The GitHub Actions job "Vulnerability Scan" on grails-core.git/build/vulnerability-scan-plugin has failed. Run started by GitHub user jdaugherty (triggered by jdaugherty).
Head commit for run: b9b13ef2fcca05887300c7e3ac24e5efecf4410d / James Daugherty <[email protected]> Address review feedback on the vulnerability scan Always leave a report when a scan fails: delete the previous run's report first, resolve the dependency graphs inside the guarded block, catch every exception, and keep cache writes best-effort so an unwritable cache cannot fail a scan. A dependency the graph could not resolve now fails the scan with an error report instead of being skipped: Gradle's resolution result is lenient, so a warning alone would have let the summary vouch for a project whose vulnerable dependency was never looked up. Apply reportMaxBytes to the whole summary, cutting the first section that does not fit at a line boundary, so a long list of exclusions cannot push a pull request comment past GitHub's limit. Match Sonatype Guide reports to their component by a normalized package URL and fail when none matches, rather than falling back to the position in the answer. Run the plugin's specs in the CI build jobs through the root build. Compare exclusion ids regardless of case, map the extension's configurations lazily into the task, rate OSV records that only carry a CVSS v3 vector by its base score, and document the cache growth and the serial scans. Report URL: https://github.com/apache/grails-core/actions/runs/37482371451 With regards, GitHub Actions via GitBox
