Copilot commented on code in PR #16737:
URL: https://github.com/apache/grails-core/pull/16737#discussion_r4354413908
##########
build-logic/vulnerability-scan/src/main/groovy/org/apache/grails/buildsrc/scan/VulnerabilityScanPlugin.groovy:
##########
@@ -88,8 +88,9 @@ class VulnerabilityScanPlugin implements Plugin<Project> {
'5.7.x through 6.5.10 as affected. The 7.x line
already carries the fix for the preceding ' +
'CVE-2026-22747. Remove once Sonatype narrows its
affected range'),
new VulnerabilityExclusion('CVE-2026-47842',
'org.springframework.security:spring-security-crypto',
- 'Sonatype flags 7.1.1, but
https://spring.io/security/cve-2026-47842 explicitly lists 7.1.1 as ' +
- 'fixed. It is the latest stable 7.1.x release and
the version Spring Boot 4.1.1 manages. ' +
+ 'Spring Boot 4.1.2 manages 7.1.2, which is past the fixed
7.1.1 listed at ' +
+ 'https://spring.io/security/cve-2026-47842.
Sonatype\'s affected range was already wrong ' +
+ 'for that fixed release. ' +
'Remove once Sonatype corrects its affected range;
reassess on any Spring Security upgrade'),
Review Comment:
The updated rationale no longer states which version Sonatype is currently
flagging (previously it explicitly said Sonatype flags 7.1.1). Since the
exclusion remains, it would be clearer to explicitly note whether Sonatype is
(still) flagging 7.1.2 (or some range including it) and that this exclusion is
required to keep scans green despite the upstream advisory indicating the
version is fixed.
##########
dependencies.gradle:
##########
@@ -74,38 +74,34 @@ ext {
'cas-client-core.version' : '4.1.1',
'bootstrap-icons.version' : '1.13.2',
'bootstrap.version' : '5.3.8',
- // Overrides the 1.18.11 Spring Boot 4.1 manages, on every
classpath, so the BOM manages the
- // version Selenium 4.49.0 pulls in transitively - see
selenium.version. Can return to Boot's
- // version when the Selenium pin is dropped.
- 'byte-buddy.version' : '1.18.13',
'checker-qual.version' : '3.55.1',
'commons-codec.version' : '1.22.1',
'geb-spock.version' : '8.0.1',
- // Pinned deliberately as a drift tripwire even though it matches
Spring Boot's
- // managed version: graphql-java-extended-scalars (below) is NOT
managed by Spring
- // Boot and must be upgraded in lockstep with graphql-java.
Keeping this pin makes
- // the dependency validator flag any Spring Boot graphql-java bump
so we re-check
- // extended-scalars compatibility. See
https://github.com/apache/grails-core/issues/15674
- 'graphql-java.version' : '25.0',
+ // Pinned as a drift tripwire even though 25.1 matches Spring Boot
4.1.2: graphql-java-
+ // extended-scalars is not managed by Spring Boot. Keeping this
pin makes a later Boot
+ // graphql-java bump force a compatibility check of
extended-scalars, not an equal-version
+ // upgrade. See https://github.com/apache/grails-core/issues/15674
+ 'graphql-java.version' : '25.1',
'graphql-java-extended-scalars.version': '24.0',
'groovy.version' : '5.1.3',
// Security: 33.7.2 addresses CVE-2026-102554 (uncontrolled
resource consumption).
'guava.version' : '33.7.2-jre',
// Groovy YAML 5.1.0 requires a minimum of Jackson 2.22.1, and
2.22.3 also overrides the
- // 2.21.5 Spring Boot 4.1 manages: it adds the
StreamReadConstraints length limit to
+ // 2.21.7 Spring Boot 4.1 manages: it adds the
StreamReadConstraints length limit to
Review Comment:
These comments refer to 'Spring Boot 4.1' while the PR specifically bumps to
4.1.2 and other nearby comments already say '4.1.2'. To avoid stale guidance,
update the wording consistently (e.g., 'Spring Boot 4.1.2 manages/imports')
where the managed baseline is tied to this bump.
##########
dependencies.gradle:
##########
@@ -220,13 +206,13 @@ ext {
'groovy-xml' :
"org.apache.groovy:groovy-xml:${bomDependencyVersions['groovy.version']}",
'groovy-yaml' :
"org.apache.groovy:groovy-yaml:${bomDependencyVersions['groovy.version']}",
'guava' :
"com.google.guava:guava:${bomDependencyVersions['guava.version']}",
- // Security override of the 2.21.5 spring-boot-dependencies
imports through
+ // Security override of the 2.21.7 spring-boot-dependencies
imports through
// com.fasterxml.jackson:jackson-bom - see jackson-2-bom.version
'jackson2-annotations' :
"com.fasterxml.jackson.core:jackson-annotations:${bomDependencyVersions['jackson2-annotations.version']}",
'jackson-2-bom-core' :
"com.fasterxml.jackson.core:jackson-core:${bomDependencyVersions['jackson-2-bom.version']}",
'jackson-2-bom-databind' :
"com.fasterxml.jackson.core:jackson-databind:${bomDependencyVersions['jackson-2-bom.version']}",
'jackson-2-bom-datatype-jsr310':
"com.fasterxml.jackson.datatype:jackson-datatype-jsr310:${bomDependencyVersions['jackson-2-bom.version']}",
- // Security override of the 3.1.5 spring-boot-dependencies imports
through
+ // Security override of the 3.1.7 spring-boot-dependencies imports
through
Review Comment:
These comments refer to 'Spring Boot 4.1' while the PR specifically bumps to
4.1.2 and other nearby comments already say '4.1.2'. To avoid stale guidance,
update the wording consistently (e.g., 'Spring Boot 4.1.2 manages/imports')
where the managed baseline is tied to this bump.
##########
dependencies.gradle:
##########
@@ -366,14 +348,15 @@ ext {
customBomVersions = [
'cache-ri-impl.version' : '1.1.1',
'derby.version' : '10.17.1.0',
- // Spring Boot 4.1 can select Hibernate ORM 7.4.x through
Spring Dependency
- // Management, and Hibernate ORM 7.4.x requires
hibernate-models 1.1.x.
+ // Spring Boot 4.1.2 selects Hibernate ORM 7.4.13.Final. This
BOM strictly re-declares
+ // that version so enforcedPlatform consumers are forced to
it; a platform() import
+ // is not enforced. 7.4.13.Final still requires
hibernate-models 1.1.2.
'hibernate-models.version' : '1.1.2',
'hibernate-tools.version' : '7.3.13.Final',
- 'hibernate.version' : '7.4.10.Final',
+ 'hibernate.version' : '7.4.13.Final',
'jandex.version' : '3.6.0',
'liquibase-test-harness.version': '1.0.11',
- 'liquibase.version' : '4.27.0',
+ 'liquibase.version' : '4.27.0', //
liquibase-hibernate5 stops at 4.27.0, and Boot 4.1.2's Liquibase 5.0.4 is a new
major.
Review Comment:
The same long inline rationale is duplicated in two places. Consider moving
this rationale to a short block comment immediately above each
`customBomVersions` map (or a shared comment where the conditional branches are
introduced) and keep the map entries themselves comment-free; this improves
readability and reduces duplication when the rationale needs edits later.
##########
dependencies.gradle:
##########
@@ -324,7 +306,7 @@ ext {
if (project.name in ['grails-bom', 'grails-hibernate5-bom'] ||
project.name.startsWith('grails-data-hibernate5')) {
customBomVersions = [
'liquibase-hibernate.version': '4.27.0',
- 'liquibase.version' : '4.27.0',
+ 'liquibase.version' : '4.27.0', //
liquibase-hibernate5 stops at 4.27.0, and Boot 4.1.2's Liquibase 5.0.4 is a new
major.
Review Comment:
The same long inline rationale is duplicated in two places. Consider moving
this rationale to a short block comment immediately above each
`customBomVersions` map (or a shared comment where the conditional branches are
introduced) and keep the map entries themselves comment-free; this improves
readability and reduces duplication when the rationale needs edits later.
##########
dependencies.gradle:
##########
@@ -74,38 +74,34 @@ ext {
'cas-client-core.version' : '4.1.1',
'bootstrap-icons.version' : '1.13.2',
'bootstrap.version' : '5.3.8',
- // Overrides the 1.18.11 Spring Boot 4.1 manages, on every
classpath, so the BOM manages the
- // version Selenium 4.49.0 pulls in transitively - see
selenium.version. Can return to Boot's
- // version when the Selenium pin is dropped.
- 'byte-buddy.version' : '1.18.13',
'checker-qual.version' : '3.55.1',
'commons-codec.version' : '1.22.1',
'geb-spock.version' : '8.0.1',
- // Pinned deliberately as a drift tripwire even though it matches
Spring Boot's
- // managed version: graphql-java-extended-scalars (below) is NOT
managed by Spring
- // Boot and must be upgraded in lockstep with graphql-java.
Keeping this pin makes
- // the dependency validator flag any Spring Boot graphql-java bump
so we re-check
- // extended-scalars compatibility. See
https://github.com/apache/grails-core/issues/15674
- 'graphql-java.version' : '25.0',
+ // Pinned as a drift tripwire even though 25.1 matches Spring Boot
4.1.2: graphql-java-
+ // extended-scalars is not managed by Spring Boot. Keeping this
pin makes a later Boot
+ // graphql-java bump force a compatibility check of
extended-scalars, not an equal-version
+ // upgrade. See https://github.com/apache/grails-core/issues/15674
+ 'graphql-java.version' : '25.1',
'graphql-java-extended-scalars.version': '24.0',
'groovy.version' : '5.1.3',
// Security: 33.7.2 addresses CVE-2026-102554 (uncontrolled
resource consumption).
'guava.version' : '33.7.2-jre',
// Groovy YAML 5.1.0 requires a minimum of Jackson 2.22.1, and
2.22.3 also overrides the
- // 2.21.5 Spring Boot 4.1 manages: it adds the
StreamReadConstraints length limit to
+ // 2.21.7 Spring Boot 4.1 manages: it adds the
StreamReadConstraints length limit to
// GregorianCalendar/Duration (CVE-2026-68497) and restricts the
URI schemes
// java.nio.file.Path deserialization accepts (CVE-2026-19032).
Jackson 2 only releases
// jackson-annotations on the minor, hence the separate 2.22
below. 2.22.3 also fixes
// CVE-2026-89425, CVE-2026-89407, CVE-2026-91777 and
CVE-2026-91776.
'jackson-2-bom.version' : '2.22.3',
'jackson2-annotations.version' : '2.22',
- // Security: overrides Jackson 3.1.5 from Spring Boot 4.1. The
3.2.3 BOM aligns the family
+ // Security: overrides Jackson 3.1.7 from Spring Boot 4.1. The
3.2.3 BOM aligns the family
Review Comment:
These comments refer to 'Spring Boot 4.1' while the PR specifically bumps to
4.1.2 and other nearby comments already say '4.1.2'. To avoid stale guidance,
update the wording consistently (e.g., 'Spring Boot 4.1.2 manages/imports')
where the managed baseline is tied to this bump.
##########
dependencies.gradle:
##########
@@ -220,13 +206,13 @@ ext {
'groovy-xml' :
"org.apache.groovy:groovy-xml:${bomDependencyVersions['groovy.version']}",
'groovy-yaml' :
"org.apache.groovy:groovy-yaml:${bomDependencyVersions['groovy.version']}",
'guava' :
"com.google.guava:guava:${bomDependencyVersions['guava.version']}",
- // Security override of the 2.21.5 spring-boot-dependencies
imports through
+ // Security override of the 2.21.7 spring-boot-dependencies
imports through
Review Comment:
These comments refer to 'Spring Boot 4.1' while the PR specifically bumps to
4.1.2 and other nearby comments already say '4.1.2'. To avoid stale guidance,
update the wording consistently (e.g., 'Spring Boot 4.1.2 manages/imports')
where the managed baseline is tied to this bump.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
