matrei commented on code in PR #16767:
URL: https://github.com/apache/grails-core/pull/16767#discussion_r4377011776
##########
build-logic/vulnerability-scan/src/main/groovy/org/apache/grails/buildsrc/scan/VulnerabilityScanPlugin.groovy:
##########
@@ -100,6 +100,18 @@ class VulnerabilityScanPlugin implements Plugin<Project> {
'and no fixed release exists. A long pause can
terminate the pause-detector dispatch thread ' +
'and leave its queue growing, see
https://github.com/LatencyUtils/LatencyUtils/issues/22. ' +
'Remove once a patched release is available or
micrometer no longer requires LatencyUtils'),
+ new VulnerabilityExclusion('CVE-2026-93879',
'org.hibernate.validator:hibernate-validator',
Review Comment:
You're right, thanks. 8.0.6.Final (2026-10-13) contains HV-2256, which
escapes message parameters by default and has tests for the `{duplicates}`
case. ab8668e090 drops the exclusion and pins `hibernate-validator` and
`hibernate-validator-annotation-processor` to 8.0.6.Final. Both resolve to
8.0.6.Final through the published POM.
Applications that depend on unescaped message parameters can opt out with
`hibernate.validator.message_parameter_escaping=none`.
##########
dependencies.gradle:
##########
@@ -147,17 +163,20 @@ ext {
// Do not upgrade to 3.2.3 until cleared by the sitemesh author.
3.2.3 is not a small patch:
// it adds a spring-webmvc-sitemesh module and an opt-in
view-resolver integration.
'starter-sitemesh.version' : '3.2.2',
- // Security: overrides spring-boot-dependencies (10.1.55). 10.1.60
includes the fixes for
- // CVE-2026-65905, CVE-2026-65182, CVE-2026-68525 and
CVE-2026-65927, plus the later 10.1.x fixes.
- // 10.1.58, named by the advisories, failed its release vote; keep
the Tomcat family aligned.
- 'tomcat.version' : '10.1.60',
+ // Security: overrides spring-boot-dependencies (10.1.55). 10.1.61
fixes CVE-2026-101356 (HTTP/2
+ // request/response mix-up after an async error) and
CVE-2026-101296 (JNDIRealm bind validation fails
+ // open), and retains the 10.1.60 fixes for CVE-2026-65905,
CVE-2026-65182, CVE-2026-68525 and
+ // CVE-2026-65927. 10.1.58, named by those advisories, failed its
release vote; keep the Tomcat family aligned.
+ 'tomcat.version' : '10.1.61',
]
// Note: the name of the dependency must be the prefix of the property
name so properties in the pom are resolved correctly
bomPlatformDependencies = [
'asset-pipeline-bom':
"cloud.wondrify:asset-pipeline-bom:${bomDependencyVersions['asset-pipeline-bom.version']}",
'spock-bom' :
"org.spockframework:spock-bom:${bomDependencyVersions['spock.version']}",
'jackson-bom' :
"com.fasterxml.jackson:jackson-bom:${bomDependencyVersions['jackson.version']}",
+ // Security override of spring-boot-dependencies - see
netty.version
Review Comment:
Confirmed, and Jackson had the same problem. With the published POMs
installed to a local repository, Maven and the Spring dependency management
plugin both resolved Boot's Netty 4.1.135.Final and Jackson 2.21.4. a1b5dc6268
imports `jackson-bom` and `netty-bom` before `spring-boot-dependencies`, as
`log4j2-bom` already is.
Resolved after the change:
| Consumer | `netty-common` | `jackson-databind` |
|---|---|---|
| Maven 3.9.11, importing `grails-bom`, `grails-base-bom`,
`grails-hibernate5-bom` or `grails-micronaut-bom` | 4.1.139.Final | 2.22.4 |
| Gradle with `io.spring.dependency-management` 1.1.7 and `mavenBom`
`grails-bom` | 4.1.139.Final | 2.22.4 |
| The same plus `platform(grails-bom)`, as Forge apps declare it |
4.1.139.Final | 2.22.4 |
| Gradle `platform(grails-bom)` only | 4.1.139.Final | 2.22.4 |
Before the change, the first three rows gave 4.1.135.Final and 2.21.4.
Jackson 2.21.4 has nine OSV advisories.
This also affects Micronaut apps. `GrailsGradlePlugin` imports `grails-bom`
through Spring dependency management for every app. So a Micronaut app with the
default setup already resolved Boot's Netty 4.1.135.Final, not Micronaut's
4.2.x, and now resolves 4.1.139.Final. The `netty-bom` skip in
`grails-micronaut-bom` only matters with `springDependencyManagement = false`.
Selenium has the same ordering issue: Maven consumers get Boot's 4.31.0
instead of 4.38.0. I've left it alone here because it isn't a security fix.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
