jamesfredley commented on PR #15557: URL: https://github.com/apache/grails-core/pull/15557#issuecomment-4313134360
### Rebase + merge with `8.0.x` (latest) Pulled the current tip of `8.0.x` into this branch, resolved the conflict, and got the build green. **Merge: `origin/8.0.x` -> `grails8-groovy5-sb4`** (commit `ff01c08cc5`) - 21 incoming commits, dominated by #15367 (JLine 3 / Jansi 2 upgrade) plus the related forge fixes (`fix/forge-graalvm-builder-java21`, jansi/jline test fixes). - Single conflict in `build-logic/plugins/src/main/groovy/org/apache/grails/buildsrc/SbomPlugin.groovy` `LICENSE_MAPPING`. `8.0.x` added 4 entries at the top of the map, 3 of which (`org.antlr/[email protected]`, `jline/[email protected]`, `org.liquibase.ext/[email protected]`) already existed in this branch's alphabetically sorted section. Resolved by deleting the duplicates and keeping the alphabetical layout. - The 4th entry from `8.0.x` (`org.jline/[email protected]`) was a new license override for the JLine 3 artifact - I initially treated it as a duplicate too, but verified later (see next commit) that it is required. **SBOM fix: `fix(sbom): align jline license overrides with post-merge resolved versions`** (commit `8c5d1d182d`) After the merge, `./gradlew assemble -PskipTests` failed in 12 modules with `cyclonedxBom` errors: ``` Unpermitted License found for bom dependency: pkg:maven/org.jline/[email protected]?type=jar : BSD-4-Clause ``` Investigation via `./gradlew :grails-shell-cli:dependencies --configuration runtimeClasspath` showed the `org.jline` group splits into two distinct resolved versions after the merge: | Artifact | Resolved version | Why | |---|---|---| | `org.jline:jline` | **3.30.6** | Direct declaration via `jline.version` in `dependencies.gradle` (#15367) | | `org.jline:jansi`, `jline-reader`, `jline-terminal`, `jline-builtins`, `jline-console`, `jline-style`, `jline-native`, `jline-terminal-{jansi,jna,jni}` | **3.30.9** | Transitive via Groovy 5's `groovy-groovysh` | Gradle does not reconcile across distinct artifact names, so both versions must appear in `LICENSE_MAPPING`. Updated the override key from the stale `org.jline/[email protected]` to `@3.30.6`, kept the sub-artifact entries at `@3.30.9`, and added per-line comments documenting which lines move with `jline.version` and which move with the `groovy-groovysh` transitive resolution. This is the only thing future jline bumps need to know about. After the fix: **BUILD SUCCESSFUL, 1292 actionable tasks, 0 failures** (JDK 21 Corretto 21.0.9, Windows). ### Dependency review (no upgrades applied) I checked latest stable versions for the major libraries in this PR. Everything is already current: | Library | This PR | Latest stable | |---|---|---| | Apache Groovy | 5.0.5 | 5.0.5 | | Spring Boot | 4.0.5 | 4.0.5 | | Spring Framework | 7.0.6 (managed) | 7.0.6 | | Spock | 2.4-groovy-5.0 | 2.4-groovy-5.0 | | Mockito | 5.20.0 | 5.20.0 | | Kotlin | 2.2.21 | 2.2.21 | | Byte Buddy | 1.17.8 | 1.17.8 | | MongoDB driver | 5.6.4 | 5.6.4 | | Selenium | 4.38.0 | 4.38.0 | No further dependency bumps in this rebase. ### What I deliberately did **not** change A few of the Groovy 5 workarounds in this PR (notably the `@CompileStatic instanceof` -> `isAssignableFrom` swaps and the GROOVY-11907 inline `true`/`false` for `CommandLineHelper`) may be revertable on Groovy 5.0.5 if the upstream fixes have actually landed. I left them in place: reverting working workarounds without dedicated test coverage risks reintroducing the very class-loading and `ClassCastException` failures this PR was created to fix. Worth a separate follow-up PR after the test suite is fully green here. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
