github-actions[bot] commented on PR #16530: URL: https://github.com/apache/grails-core/pull/16530#issuecomment-6001193314
<!-- grails-vulnerability-scan --> ## 🔍 Vulnerability Scan — pull request ❌ 9 known vulnerabilities in 5 dependencies of 155 scanned projects. Checked against OSV and Sonatype Guide. ### org.apache.tomcat.embed:tomcat-embed-core:10.1.55 | Vulnerability | Severity | Fixed in | Found by | Summary | | --- | --- | --- | --- | --- | | [CVE-2026-65927](https://guide.sonatype.com/vulnerability/CVE-2026-65927?component-type=maven&component-name=org.apache.tomcat.embed%2Ftomcat-embed-core&utm_source=java-http-client&utm_medium=integration&utm_content=17.0.20) | MEDIUM (CVSS 6.3) | none known | [Sonatype Guide](https://guide.sonatype.com/vulnerability/CVE-2026-65927?component-type=maven&component-name=org.apache.tomcat.embed%2Ftomcat-embed-core&utm_source=java-http-client&utm_medium=integration&utm_content=17.0.20) | Off-by-one Error vulnerability in Apache Tomcat impacting the [N] flag on the rewrite valves causes rewrite processing to restart at the second rule rather than the first rule. | | [GHSA-9xv2-5v5q-p794](https://osv.dev/vulnerability/GHSA-9xv2-5v5q-p794) (BIT-tomcat-2026-65905, CVE-2026-65905) | CRITICAL | 11.0.25, 10.1.58, 9.0.121 | [OSV](https://osv.dev/vulnerability/GHSA-9xv2-5v5q-p794) | Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability | | [GHSA-gcx9-497g-6cp6](https://osv.dev/vulnerability/GHSA-gcx9-497g-6cp6) (BIT-tomcat-2026-65182, CVE-2026-65182) | CRITICAL | 11.0.25, 10.1.58, 9.0.121 | [OSV](https://osv.dev/vulnerability/GHSA-gcx9-497g-6cp6) | Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability | | [GHSA-h3x4-894j-xpx5](https://osv.dev/vulnerability/GHSA-h3x4-894j-xpx5) (BIT-tomcat-2026-68525, CVE-2026-68525) | CRITICAL | 11.0.25, 10.1.58, 9.0.121 | [OSV](https://osv.dev/vulnerability/GHSA-h3x4-894j-xpx5) | Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability | Found in `:grails-dependencies-starter-web`, `:grails-fields`, `:grails-sitemesh3`, `:grails-test-examples-app1`, `:grails-test-examples-app2`, `:grails-test-examples-app3`, `:grails-test-examples-async-events-pubsub-demo`, `:grails-test-examples-cache`, `:grails-test-examples-config-report`, `:grails-test-examples-database-cleanup`, `:grails-test-examples-datasources`, `:grails-test-examples-demo33`, `:grails-test-examples-exploded`, `:grails-test-examples-external-configuration`, `:grails-test-examples-geb`, `:grails-test-examples-geb-gebconfig`, `:grails-test-examples-gorm`, `:grails-test-examples-gsp-layout`, `:grails-test-examples-gsp-sitemesh3`, `:grails-test-examples-gsp-spring-boot`, `:grails-test-examples-hibernate5-grails-data-service`, `:grails-test-examples-hibernate5-grails-data-service-multi-datasource`, `:grails-test-examples-hibernate5-grails-database-per-tenant`, `:grails-test-examples-hibernate5-grails-hibernate`, `:grails-test-examples-hibernate5-grails-multiple -datasources`, `:grails-test-examples-hibernate5-grails-multitenant-multi-datasource`, `:grails-test-examples-hibernate5-grails-partitioned-multi-tenancy`, `:grails-test-examples-hibernate5-grails-schema-per-tenant`, `:grails-test-examples-hibernate5-issue450`, `:grails-test-examples-hibernate5-spring-boot-hibernate`, `:grails-test-examples-hyphenated`, `:grails-test-examples-issue-11102`, `:grails-test-examples-issue-11767`, `:grails-test-examples-issue-15228`, `:grails-test-examples-issue-698-domain-save-npe`, `:grails-test-examples-issue-views-182`, `:grails-test-examples-mongodb-base`, `:grails-test-examples-mongodb-database-per-tenant`, `:grails-test-examples-mongodb-gson-templates`, `:grails-test-examples-mongodb-hibernate5`, `:grails-test-examples-mongodb-springboot`, `:grails-test-examples-mongodb-test-data-service`, `:grails-test-examples-namespaces`, `:grails-test-examples-plugins-exploded`, `:grails-test-examples-plugins-issue11005`, `:grails-test-examples-plugins-loadaft er`, `:grails-test-examples-plugins-loadfirst`, `:grails-test-examples-plugins-loadsecond`, `:grails-test-examples-quartz`, `:grails-test-examples-scaffolding`, `:grails-test-examples-scaffolding-fields`, `:grails-test-examples-views-functional-tests`, via `runtimeClasspath › org.springframework.boot:spring-boot-starter-tomcat:3.5.16 › org.apache.tomcat.embed:tomcat-embed-core:10.1.55` ### org.latencyutils:LatencyUtils:2.0.3 | Vulnerability | Severity | Fixed in | Found by | Summary | | --- | --- | --- | --- | --- | | [CVE-2026-82596](https://guide.sonatype.com/vulnerability/CVE-2026-82596?component-type=maven&component-name=org.latencyutils%2FLatencyUtils&utm_source=java-http-client&utm_medium=integration&utm_content=17.0.20) | LOW (CVSS 1.9) | none known | [Sonatype Guide](https://guide.sonatype.com/vulnerability/CVE-2026-82596?component-type=maven&component-name=org.latencyutils%2FLatencyUtils&utm_source=java-http-client&utm_medium=integration&utm_content=17.0.20) | A vulnerability was determined in LatencyUtils up to 2.0.3. Affected by this issue is the function LatencyStats.recordDetectedPause of the file src/main/java/org/LatencyUtils/LatencyStats.java of the … | Found in `:grails-dependencies-starter-web`, `:grails-test-examples-app1`, `:grails-test-examples-app2`, `:grails-test-examples-app3`, `:grails-test-examples-cache`, `:grails-test-examples-database-cleanup`, `:grails-test-examples-datasources`, `:grails-test-examples-exploded`, `:grails-test-examples-external-configuration`, `:grails-test-examples-geb`, `:grails-test-examples-geb-gebconfig`, `:grails-test-examples-gorm`, `:grails-test-examples-hyphenated`, `:grails-test-examples-issue-11102`, `:grails-test-examples-issue-11767`, `:grails-test-examples-issue-15228`, `:grails-test-examples-issue-698-domain-save-npe`, `:grails-test-examples-issue-views-182`, `:grails-test-examples-namespaces`, `:grails-test-examples-plugins-exploded`, `:grails-test-examples-plugins-issue11005`, `:grails-test-examples-plugins-loadafter`, `:grails-test-examples-plugins-loadfirst`, `:grails-test-examples-plugins-loadsecond`, `:grails-test-examples-scaffolding`, `:grails-test-examples-scaffolding-fields` , via `runtimeClasspath › project :grails-bom › io.micrometer:micrometer-core:1.16.7 › org.latencyutils:LatencyUtils:2.0.3` ### org.mongodb:mongodb-driver-core:5.9.2 | Vulnerability | Severity | Fixed in | Found by | Summary | | --- | --- | --- | --- | --- | | [CVE-2026-88033](https://guide.sonatype.com/vulnerability/CVE-2026-88033?component-type=maven&component-name=org.mongodb%2Fmongodb-driver-core&utm_source=java-http-client&utm_medium=integration&utm_content=17.0.20) | HIGH (CVSS 8.3) | none known | [Sonatype Guide](https://guide.sonatype.com/vulnerability/CVE-2026-88033?component-type=maven&component-name=org.mongodb%2Fmongodb-driver-core&utm_source=java-http-client&utm_medium=integration&utm_content=17.0.20) | Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Java Driver can cause a caller-supplied structured file identifier to be interpreted as a query c… | Found in `:grails-data-mongodb`, `:grails-data-mongodb-core`, `:grails-data-mongodb-ext`, `:grails-data-mongodb-gson-templates`, `:grails-data-mongodb-spring-boot`, `:grails-test-examples-mongodb-base`, `:grails-test-examples-mongodb-database-per-tenant`, `:grails-test-examples-mongodb-gson-templates`, `:grails-test-examples-mongodb-hibernate5`, `:grails-test-examples-mongodb-springboot`, `:grails-test-examples-mongodb-test-data-service`, via `runtimeClasspath › org.mongodb:mongodb-driver-core:5.9.2` ### org.mongodb:mongodb-driver-sync:5.9.2 | Vulnerability | Severity | Fixed in | Found by | Summary | | --- | --- | --- | --- | --- | | [CVE-2026-88033](https://guide.sonatype.com/vulnerability/CVE-2026-88033?component-type=maven&component-name=org.mongodb%2Fmongodb-driver-sync&utm_source=java-http-client&utm_medium=integration&utm_content=17.0.20) | HIGH (CVSS 8.3) | none known | [Sonatype Guide](https://guide.sonatype.com/vulnerability/CVE-2026-88033?component-type=maven&component-name=org.mongodb%2Fmongodb-driver-sync&utm_source=java-http-client&utm_medium=integration&utm_content=17.0.20) | Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Java Driver can cause a caller-supplied structured file identifier to be interpreted as a query c… | Found in `:grails-data-mongodb`, `:grails-data-mongodb-core`, `:grails-data-mongodb-ext`, `:grails-data-mongodb-gson-templates`, `:grails-data-mongodb-spring-boot`, `:grails-test-examples-mongodb-base`, `:grails-test-examples-mongodb-database-per-tenant`, `:grails-test-examples-mongodb-gson-templates`, `:grails-test-examples-mongodb-hibernate5`, `:grails-test-examples-mongodb-springboot`, `:grails-test-examples-mongodb-test-data-service`, via `runtimeClasspath › org.mongodb:mongodb-driver-sync:5.9.2` ### org.pac4j:pac4j-core:6.4.3 | Vulnerability | Severity | Fixed in | Found by | Summary | | --- | --- | --- | --- | --- | | [CVE-2026-82463](https://guide.sonatype.com/vulnerability/CVE-2026-82463?component-type=maven&component-name=org.pac4j%2Fpac4j-core&utm_source=java-http-client&utm_medium=integration&utm_content=17.0.20) | HIGH (CVSS 8.1) | none known | [Sonatype Guide](https://guide.sonatype.com/vulnerability/CVE-2026-82463?component-type=maven&component-name=org.pac4j%2Fpac4j-core&utm_source=java-http-client&utm_medium=integration&utm_content=17.0.20) | pac4j-core before 6.5.6 contains an authentication bypass vulnerability in CheckProfileTypeAuthorizer that reverses the profile type validation logic. Attackers can authenticate through a weaker clien… | | [CVE-2026-82464](https://guide.sonatype.com/vulnerability/CVE-2026-82464?component-type=maven&component-name=org.pac4j%2Fpac4j-core&utm_source=java-http-client&utm_medium=integration&utm_content=17.0.20) | MEDIUM (CVSS 6.1) | none known | [Sonatype Guide](https://guide.sonatype.com/vulnerability/CVE-2026-82464?component-type=maven&component-name=org.pac4j%2Fpac4j-core&utm_source=java-http-client&utm_medium=integration&utm_content=17.0.20) | pac4j-core before 6.5.6 contains an open redirect vulnerability in DefaultLogoutLogic.perform() that accepts backslash-prefixed logout redirect targets matching logoutUrlPattern. Attackers can craft l… | Found in `:grails-test-examples-mongodb-test-data-service`, via `runtimeClasspath › project :grails-bom › org.pac4j:pac4j-core:6.4.3` ### Excluded - ch.qos.logback:logback-classic:1.5.38: [CVE-2026-19880](https://guide.sonatype.com/vulnerability/CVE-2026-19880?component-type=maven&component-name=ch.qos.logback%2Flogback-classic&utm_source=java-http-client&utm_medium=integration&utm_content=17.0.20) - Fixed only in logback 1.6.3, and no Spring Boot release manages the 1.6.x line, so adopting it would put logback two minor lines ahead of the stack it integrates with. Grails ships no SiftingAppender/MDCBasedDiscriminator configuration, so exposure is limited to applications that opt into that pattern with attacker-controlled MDC values. Remove once a Spring Boot release manages logback 1.6.3 or later - com.h2database:h2:2.4.240: [CVE-2018-14335](https://guide.sonatype.com/vulnerability/CVE-2018-14335?component-type=maven&component-name=com.h2database%2Fh2&utm_source=java-http-client&utm_medium=integration&utm_content=17.0.20) - Sonatype Guide flags every H2 version and no fixed release exists upstream, see https://github.com/h2database/h2database/issues/1294 - io.micronaut:micronaut-context:4.9.12: [GHSA-8hjv-92q9-g4xj](https://osv.dev/vulnerability/GHSA-8hjv-92q9-g4xj) - A fix requires Micronaut 4.10 or later, which pulls javaparser 3.28 while the grails-micronaut-bom pins javaparser-core to 3.27 (see dependencies.gradle). Remove once Micronaut ships a compatible patched release - io.micronaut:micronaut-inject:4.9.12: [CVE-2026-44242](https://guide.sonatype.com/vulnerability/CVE-2026-44242?component-type=maven&component-name=io.micronaut%2Fmicronaut-inject&utm_source=java-http-client&utm_medium=integration&utm_content=17.0.20) - A fix requires Micronaut 4.10 or later, which pulls javaparser 3.28 while the grails-micronaut-bom pins javaparser-core to 3.27 (see dependencies.gradle). Remove once Micronaut ships a compatible patched release - org.fusesource.jansi:jansi:1.18: [CVE-2026-8484](https://guide.sonatype.com/vulnerability/CVE-2026-8484?component-type=maven&component-name=org.fusesource.jansi%2Fjansi&utm_source=java-http-client&utm_medium=integration&utm_content=17.0.20) - org.fusesource.jansi is unmaintained and every version through 2.4.3 is flagged, with no fixed release upstream. Grails still uses it for ANSI console output; remove once consumers migrate off fusesource jansi or a patched release ships - org.hdrhistogram:HdrHistogram:2.2.2: [CVE-2026-14683](https://guide.sonatype.com/vulnerability/CVE-2026-14683?component-type=maven&component-name=org.hdrhistogram%2FHdrHistogram&utm_source=java-http-client&utm_medium=integration&utm_content=17.0.20) - Pulled transitively via micrometer/actuator (LatencyUtils); the fix is HdrHistogram 2.2.3, which is not published to Maven Central yet. Remove once 2.2.3 or later resolves on the classpath - org.hdrhistogram:HdrHistogram:2.2.2: [CVE-2026-14686](https://guide.sonatype.com/vulnerability/CVE-2026-14686?component-type=maven&component-name=org.hdrhistogram%2FHdrHistogram&utm_source=java-http-client&utm_medium=integration&utm_content=17.0.20) - Pulled transitively via micrometer/actuator (LatencyUtils); the fix is HdrHistogram 2.2.3, which is not published to Maven Central yet. Remove once 2.2.3 or later resolves on the classpath - org.springframework.security:spring-security-core:6.5.11: [CVE-2026-59276](https://guide.sonatype.com/vulnerability/CVE-2026-59276?component-type=maven&component-name=org.springframework.security%2Fspring-security-core&utm_source=java-http-client&utm_medium=integration&utm_content=17.0.20) - Spring Security 6.5.11 is the last open source release of the 6.5.x line: the fix is published to Enterprise Support customers only, and the open source fixes require Spring Boot 4 / Spring Framework 7, which this line does not use. Remove when Grails moves to Spring Boot 4 - org.springframework.security:spring-security-crypto:6.5.11: [CVE-2026-47842](https://guide.sonatype.com/vulnerability/CVE-2026-47842?component-type=maven&component-name=org.springframework.security%2Fspring-security-crypto&utm_source=java-http-client&utm_medium=integration&utm_content=17.0.20) - Spring Security 6.5.11 is the last open source release of the 6.5.x line: the fix is published to Enterprise Support customers only, and the open source fixes require Spring Boot 4 / Spring Framework 7, which this line does not use. Remove when Grails moves to Spring Boot 4 - org.springframework.security:spring-security-oauth2-jose:6.5.11: [CVE-2026-41707](https://guide.sonatype.com/vulnerability/CVE-2026-41707?component-type=maven&component-name=org.springframework.security%2Fspring-security-oauth2-jose&utm_source=java-http-client&utm_medium=integration&utm_content=17.0.20) - Spring Security 6.5.11 is the last open source release of the 6.5.x line: the fix is published to Enterprise Support customers only, and the open source fixes require Spring Boot 4 / Spring Framework 7, which this line does not use. Remove when Grails moves to Spring Boot 4 - org.springframework.security:spring-security-web:6.5.11: [CVE-2026-47838](https://guide.sonatype.com/vulnerability/CVE-2026-47838?component-type=maven&component-name=org.springframework.security%2Fspring-security-web&utm_source=java-http-client&utm_medium=integration&utm_content=17.0.20) - Spring Security 6.5.11 is the last open source release of the 6.5.x line: the fix is published to Enterprise Support customers only, and the open source fixes require Spring Boot 4 / Spring Framework 7, which this line does not use. Remove when Grails moves to Spring Boot 4 - org.springframework.security:spring-security-web:6.5.11: [CVE-2026-47841](https://guide.sonatype.com/vulnerability/CVE-2026-47841?component-type=maven&component-name=org.springframework.security%2Fspring-security-web&utm_source=java-http-client&utm_medium=integration&utm_content=17.0.20) - Spring Security 6.5.11 is the last open source release of the 6.5.x line: the fix is published to Enterprise Support customers only, and the open source fixes require Spring Boot 4 / Spring Framework 7, which this line does not use. Remove when Grails moves to Spring Boot 4 - org.springframework.security:spring-security-web:6.5.11: [CVE-2026-59276](https://guide.sonatype.com/vulnerability/CVE-2026-59276?component-type=maven&component-name=org.springframework.security%2Fspring-security-web&utm_source=java-http-client&utm_medium=integration&utm_content=17.0.20) - Spring Security 6.5.11 is the last open source release of the 6.5.x line: the fix is published to Enterprise Support customers only, and the open source fixes require Spring Boot 4 / Spring Framework 7, which this line does not use. Remove when Grails moves to Spring Boot 4 - org.springframework:spring-beans:6.2.19: [CVE-2026-59282](https://guide.sonatype.com/vulnerability/CVE-2026-59282?component-type=maven&component-name=org.springframework%2Fspring-beans&utm_source=java-http-client&utm_medium=integration&utm_content=17.0.20) - Spring Framework 6.2.19 is the last open source release of the 6.2.x line: the fix is published to Enterprise Support customers only, and the open source fix 7.0.9 requires Spring Framework 7 / Spring Boot 4, which this line does not use. Remove when Grails moves to Spring Boot 4 - org.springframework:spring-context-support:6.2.19: [CVE-2026-59280](https://guide.sonatype.com/vulnerability/CVE-2026-59280?component-type=maven&component-name=org.springframework%2Fspring-context-support&utm_source=java-http-client&utm_medium=integration&utm_content=17.0.20) - Spring Framework 6.2.19 is the last open source release of the 6.2.x line: the fix is published to Enterprise Support customers only, and the open source fix 7.0.9 requires Spring Framework 7 / Spring Boot 4, which this line does not use. Remove when Grails moves to Spring Boot 4 - org.springframework:spring-expression:6.2.19: [CVE-2026-47886](https://guide.sonatype.com/vulnerability/CVE-2026-47886?component-type=maven&component-name=org.springframework%2Fspring-expression&utm_source=java-http-client&utm_medium=integration&utm_content=17.0.20) - Spring Framework 6.2.19 is the last open source release of the 6.2.x line: the fix is published to Enterprise Support customers only, and the open source fix 7.0.9 requires Spring Framework 7 / Spring Boot 4, which this line does not use. Remove when Grails moves to Spring Boot 4 - org.springframework:spring-expression:6.2.19: [CVE-2026-59283](https://guide.sonatype.com/vulnerability/CVE-2026-59283?component-type=maven&component-name=org.springframework%2Fspring-expression&utm_source=java-http-client&utm_medium=integration&utm_content=17.0.20) - Spring Framework 6.2.19 is the last open source release of the 6.2.x line: the fix is published to Enterprise Support customers only, and the open source fix 7.0.9 requires Spring Framework 7 / Spring Boot 4, which this line does not use. Remove when Grails moves to Spring Boot 4 - org.springframework:spring-web:6.2.19: [CVE-2026-47883](https://guide.sonatype.com/vulnerability/CVE-2026-47883?component-type=maven&component-name=org.springframework%2Fspring-web&utm_source=java-http-client&utm_medium=integration&utm_content=17.0.20) - Spring Framework 6.2.19 is the last open source release of the 6.2.x line: the fix is published to Enterprise Support customers only, and the open source fix 7.0.9 requires Spring Framework 7 / Spring Boot 4, which this line does not use. Remove when Grails moves to Spring Boot 4 - org.springframework:spring-web:6.2.19: [CVE-2026-47885](https://guide.sonatype.com/vulnerability/CVE-2026-47885?component-type=maven&component-name=org.springframework%2Fspring-web&utm_source=java-http-client&utm_medium=integration&utm_content=17.0.20) - Spring Framework 6.2.19 is the last open source release of the 6.2.x line: the fix is published to Enterprise Support customers only, and the open source fix 7.0.9 requires Spring Framework 7 / Spring Boot 4, which this line does not use. Remove when Grails moves to Spring Boot 4 - org.springframework:spring-web:6.2.19: [CVE-2026-47889](https://guide.sonatype.com/vulnerability/CVE-2026-47889?component-type=maven&component-name=org.springframework%2Fspring-web&utm_source=java-http-client&utm_medium=integration&utm_content=17.0.20) - Spring Framework 6.2.19 is the last open source release of the 6.2.x line: the fix is published to Enterprise Support customers only, and the open source fix 7.0.9 requires Spring Framework 7 / Spring Boot 4, which this line does not use. Remove when Grails moves to Spring Boot 4 - org.springframework:spring-web:6.2.19: [CVE-2026-47891](https://guide.sonatype.com/vulnerability/CVE-2026-47891?component-type=maven&component-name=org.springframework%2Fspring-web&utm_source=java-http-client&utm_medium=integration&utm_content=17.0.20) - Spring Framework 6.2.19 is the last open source release of the 6.2.x line: the fix is published to Enterprise Support customers only, and the open source fix 7.0.9 requires Spring Framework 7 / Spring Boot 4, which this line does not use. Remove when Grails moves to Spring Boot 4 - org.springframework:spring-web:6.2.19: [CVE-2026-59281](https://guide.sonatype.com/vulnerability/CVE-2026-59281?component-type=maven&component-name=org.springframework%2Fspring-web&utm_source=java-http-client&utm_medium=integration&utm_content=17.0.20) - Spring Framework 6.2.19 is the last open source release of the 6.2.x line: the fix is published to Enterprise Support customers only, and the open source fix 7.0.9 requires Spring Framework 7 / Spring Boot 4, which this line does not use. Remove when Grails moves to Spring Boot 4 - org.springframework:spring-web:6.2.19: [CVE-2026-59314](https://guide.sonatype.com/vulnerability/CVE-2026-59314?component-type=maven&component-name=org.springframework%2Fspring-web&utm_source=java-http-client&utm_medium=integration&utm_content=17.0.20) - Spring Framework 6.2.19 is the last open source release of the 6.2.x line: the fix is published to Enterprise Support customers only, and the open source fix 7.0.9 requires Spring Framework 7 / Spring Boot 4, which this line does not use. Remove when Grails moves to Spring Boot 4 - org.springframework:spring-webmvc:6.2.19: [CVE-2026-47884](https://guide.sonatype.com/vulnerability/CVE-2026-47884?component-type=maven&component-name=org.springframework%2Fspring-webmvc&utm_source=java-http-client&utm_medium=integration&utm_content=17.0.20) - Spring Framework 6.2.19 is the last open source release of the 6.2.x line: the fix is published to Enterprise Support customers only, and the open source fix 7.0.9 requires Spring Framework 7 / Spring Boot 4, which this line does not use. Remove when Grails moves to Spring Boot 4 - org.springframework:spring-webmvc:6.2.19: [CVE-2026-47887](https://guide.sonatype.com/vulnerability/CVE-2026-47887?component-type=maven&component-name=org.springframework%2Fspring-webmvc&utm_source=java-http-client&utm_medium=integration&utm_content=17.0.20) - Spring Framework 6.2.19 is the last open source release of the 6.2.x line: the fix is published to Enterprise Support customers only, and the open source fix 7.0.9 requires Spring Framework 7 / Spring Boot 4, which this line does not use. Remove when Grails moves to Spring Boot 4 - org.springframework:spring-webmvc:6.2.19: [CVE-2026-47890](https://guide.sonatype.com/vulnerability/CVE-2026-47890?component-type=maven&component-name=org.springframework%2Fspring-webmvc&utm_source=java-http-client&utm_medium=integration&utm_content=17.0.20) - Spring Framework 6.2.19 is the last open source release of the 6.2.x line: the fix is published to Enterprise Support customers only, and the open source fix 7.0.9 requires Spring Framework 7 / Spring Boot 4, which this line does not use. Remove when Grails moves to Spring Boot 4 - org.springframework:spring-webmvc:6.2.19: [CVE-2026-59313](https://guide.sonatype.com/vulnerability/CVE-2026-59313?component-type=maven&component-name=org.springframework%2Fspring-webmvc&utm_source=java-http-client&utm_medium=integration&utm_content=17.0.20) - Spring Framework 6.2.19 is the last open source release of the 6.2.x line: the fix is published to Enterprise Support customers only, and the open source fix 7.0.9 requires Spring Framework 7 / Spring Boot 4, which this line does not use. Remove when Grails moves to Spring Boot 4 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
