jamesfredley commented on code in PR #16737:
URL: https://github.com/apache/grails-core/pull/16737#discussion_r4354822579
##########
dependencies.gradle:
##########
@@ -74,38 +74,34 @@ ext {
'cas-client-core.version' : '4.1.1',
'bootstrap-icons.version' : '1.13.2',
'bootstrap.version' : '5.3.8',
- // Overrides the 1.18.11 Spring Boot 4.1 manages, on every
classpath, so the BOM manages the
- // version Selenium 4.49.0 pulls in transitively - see
selenium.version. Can return to Boot's
- // version when the Selenium pin is dropped.
- 'byte-buddy.version' : '1.18.13',
'checker-qual.version' : '3.55.1',
'commons-codec.version' : '1.22.1',
'geb-spock.version' : '8.0.1',
- // Pinned deliberately as a drift tripwire even though it matches
Spring Boot's
- // managed version: graphql-java-extended-scalars (below) is NOT
managed by Spring
- // Boot and must be upgraded in lockstep with graphql-java.
Keeping this pin makes
- // the dependency validator flag any Spring Boot graphql-java bump
so we re-check
- // extended-scalars compatibility. See
https://github.com/apache/grails-core/issues/15674
- 'graphql-java.version' : '25.0',
+ // Pinned as a drift tripwire even though 25.1 matches Spring Boot
4.1.2: graphql-java-
+ // extended-scalars is not managed by Spring Boot. Keeping this
pin makes a later Boot
+ // graphql-java bump force a compatibility check of
extended-scalars, not an equal-version
+ // upgrade. See https://github.com/apache/grails-core/issues/15674
+ 'graphql-java.version' : '25.1',
'graphql-java-extended-scalars.version': '24.0',
'groovy.version' : '5.1.3',
// Security: 33.7.2 addresses CVE-2026-102554 (uncontrolled
resource consumption).
'guava.version' : '33.7.2-jre',
// Groovy YAML 5.1.0 requires a minimum of Jackson 2.22.1, and
2.22.3 also overrides the
- // 2.21.5 Spring Boot 4.1 manages: it adds the
StreamReadConstraints length limit to
+ // 2.21.7 Spring Boot 4.1 manages: it adds the
StreamReadConstraints length limit to
Review Comment:
Updated to Spring Boot 4.1.2 in 781e5d0.
##########
build-logic/vulnerability-scan/src/main/groovy/org/apache/grails/buildsrc/scan/VulnerabilityScanPlugin.groovy:
##########
@@ -88,8 +88,9 @@ class VulnerabilityScanPlugin implements Plugin<Project> {
'5.7.x through 6.5.10 as affected. The 7.x line
already carries the fix for the preceding ' +
'CVE-2026-22747. Remove once Sonatype narrows its
affected range'),
new VulnerabilityExclusion('CVE-2026-47842',
'org.springframework.security:spring-security-crypto',
- 'Sonatype flags 7.1.1, but
https://spring.io/security/cve-2026-47842 explicitly lists 7.1.1 as ' +
- 'fixed. It is the latest stable 7.1.x release and
the version Spring Boot 4.1.1 manages. ' +
+ 'Spring Boot 4.1.2 manages 7.1.2, which is past the fixed
7.1.1 listed at ' +
+ 'https://spring.io/security/cve-2026-47842.
Sonatype\'s affected range was already wrong ' +
+ 'for that fixed release. ' +
'Remove once Sonatype corrects its affected range;
reassess on any Spring Security upgrade'),
Review Comment:
Restored the version Sonatype flags: 7.1.1, which the Spring advisory lists
as fixed. Spring Boot 4.1.2 manages 7.1.2, past that release. The exclusion
stays until Sonatype narrows the range past the version Boot manages. 781e5d0.
##########
dependencies.gradle:
##########
@@ -74,38 +74,34 @@ ext {
'cas-client-core.version' : '4.1.1',
'bootstrap-icons.version' : '1.13.2',
'bootstrap.version' : '5.3.8',
- // Overrides the 1.18.11 Spring Boot 4.1 manages, on every
classpath, so the BOM manages the
- // version Selenium 4.49.0 pulls in transitively - see
selenium.version. Can return to Boot's
- // version when the Selenium pin is dropped.
- 'byte-buddy.version' : '1.18.13',
'checker-qual.version' : '3.55.1',
'commons-codec.version' : '1.22.1',
'geb-spock.version' : '8.0.1',
- // Pinned deliberately as a drift tripwire even though it matches
Spring Boot's
- // managed version: graphql-java-extended-scalars (below) is NOT
managed by Spring
- // Boot and must be upgraded in lockstep with graphql-java.
Keeping this pin makes
- // the dependency validator flag any Spring Boot graphql-java bump
so we re-check
- // extended-scalars compatibility. See
https://github.com/apache/grails-core/issues/15674
- 'graphql-java.version' : '25.0',
+ // Pinned as a drift tripwire even though 25.1 matches Spring Boot
4.1.2: graphql-java-
+ // extended-scalars is not managed by Spring Boot. Keeping this
pin makes a later Boot
+ // graphql-java bump force a compatibility check of
extended-scalars, not an equal-version
+ // upgrade. See https://github.com/apache/grails-core/issues/15674
+ 'graphql-java.version' : '25.1',
'graphql-java-extended-scalars.version': '24.0',
'groovy.version' : '5.1.3',
// Security: 33.7.2 addresses CVE-2026-102554 (uncontrolled
resource consumption).
'guava.version' : '33.7.2-jre',
// Groovy YAML 5.1.0 requires a minimum of Jackson 2.22.1, and
2.22.3 also overrides the
- // 2.21.5 Spring Boot 4.1 manages: it adds the
StreamReadConstraints length limit to
+ // 2.21.7 Spring Boot 4.1 manages: it adds the
StreamReadConstraints length limit to
Review Comment:
Updated to Spring Boot 4.1.2 in 781e5d0.
##########
dependencies.gradle:
##########
@@ -74,38 +74,34 @@ ext {
'cas-client-core.version' : '4.1.1',
'bootstrap-icons.version' : '1.13.2',
'bootstrap.version' : '5.3.8',
- // Overrides the 1.18.11 Spring Boot 4.1 manages, on every
classpath, so the BOM manages the
- // version Selenium 4.49.0 pulls in transitively - see
selenium.version. Can return to Boot's
- // version when the Selenium pin is dropped.
- 'byte-buddy.version' : '1.18.13',
'checker-qual.version' : '3.55.1',
'commons-codec.version' : '1.22.1',
'geb-spock.version' : '8.0.1',
- // Pinned deliberately as a drift tripwire even though it matches
Spring Boot's
- // managed version: graphql-java-extended-scalars (below) is NOT
managed by Spring
- // Boot and must be upgraded in lockstep with graphql-java.
Keeping this pin makes
- // the dependency validator flag any Spring Boot graphql-java bump
so we re-check
- // extended-scalars compatibility. See
https://github.com/apache/grails-core/issues/15674
- 'graphql-java.version' : '25.0',
+ // Pinned as a drift tripwire even though 25.1 matches Spring Boot
4.1.2: graphql-java-
+ // extended-scalars is not managed by Spring Boot. Keeping this
pin makes a later Boot
+ // graphql-java bump force a compatibility check of
extended-scalars, not an equal-version
+ // upgrade. See https://github.com/apache/grails-core/issues/15674
+ 'graphql-java.version' : '25.1',
'graphql-java-extended-scalars.version': '24.0',
'groovy.version' : '5.1.3',
// Security: 33.7.2 addresses CVE-2026-102554 (uncontrolled
resource consumption).
'guava.version' : '33.7.2-jre',
// Groovy YAML 5.1.0 requires a minimum of Jackson 2.22.1, and
2.22.3 also overrides the
- // 2.21.5 Spring Boot 4.1 manages: it adds the
StreamReadConstraints length limit to
+ // 2.21.7 Spring Boot 4.1 manages: it adds the
StreamReadConstraints length limit to
// GregorianCalendar/Duration (CVE-2026-68497) and restricts the
URI schemes
// java.nio.file.Path deserialization accepts (CVE-2026-19032).
Jackson 2 only releases
// jackson-annotations on the minor, hence the separate 2.22
below. 2.22.3 also fixes
// CVE-2026-89425, CVE-2026-89407, CVE-2026-91777 and
CVE-2026-91776.
'jackson-2-bom.version' : '2.22.3',
'jackson2-annotations.version' : '2.22',
- // Security: overrides Jackson 3.1.5 from Spring Boot 4.1. The
3.2.3 BOM aligns the family
+ // Security: overrides Jackson 3.1.7 from Spring Boot 4.1. The
3.2.3 BOM aligns the family
Review Comment:
Updated to Spring Boot 4.1.2 in 781e5d0.
##########
dependencies.gradle:
##########
@@ -220,13 +206,13 @@ ext {
'groovy-xml' :
"org.apache.groovy:groovy-xml:${bomDependencyVersions['groovy.version']}",
'groovy-yaml' :
"org.apache.groovy:groovy-yaml:${bomDependencyVersions['groovy.version']}",
'guava' :
"com.google.guava:guava:${bomDependencyVersions['guava.version']}",
- // Security override of the 2.21.5 spring-boot-dependencies
imports through
+ // Security override of the 2.21.7 spring-boot-dependencies
imports through
// com.fasterxml.jackson:jackson-bom - see jackson-2-bom.version
'jackson2-annotations' :
"com.fasterxml.jackson.core:jackson-annotations:${bomDependencyVersions['jackson2-annotations.version']}",
'jackson-2-bom-core' :
"com.fasterxml.jackson.core:jackson-core:${bomDependencyVersions['jackson-2-bom.version']}",
'jackson-2-bom-databind' :
"com.fasterxml.jackson.core:jackson-databind:${bomDependencyVersions['jackson-2-bom.version']}",
'jackson-2-bom-datatype-jsr310':
"com.fasterxml.jackson.datatype:jackson-datatype-jsr310:${bomDependencyVersions['jackson-2-bom.version']}",
- // Security override of the 3.1.5 spring-boot-dependencies imports
through
+ // Security override of the 3.1.7 spring-boot-dependencies imports
through
Review Comment:
This line does not say Spring Boot 4.1. It names the Jackson 3 BOM version
spring-boot-dependencies imports (3.1.7). Leaving it.
##########
dependencies.gradle:
##########
@@ -220,13 +206,13 @@ ext {
'groovy-xml' :
"org.apache.groovy:groovy-xml:${bomDependencyVersions['groovy.version']}",
'groovy-yaml' :
"org.apache.groovy:groovy-yaml:${bomDependencyVersions['groovy.version']}",
'guava' :
"com.google.guava:guava:${bomDependencyVersions['guava.version']}",
- // Security override of the 2.21.5 spring-boot-dependencies
imports through
+ // Security override of the 2.21.7 spring-boot-dependencies
imports through
Review Comment:
This line does not say Spring Boot 4.1. It names the jackson-bom version
spring-boot-dependencies imports (2.21.7). Leaving it.
##########
dependencies.gradle:
##########
@@ -324,7 +306,7 @@ ext {
if (project.name in ['grails-bom', 'grails-hibernate5-bom'] ||
project.name.startsWith('grails-data-hibernate5')) {
customBomVersions = [
'liquibase-hibernate.version': '4.27.0',
- 'liquibase.version' : '4.27.0',
+ 'liquibase.version' : '4.27.0', //
liquibase-hibernate5 stops at 4.27.0, and Boot 4.1.2's Liquibase 5.0.4 is a new
major.
Review Comment:
Keeping the rationale on the pin. Not extracting it.
##########
dependencies.gradle:
##########
@@ -366,14 +348,15 @@ ext {
customBomVersions = [
'cache-ri-impl.version' : '1.1.1',
'derby.version' : '10.17.1.0',
- // Spring Boot 4.1 can select Hibernate ORM 7.4.x through
Spring Dependency
- // Management, and Hibernate ORM 7.4.x requires
hibernate-models 1.1.x.
+ // Spring Boot 4.1.2 selects Hibernate ORM 7.4.13.Final. This
BOM strictly re-declares
+ // that version so enforcedPlatform consumers are forced to
it; a platform() import
+ // is not enforced. 7.4.13.Final still requires
hibernate-models 1.1.2.
'hibernate-models.version' : '1.1.2',
'hibernate-tools.version' : '7.3.13.Final',
- 'hibernate.version' : '7.4.10.Final',
+ 'hibernate.version' : '7.4.13.Final',
'jandex.version' : '3.6.0',
'liquibase-test-harness.version': '1.0.11',
- 'liquibase.version' : '4.27.0',
+ 'liquibase.version' : '4.27.0', //
liquibase-hibernate5 stops at 4.27.0, and Boot 4.1.2's Liquibase 5.0.4 is a new
major.
Review Comment:
Keeping the Hibernate 7 local re-declaration and the pin rationale as
written.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
