jamesfredley commented on code in PR #16767:
URL: https://github.com/apache/grails-core/pull/16767#discussion_r4376633814
##########
build-logic/vulnerability-scan/src/main/groovy/org/apache/grails/buildsrc/scan/VulnerabilityScanPlugin.groovy:
##########
@@ -100,6 +100,18 @@ class VulnerabilityScanPlugin implements Plugin<Project> {
'and no fixed release exists. A long pause can
terminate the pause-detector dispatch thread ' +
'and leave its queue growing, see
https://github.com/LatencyUtils/LatencyUtils/issues/22. ' +
'Remove once a patched release is available or
micrometer no longer requires LatencyUtils'),
+ new VulnerabilityExclusion('CVE-2026-93879',
'org.hibernate.validator:hibernate-validator',
Review Comment:
This exclusion hides CVE-2026-93879. Hibernate Validator 8.0.6.Final fixes
it. Spring Boot 3.5.16 still manages 8.0.3.Final.
Drop the exclusion and pin `hibernate-validator` and
`hibernate-validator-annotation-processor` to 8.0.6.Final.
##########
dependencies.gradle:
##########
@@ -147,17 +163,20 @@ ext {
// Do not upgrade to 3.2.3 until cleared by the sitemesh author.
3.2.3 is not a small patch:
// it adds a spring-webmvc-sitemesh module and an opt-in
view-resolver integration.
'starter-sitemesh.version' : '3.2.2',
- // Security: overrides spring-boot-dependencies (10.1.55). 10.1.60
includes the fixes for
- // CVE-2026-65905, CVE-2026-65182, CVE-2026-68525 and
CVE-2026-65927, plus the later 10.1.x fixes.
- // 10.1.58, named by the advisories, failed its release vote; keep
the Tomcat family aligned.
- 'tomcat.version' : '10.1.60',
+ // Security: overrides spring-boot-dependencies (10.1.55). 10.1.61
fixes CVE-2026-101356 (HTTP/2
+ // request/response mix-up after an async error) and
CVE-2026-101296 (JNDIRealm bind validation fails
+ // open), and retains the 10.1.60 fixes for CVE-2026-65905,
CVE-2026-65182, CVE-2026-68525 and
+ // CVE-2026-65927. 10.1.58, named by those advisories, failed its
release vote; keep the Tomcat family aligned.
+ 'tomcat.version' : '10.1.61',
]
// Note: the name of the dependency must be the prefix of the property
name so properties in the pom are resolved correctly
bomPlatformDependencies = [
'asset-pipeline-bom':
"cloud.wondrify:asset-pipeline-bom:${bomDependencyVersions['asset-pipeline-bom.version']}",
'spock-bom' :
"org.spockframework:spock-bom:${bomDependencyVersions['spock.version']}",
'jackson-bom' :
"com.fasterxml.jackson:jackson-bom:${bomDependencyVersions['jackson.version']}",
+ // Security override of spring-boot-dependencies - see
netty.version
Review Comment:
With `springDependencyManagement` on, the generated POM imports Spring Boot
before this Netty BOM. Maven keeps Boot's 4.1.135.Final. An application that
consumes the POM stays on the vulnerable Netty.
Import the Netty override before Spring Boot, or constrain the Netty modules
directly. Please resolve `io.netty:netty-common` through the published POM and
assert 4.1.139.Final.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
