codeconsole opened a new pull request, #16738: URL: https://github.com/apache/grails-core/pull/16738
Moves 9.1.x from Spring Boot 4.2.0-M2, which #16408 brought in, to [Spring Boot 4.2.0-RC1](https://github.com/spring-projects/spring-boot/releases/tag/v4.2.0-RC1). ### Managed versions that change | | Spring Boot 4.2.0-M2 | Spring Boot 4.2.0-RC1 | |---|---|---| | Spring Framework | 7.1.0-M2 | 7.1.0-RC1 | | Spring Security | 7.2.0-M2 | 7.2.0-RC1 | | Spring Data | 2026.1.0-M2 | 2026.1.0-RC1 | | Micrometer | 1.18.0-M2 | 1.18.0-RC1 | | Reactor | 2026.0.0-M2 | 2026.0.0-RC1 | | Hibernate ORM | 7.4.9.Final | 7.4.13.Final | | Tomcat | 11.0.26 | 11.0.27 | | MongoDB driver | 5.11.1 | 5.13.0 | | Logback | 1.6.3 | 1.6.5 | | Jackson 3 / Jackson 2 | 3.1.6 / 2.21.6 | 3.1.7 / 2.21.7 | | H2 | 2.5.250 | 2.5.252 | | Jedis | 8.0.1 | 8.0.2 | graphql-java stays at 26.1, and Jedis 8.0.2 still depends on `org.json:json:20260719`, so the LEGAL-666 SBOM mapping does not move. ### Changes Spring Framework 7.1.0-RC1 requires - **`ForwardedHeaderUtils.parseStandardHeader` and `parseXForwardedHeaders` with remote and local addresses are deprecated for removal**, in favor of new `parseStandardHeader(URI, HttpHeaders)` and `parseXForwardedHeaders(URI, HttpHeaders)`. `GrailsSecurityHeadersFilter` reads only the forwarded scheme for its HSTS decision and passed `null` for both addresses, so it moves to the new methods with no change in behavior. - **A problem detail no longer gets the request path as its `instance`** ([spring-framework#35969](https://github.com/spring-projects/spring-framework/issues/35969)). RFC 9457 defines `instance` as a URI that identifies the specific occurrence of the problem, which the request path does not, so Spring MVC 7.1 leaves it unset when a handler method returns a `ProblemDetail` or an `ErrorResponse`. A `ProblemDetail` a Grails action returns is written by those handlers and lost its `instance` with the upgrade. `respond` writes a problem as Spring MVC writes one a handler method returns, so it no longer sets the `instance` either, for a `ProblemDetail`, an `ErrorResponse`, or the problem it writes for validation errors. An `instance` the application sets is written as before: ```groovy ProblemDetail problem = validationProblemDetailFactory.create(book.errors) problem.instance = URI.create("urn:uuid:${UUID.randomUUID()}") respond problem ``` The OpenAPI `ValidationProblem` schema still describes `instance`, as an optional member the application may set. ### grails-bom - The Logback (1.6.5) pin goes: Spring Boot 4.2.0-RC1 manages 1.6.5, which carries the CVE-2026-19880 and CVE-2026-104721 fixes the pin was for. - The MongoDB driver pin (5.12.0) goes: Spring Boot 4.2.0-RC1 manages 5.13.0. - Jackson 2 stays at 2.22.3, because Groovy YAML 6.0.0 depends on 2.22.2. Jackson 3 stays at 3.2.3, so that moving to Spring Boot 4.2 does not take it from the 3.2 line Grails 8 and 9.0 manage back to 3.1. Spring Boot's 3.1.7 and 2.21.7 now carry the CVE-2026-89425, CVE-2026-89407, CVE-2026-91777 and CVE-2026-91776 fixes, so neither pin is a security override any more. - The CVE-2026-47842 vulnerability-scan exclusion for `spring-security-crypto` now describes 7.2.0-RC1, which Spring's advisory does not list and which carries the 7.1.1 fix. ### Documentation - The Grails 9 upgrade notes gain the `instance` change, and a tip on `spring.properties.migrator.fail`, new in Spring Boot 4.2, which makes the application fail to start while a renamed property such as `server.tomcat.use-relative-redirects` is left. - The `respond` reference and the REST validation-errors section describe a problem without an `instance` as written without one. ### Limitations - 9.1.x snapshots depend on release candidates of Spring Boot, Spring Framework, Spring Security, Spring Data, Micrometer and Reactor until 4.2.0 is released, and 9.1.0 cannot be released before it. - The Hibernate 7 BOM keeps Hibernate ORM 7.4.10.Final, which every release line manages, so applications using `grails-data-hibernate7` get 7.4.10 through the enforced platform although Spring Boot 4.2.0-RC1 manages 7.4.13.Final. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
