How Tanzu Spring Application Advisor Incorporates Enterprise and DESAT Releases

Products

• VMware Tanzu Platform Spring
• VMware Tanzu Platform Spring Essentials
• VMware Tanzu Spring Essentials

Issue/Introduction

How does Tanzu Spring Application Advisor incorporate releases distributed via DESAT or the Enterprise repository? Does the CLI automatically identify 4-digit CVE-fix versions (e.g., 4.1.0.1) and progress to 3-digit micro patches (e.g., 4.1.1), or must they be adopted explicitly?

Resolution

Tanzu Spring Application Advisor is designed to automatically resolve and recommend the latest available patches from all accessible repositories, including commercial-only releases.

Command Behavior
The Advisor CLI uses the advisor patch apply command to manage high-frequency security compliance. This command:

• Calculates if new patch versions exist for your project's current artifacts.
• Automatically identifies 4-digit version strings (e.g., X.Y.Z.W), which are reserved strictly for enterprise-validated CVE fixes and security patches.
• Does not require a complex "upgrade plan" resolution, as it targets the latest patch for existing artifacts within the same minor version family.

Distribution Flow
Advisor follows a natural progression based on version availability in the repository:
1.  4-Digit Patches: If a security hotfix (e.g., 4.1.0.1) is published to the Enterprise repository, Advisor will recommend this version to address immediate vulnerabilities.
2.  3-Digit Transition: When a subsequent 3-digit micro patch (e.g., 4.1.1) is released, Advisor will recognize it as a cumulative update that inherits all previous CVE fixes. It will then recommend the 3-digit version as the latest stable path.

Requirements for Automation
For Advisor to "see" and incorporate these releases, the following must be true:

• Repository Access: The Maven settings.xml (or Gradle equivalent) for the environment running the CLI must be configured with the Broadcom Enterprise Repository or a local proxy (like Artifactory or Nexus) that mirrors it.
• Command Usage: Users should run advisor build-config get to ensure the current project state is recognized, followed by advisor patch apply.