github-actions[bot] commented on PR #16767: URL: https://github.com/apache/grails-core/pull/16767#issuecomment-6414483814
<!-- grails-vulnerability-scan --> ## 🔍 Vulnerability Scan — pull request ✅ No known vulnerabilities in the dependencies of 155 scanned projects. Checked against OSV and Sonatype Guide. ### Excluded - ch.qos.logback:logback-classic:1.5.38: [CVE-2026-104721](https://guide.sonatype.com/vulnerability/CVE-2026-104721?component-type=maven&component-name=ch.qos.logback%2Flogback-classic&utm_source=java-http-client&utm_medium=integration&utm_content=17.0.21) - Fixed only on the logback 1.6.x line, and no Spring Boot release manages it, so adopting it would put logback two minor lines ahead of the stack it integrates with. Grails ships no SiftingAppender/MDCBasedDiscriminator configuration, so exposure is limited to applications that opt into that pattern with attacker-controlled MDC values. Remove once a Spring Boot release manages logback 1.6.5 or later - ch.qos.logback:logback-classic:1.5.38: [CVE-2026-19880](https://guide.sonatype.com/vulnerability/CVE-2026-19880?component-type=maven&component-name=ch.qos.logback%2Flogback-classic&utm_source=java-http-client&utm_medium=integration&utm_content=17.0.21) - Fixed only on the logback 1.6.x line, and no Spring Boot release manages it, so adopting it would put logback two minor lines ahead of the stack it integrates with. Grails ships no SiftingAppender/MDCBasedDiscriminator configuration, so exposure is limited to applications that opt into that pattern with attacker-controlled MDC values. Remove once a Spring Boot release manages logback 1.6.5 or later - com.h2database:h2:2.4.240: [CVE-2018-14335](https://guide.sonatype.com/vulnerability/CVE-2018-14335?component-type=maven&component-name=com.h2database%2Fh2&utm_source=java-http-client&utm_medium=integration&utm_content=17.0.21) - Sonatype Guide flags every H2 version and no fixed release exists upstream, see https://github.com/h2database/h2database/issues/1294 - com.vaadin.external.google:android-json:0.0.20131108.vaadin1: [CVE-2026-110974](https://guide.sonatype.com/vulnerability/CVE-2026-110974?component-type=maven&component-name=com.vaadin.external.google%2Fandroid-json&utm_source=java-http-client&utm_medium=integration&utm_content=17.0.21) - Pulled transitively via spring-boot-cli; com.vaadin.external.google:android-json is unmaintained and 0.0.20131108.vaadin1, its newest release, is affected. Remove once spring-boot-cli no longer requires it or a patched release ships - io.micronaut:micronaut-context:4.9.12: [GHSA-8hjv-92q9-g4xj](https://osv.dev/vulnerability/GHSA-8hjv-92q9-g4xj) - A fix requires Micronaut 4.10 or later, which pulls javaparser 3.28 while the grails-micronaut-bom pins javaparser-core to 3.27 (see dependencies.gradle). Remove once Micronaut ships a compatible patched release - io.micronaut:micronaut-inject:4.9.12: [CVE-2026-44242](https://guide.sonatype.com/vulnerability/CVE-2026-44242?component-type=maven&component-name=io.micronaut%2Fmicronaut-inject&utm_source=java-http-client&utm_medium=integration&utm_content=17.0.21) - A fix requires Micronaut 4.10 or later, which pulls javaparser 3.28 while the grails-micronaut-bom pins javaparser-core to 3.27 (see dependencies.gradle). Remove once Micronaut ships a compatible patched release - net.minidev:json-smart:2.5.2: [CVE-2026-113602](https://guide.sonatype.com/vulnerability/CVE-2026-113602?component-type=maven&component-name=net.minidev%2Fjson-smart&utm_source=java-http-client&utm_medium=integration&utm_content=17.0.21) - Managed by spring-boot-dependencies; every release through 2.6.0, the newest, is affected and no fixed release exists. Strict-mode parsing accepts a trailing 0x1A character. Remove once a patched release ships - org.fusesource.jansi:jansi:1.18: [CVE-2026-8484](https://guide.sonatype.com/vulnerability/CVE-2026-8484?component-type=maven&component-name=org.fusesource.jansi%2Fjansi&utm_source=java-http-client&utm_medium=integration&utm_content=17.0.21) - org.fusesource.jansi is unmaintained and every version through 2.4.3 is flagged, with no fixed release upstream. Grails still uses it for ANSI console output; remove once consumers migrate off fusesource jansi or a patched release ships - org.hdrhistogram:HdrHistogram:2.2.2: [CVE-2026-14683](https://guide.sonatype.com/vulnerability/CVE-2026-14683?component-type=maven&component-name=org.hdrhistogram%2FHdrHistogram&utm_source=java-http-client&utm_medium=integration&utm_content=17.0.21) - Pulled transitively via micrometer/actuator (LatencyUtils); the fix is HdrHistogram 2.2.3, which is not published to Maven Central yet. Remove once 2.2.3 or later resolves on the classpath - org.hdrhistogram:HdrHistogram:2.2.2: [CVE-2026-14686](https://guide.sonatype.com/vulnerability/CVE-2026-14686?component-type=maven&component-name=org.hdrhistogram%2FHdrHistogram&utm_source=java-http-client&utm_medium=integration&utm_content=17.0.21) - Pulled transitively via micrometer/actuator (LatencyUtils); the fix is HdrHistogram 2.2.3, which is not published to Maven Central yet. Remove once 2.2.3 or later resolves on the classpath - org.hibernate.validator:hibernate-validator:8.0.3.Final: [CVE-2026-93879](https://guide.sonatype.com/vulnerability/CVE-2026-93879?component-type=maven&component-name=org.hibernate.validator%2Fhibernate-validator&utm_source=java-http-client&utm_medium=integration&utm_content=17.0.21) - Managed by spring-boot-dependencies; no fixed release exists upstream, see https://bugzilla.redhat.com/show_bug.cgi?id=2540892. An unescaped {duplicates} message parameter is re-evaluated as Expression Language. Remove once a patched 8.0.x release ships - org.latencyutils:LatencyUtils:2.0.3: [CVE-2026-82596](https://guide.sonatype.com/vulnerability/CVE-2026-82596?component-type=maven&component-name=org.latencyutils%2FLatencyUtils&utm_source=java-http-client&utm_medium=integration&utm_content=17.0.21) - Pulled transitively via micrometer/actuator; all published releases through 2.0.3 are affected and no fixed release exists. A long pause can terminate the pause-detector dispatch thread and leave its queue growing, see https://github.com/LatencyUtils/LatencyUtils/issues/22. Remove once a patched release is available or micrometer no longer requires LatencyUtils - org.springframework.security:spring-security-core:6.5.11: [CVE-2026-59276](https://guide.sonatype.com/vulnerability/CVE-2026-59276?component-type=maven&component-name=org.springframework.security%2Fspring-security-core&utm_source=java-http-client&utm_medium=integration&utm_content=17.0.21) - Spring Security 6.5.11 is the last open source release of the 6.5.x line: the fix is published to Enterprise Support customers only, and the open source fixes require Spring Boot 4 / Spring Framework 7, which this line does not use. Remove when Grails moves to Spring Boot 4 - org.springframework.security:spring-security-crypto:6.5.11: [CVE-2026-47842](https://guide.sonatype.com/vulnerability/CVE-2026-47842?component-type=maven&component-name=org.springframework.security%2Fspring-security-crypto&utm_source=java-http-client&utm_medium=integration&utm_content=17.0.21) - Spring Security 6.5.11 is the last open source release of the 6.5.x line: the fix is published to Enterprise Support customers only, and the open source fixes require Spring Boot 4 / Spring Framework 7, which this line does not use. Remove when Grails moves to Spring Boot 4 - org.springframework.security:spring-security-oauth2-jose:6.5.11: [CVE-2026-41707](https://guide.sonatype.com/vulnerability/CVE-2026-41707?component-type=maven&component-name=org.springframework.security%2Fspring-security-oauth2-jose&utm_source=java-http-client&utm_medium=integration&utm_content=17.0.21) - Spring Security 6.5.11 is the last open source release of the 6.5.x line: the fix is published to Enterprise Support customers only, and the open source fixes require Spring Boot 4 / Spring Framework 7, which this line does not use. Remove when Grails moves to Spring Boot 4 - org.springframework.security:spring-security-web:6.5.11: [CVE-2026-47838](https://guide.sonatype.com/vulnerability/CVE-2026-47838?component-type=maven&component-name=org.springframework.security%2Fspring-security-web&utm_source=java-http-client&utm_medium=integration&utm_content=17.0.21) - Spring Security 6.5.11 is the last open source release of the 6.5.x line: the fix is published to Enterprise Support customers only, and the open source fixes require Spring Boot 4 / Spring Framework 7, which this line does not use. Remove when Grails moves to Spring Boot 4 - org.springframework.security:spring-security-web:6.5.11: [CVE-2026-47841](https://guide.sonatype.com/vulnerability/CVE-2026-47841?component-type=maven&component-name=org.springframework.security%2Fspring-security-web&utm_source=java-http-client&utm_medium=integration&utm_content=17.0.21) - Spring Security 6.5.11 is the last open source release of the 6.5.x line: the fix is published to Enterprise Support customers only, and the open source fixes require Spring Boot 4 / Spring Framework 7, which this line does not use. Remove when Grails moves to Spring Boot 4 - org.springframework.security:spring-security-web:6.5.11: [CVE-2026-59276](https://guide.sonatype.com/vulnerability/CVE-2026-59276?component-type=maven&component-name=org.springframework.security%2Fspring-security-web&utm_source=java-http-client&utm_medium=integration&utm_content=17.0.21) - Spring Security 6.5.11 is the last open source release of the 6.5.x line: the fix is published to Enterprise Support customers only, and the open source fixes require Spring Boot 4 / Spring Framework 7, which this line does not use. Remove when Grails moves to Spring Boot 4 - org.springframework:spring-beans:6.2.19: [CVE-2026-59282](https://guide.sonatype.com/vulnerability/CVE-2026-59282?component-type=maven&component-name=org.springframework%2Fspring-beans&utm_source=java-http-client&utm_medium=integration&utm_content=17.0.21) - Spring Framework 6.2.19 is the last open source release of the 6.2.x line: the fix is published to Enterprise Support customers only, and the open source fix 7.0.9 requires Spring Framework 7 / Spring Boot 4, which this line does not use. Remove when Grails moves to Spring Boot 4 - org.springframework:spring-context-support:6.2.19: [CVE-2026-59280](https://guide.sonatype.com/vulnerability/CVE-2026-59280?component-type=maven&component-name=org.springframework%2Fspring-context-support&utm_source=java-http-client&utm_medium=integration&utm_content=17.0.21) - Spring Framework 6.2.19 is the last open source release of the 6.2.x line: the fix is published to Enterprise Support customers only, and the open source fix 7.0.9 requires Spring Framework 7 / Spring Boot 4, which this line does not use. Remove when Grails moves to Spring Boot 4 - org.springframework:spring-expression:6.2.19: [CVE-2026-47886](https://guide.sonatype.com/vulnerability/CVE-2026-47886?component-type=maven&component-name=org.springframework%2Fspring-expression&utm_source=java-http-client&utm_medium=integration&utm_content=17.0.21) - Spring Framework 6.2.19 is the last open source release of the 6.2.x line: the fix is published to Enterprise Support customers only, and the open source fix 7.0.9 requires Spring Framework 7 / Spring Boot 4, which this line does not use. Remove when Grails moves to Spring Boot 4 - org.springframework:spring-expression:6.2.19: [CVE-2026-59283](https://guide.sonatype.com/vulnerability/CVE-2026-59283?component-type=maven&component-name=org.springframework%2Fspring-expression&utm_source=java-http-client&utm_medium=integration&utm_content=17.0.21) - Spring Framework 6.2.19 is the last open source release of the 6.2.x line: the fix is published to Enterprise Support customers only, and the open source fix 7.0.9 requires Spring Framework 7 / Spring Boot 4, which this line does not use. Remove when Grails moves to Spring Boot 4 - org.springframework:spring-web:6.2.19: [CVE-2026-47883](https://guide.sonatype.com/vulnerability/CVE-2026-47883?component-type=maven&component-name=org.springframework%2Fspring-web&utm_source=java-http-client&utm_medium=integration&utm_content=17.0.21) - Spring Framework 6.2.19 is the last open source release of the 6.2.x line: the fix is published to Enterprise Support customers only, and the open source fix 7.0.9 requires Spring Framework 7 / Spring Boot 4, which this line does not use. Remove when Grails moves to Spring Boot 4 - org.springframework:spring-web:6.2.19: [CVE-2026-47885](https://guide.sonatype.com/vulnerability/CVE-2026-47885?component-type=maven&component-name=org.springframework%2Fspring-web&utm_source=java-http-client&utm_medium=integration&utm_content=17.0.21) - Spring Framework 6.2.19 is the last open source release of the 6.2.x line: the fix is published to Enterprise Support customers only, and the open source fix 7.0.9 requires Spring Framework 7 / Spring Boot 4, which this line does not use. Remove when Grails moves to Spring Boot 4 - org.springframework:spring-web:6.2.19: [CVE-2026-47889](https://guide.sonatype.com/vulnerability/CVE-2026-47889?component-type=maven&component-name=org.springframework%2Fspring-web&utm_source=java-http-client&utm_medium=integration&utm_content=17.0.21) - Spring Framework 6.2.19 is the last open source release of the 6.2.x line: the fix is published to Enterprise Support customers only, and the open source fix 7.0.9 requires Spring Framework 7 / Spring Boot 4, which this line does not use. Remove when Grails moves to Spring Boot 4 - org.springframework:spring-web:6.2.19: [CVE-2026-47891](https://guide.sonatype.com/vulnerability/CVE-2026-47891?component-type=maven&component-name=org.springframework%2Fspring-web&utm_source=java-http-client&utm_medium=integration&utm_content=17.0.21) - Spring Framework 6.2.19 is the last open source release of the 6.2.x line: the fix is published to Enterprise Support customers only, and the open source fix 7.0.9 requires Spring Framework 7 / Spring Boot 4, which this line does not use. Remove when Grails moves to Spring Boot 4 - org.springframework:spring-web:6.2.19: [CVE-2026-59281](https://guide.sonatype.com/vulnerability/CVE-2026-59281?component-type=maven&component-name=org.springframework%2Fspring-web&utm_source=java-http-client&utm_medium=integration&utm_content=17.0.21) - Spring Framework 6.2.19 is the last open source release of the 6.2.x line: the fix is published to Enterprise Support customers only, and the open source fix 7.0.9 requires Spring Framework 7 / Spring Boot 4, which this line does not use. Remove when Grails moves to Spring Boot 4 - org.springframework:spring-web:6.2.19: [CVE-2026-59314](https://guide.sonatype.com/vulnerability/CVE-2026-59314?component-type=maven&component-name=org.springframework%2Fspring-web&utm_source=java-http-client&utm_medium=integration&utm_content=17.0.21) - Spring Framework 6.2.19 is the last open source release of the 6.2.x line: the fix is published to Enterprise Support customers only, and the open source fix 7.0.9 requires Spring Framework 7 / Spring Boot 4, which this line does not use. Remove when Grails moves to Spring Boot 4 - org.springframework:spring-webmvc:6.2.19: [CVE-2026-47887](https://guide.sonatype.com/vulnerability/CVE-2026-47887?component-type=maven&component-name=org.springframework%2Fspring-webmvc&utm_source=java-http-client&utm_medium=integration&utm_content=17.0.21) - Spring Framework 6.2.19 is the last open source release of the 6.2.x line: the fix is published to Enterprise Support customers only, and the open source fix 7.0.9 requires Spring Framework 7 / Spring Boot 4, which this line does not use. Remove when Grails moves to Spring Boot 4 - org.springframework:spring-webmvc:6.2.19: [CVE-2026-59313](https://guide.sonatype.com/vulnerability/CVE-2026-59313?component-type=maven&component-name=org.springframework%2Fspring-webmvc&utm_source=java-http-client&utm_medium=integration&utm_content=17.0.21) - Spring Framework 6.2.19 is the last open source release of the 6.2.x line: the fix is published to Enterprise Support customers only, and the open source fix 7.0.9 requires Spring Framework 7 / Spring Boot 4, which this line does not use. Remove when Grails moves to Spring Boot 4 - org.springframework:spring-webmvc:6.2.19: [GHSA-j9f9-w8pj-32f8](https://osv.dev/vulnerability/GHSA-j9f9-w8pj-32f8) - Spring Framework 6.2.19 is the last open source release of the 6.2.x line: the fix is published to Enterprise Support customers only, and the open source fix 7.0.9 requires Spring Framework 7 / Spring Boot 4, which this line does not use. Remove when Grails moves to Spring Boot 4 - org.springframework:spring-webmvc:6.2.19: [GHSA-pc63-qcmh-9cmg](https://osv.dev/vulnerability/GHSA-pc63-qcmh-9cmg) - Spring Framework 6.2.19 is the last open source release of the 6.2.x line: the fix is published to Enterprise Support customers only, and the open source fix 7.0.9 requires Spring Framework 7 / Spring Boot 4, which this line does not use. Remove when Grails moves to Spring Boot 4 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
