borinquenkid opened a new pull request, #16079: URL: https://github.com/apache/grails-core/pull/16079
### Summary `org.fusesource.jansi` is unmaintained and flagged by CVE-2026-8484 with no fixed release. The JLine project maintains the fork and publishes it as `org.jline:jansi` (repackaged under `org.jline.jansi`), which Groovy 5 already uses for groovysh — its `groovy-groovysh` POM depends on `org.jline:jansi:3.30.9` and explicitly excludes the fusesource coordinate. This PR adopts the fork per [@jdaugherty's review comment on #16044](https://github.com/apache/grails-core/pull/16044#pullrequestreview-3048071079), removing the last reason this repo's own builds resolve the vulnerable coordinate. ### Changes - **BOM**: `jansi` now maps to `org.jline:jansi:3.30.9` in `dependencies.gradle`; `jline.version` bumped 3.30.6 → 3.30.9 to match Groovy 5.0.7's transitives, with the two documented to stay in lockstep - **Imports**: `org.fusesource.jansi` → `org.jline.jansi` in `GrailsConsole`, `AnsiConsoleUrlMappingsRenderer`, forge's `InteractiveShell`, and their specs; `CreateAppCommandSpec` uses the `Ansi.DISABLE` constant instead of the old hardcoded property name - **Generated apps**: the base profile, forge's `Scaffolding` feature (+ spec), and the user guide dependency listing all emit `org.jline:jansi` - **Version alignment**: stray `jansiVersion` pins in grails-forge (2.4.2) and grails-data-neo4j (2.4.1) both moved to 3.30.9 - **SBOM/scan tooling**: license mapping updated to `org.jline:[email protected]` (CycloneDX misreads JLine's license name as BSD-4-Clause); the `ossIndexAudit` exemption for `org.fusesource.jansi:jansi:1.18` remains because previously published Grails 6/7 artifacts still pull it transitively on some scanned classpaths — its comment now records that removal condition ### Relationship to #16044 This supersedes only the Jansi-exemption hunk of #16044 (`org.fusesource.jansi:jansi:2.4.2` no longer resolves anywhere in this build, so there is no finding to exempt). The Log4j BOM changes in that PR are unaffected and still needed. ### Verification - Tests pass for grails-bootstrap, grails-web-url-mappings, grails-shell-cli; full grails-console build green - grails-forge build green, including `ScaffoldingSpec` and the CLI compile - `codeStyle` passes across the repo 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
