The GitHub Actions job "CI - Groovy Joint Validation Build" on grails-core.git/fix/databinding-raw-collection-8.0.x has failed. Run started by GitHub user codeconsole (triggered by codeconsole).
Head commit for run: ae38d9bc7e10ae6d2dacfd7d1960fac9b0f5514f / Scott Murphy Heiberg <[email protected]> Leave a raw collection's elements alone rather than binding them into Object Deny-by-default binding instantiates a nested type and binds the allowlisted properties into it, instead of handing the map to a constructor that would set whatever it was given. That is the right thing to do for a real nested type, but the element type is not always one. A collection written without a type argument reports Object as its component type: Basic#componentType falls back to Object.class when a property carries no generic signature. Object has a public no-arg constructor, so instantiation succeeds, and Object declares no properties, so binding into it puts the map's contents nowhere. The element is replaced by an empty Object and its data is gone, silently, before anything can fail on it. That is also why it escapes the opt-in: the instantiation happens in the try, while the deny-by-default check guards only the map-constructor fallback in the catch, so an application that never enabled the mode still loses the data. GORM then reports it as a missing codec for java.lang.Object, at a point far from the binding that caused it. Nothing can be mass-assigned through a value that is never used as a property source, so an element whose target type is Object is kept as it stands, which is what these collections did before. Every other type still instantiates and binds through the allowlist, and bindable: false is unaffected. Report URL: https://github.com/apache/grails-core/actions/runs/32683166403 With regards, GitHub Actions via GitBox
