matrei opened a new pull request, #16767: URL: https://github.com/apache/grails-core/pull/16767
Dependency updates for 7.0.18, ahead of the release. The vulnerability scan has not run on 7.0.x since July: its schedule only covers the default branch, now 8.0.x. A manual run on 7.0.x (https://github.com/apache/grails-core/actions/runs/40287647804) found the Sonatype Guide issues addressed below. The Tomcat and Jackson CVEs are not in OSV yet, so the scan does not flag them. ### Security updates | Dependency | From | To | Fixes | |---|---|---|---| | Tomcat | 10.1.60 | 10.1.61 | CVE-2026-101356, CVE-2026-101296 (both Important) and four Low | | Jackson | 2.22.3 | 2.22.4 | CVE-2026-110879 (databind) and the Avro, CBOR, Protobuf and Smile CVEs in its release notes | | Forge jackson-databind | 2.18.11 | 2.18.12 | CVE-2026-110879, CVE-2026-54516 | | ASM | 9.10.1 | 9.11.1 | CVE-2026-110257 to CVE-2026-110263, CVE-2026-110270, CVE-2026-110591 | | Guava | 33.6.0-jre | 33.7.2-jre | CVE-2026-102554 | `asm-analysis`, `asm-commons` and `asm-tree` are now managed alongside `asm` and `asm-util`, so `asm-commons` no longer resolves to the 9.8 that `micronaut-inject-groovy` pulls. ### New overrides of spring-boot-dependencies There will be no further open source Spring Boot 3.5.x releases, so these Boot-managed versions stay vulnerable unless Grails overrides them: - **Netty 4.1.139.Final** (Boot: 4.1.135.Final). This fixes about a dozen OSV advisories, including the critical CVE-2026-75595. Netty is not on any Grails project's classpath, but applications that add it get the version through `grails-bom`. `grails-micronaut-bom` does not force the override: Micronaut 4.9 manages Netty 4.2.x itself, and `enforcedPlatform()` consumers would otherwise be downgraded. - **PostgreSQL JDBC 42.7.14** (Boot: 42.7.11). This fixes CVE-2026-54291. The Forge PostgreSQL feature adds the driver without a version, so generated apps got 42.7.11. Forge's own `postgresqlVersion` moves from 42.7.13 to 42.7.14. ### Exclusions (no fix upstream) - Hibernate Validator CVE-2026-93879 (via Spring Boot) - json-smart CVE-2026-113602 (every release through 2.6.0, the newest) - android-json CVE-2026-110974 (unmaintained, via `spring-boot-cli`) Sonatype Guide lists "no fixed version known" for the ASM and Jackson CVEs too, so its data may still flag ASM 9.11.1 and Jackson 2.22.4 even though upstream fixed them. The scan on this PR will show whether it does. ### Patch updates asset-pipeline 5.0.36, byte-buddy 1.18.16, bootstrap-icons 1.13.2, commons-codec 1.22.1, httpclient5 5.6.5 and micrometer 1.16.8. In Forge: Micronaut 3.10.17. Forge's picocli stays on 4.7.5: 4.7.7 pulls jline 3.29.0, which the CycloneDX license check rejects (SbomPlugin only maps jline 3.23.0 around https://github.com/CycloneDX/cyclonedx-core-java/issues/205). ### Testing Run locally on JDK 17.0.18, with the commands from `gradle.yml`: - `./gradlew build :grails-shell-cli:installDist :build-logic-root:vulnerability-scan:check -PonlyCoreTests` - `./gradlew bootJar check -PonlyFunctionalTests` (with the other suites skipped), then `-PonlySpringSecurityTests`, `-PonlyHibernate5Tests`, `-PonlyMongodbTests` and `-PonlyRedisTests` with the default container versions - `./gradlew validateDependencyVersions` in the root and in `grails-gradle` - `./gradlew build` in `grails-gradle` and in `grails-forge` - `./gradlew vulnerabilityScan` against OSV: no findings in 155 projects. Sonatype Guide was not consulted locally. All passed. Not run locally: the JDK 21 and 25 matrix entries, and the other MongoDB and Redis container versions. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
