-engine · GitHub

The current main branch uses 3.5.10.