You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@grails.apache.org by ja...@apache.org on 2026/10/22 22:42:05 UTC
(grails-core) 01/01: Update Spring Boot to 4.1.2
This is an automated email from the ASF dual-hosted git repository.
jamesfredley pushed a commit to branch deps/spring-boot-4.1.2
in repository https://gitbox.apache.org/repos/asf/grails-core.git
commit 25bcdc4e869904978212c4f46889c66766b5513a
Author: James Fredley <ja...@users.noreply.github.com>
AuthorDate: Thu Oct 22 18:41:21 2026 -0400
Update Spring Boot to 4.1.2
Spring Boot 4.1.2 is released. Inherit the versions it now manages and drop
the pins that would repeat or lag it: SLF4J 2.0.19, Byte Buddy 1.18.13, and
Tomcat 11.0.26. Boot 4.1.2 manages SLF4J 2.0.20, Byte Buddy 1.18.15, and
Tomcat 11.0.27.
Bring the Grails-owned updates from #16560: springdoc 3.1.1, swagger 2.2.55,
Undertow 2.4.4.Final / 2.0.3.Final, and the graphql-java 25.1 tripwire.
Hibernate 7 is strictly re-declared at Boot's 7.4.13.Final. Liquibase stays
at 4.27.0 because liquibase-hibernate5 stops there.
Replaces #16560.
Assisted-by: Sisyphus:grok-4.7
---
.../buildsrc/scan/VulnerabilityScanPlugin.groovy | 5 +-
dependencies.gradle | 75 +++++++++-------------
2 files changed, 32 insertions(+), 48 deletions(-)
diff --git a/build-logic/vulnerability-scan/src/main/groovy/org/apache/grails/buildsrc/scan/VulnerabilityScanPlugin.groovy b/build-logic/vulnerability-scan/src/main/groovy/org/apache/grails/buildsrc/scan/VulnerabilityScanPlugin.groovy
index 96cc34b088..2abcaa150b 100644
--- a/build-logic/vulnerability-scan/src/main/groovy/org/apache/grails/buildsrc/scan/VulnerabilityScanPlugin.groovy
+++ b/build-logic/vulnerability-scan/src/main/groovy/org/apache/grails/buildsrc/scan/VulnerabilityScanPlugin.groovy
@@ -88,8 +88,9 @@ class VulnerabilityScanPlugin implements Plugin<Project> {
'5.7.x through 6.5.10 as affected. The 7.x line already carries the fix for the preceding ' +
'CVE-2026-22747. Remove once Sonatype narrows its affected range'),
new VulnerabilityExclusion('CVE-2026-47842', 'org.springframework.security:spring-security-crypto',
- 'Sonatype flags 7.1.1, but https://spring.io/security/cve-2026-47842 explicitly lists 7.1.1 as ' +
- 'fixed. It is the latest stable 7.1.x release and the version Spring Boot 4.1.1 manages. ' +
+ 'Spring Boot 4.1.2 manages 7.1.2, which is past the fixed 7.1.1 listed at ' +
+ 'https://spring.io/security/cve-2026-47842. Sonatype\'s affected range was already wrong ' +
+ 'for that fixed release. ' +
'Remove once Sonatype corrects its affected range; reassess on any Spring Security upgrade'),
].asImmutable()
diff --git a/dependencies.gradle b/dependencies.gradle
index 4b9e400eb1..e2e84c678e 100644
--- a/dependencies.gradle
+++ b/dependencies.gradle
@@ -39,7 +39,7 @@ ext {
'jna.version' : '5.19.1',
'maven-model.version' : '3.9.16',
'objenesis.version' : '3.6',
- 'spring-boot.version' : '4.1.1',
+ 'spring-boot.version' : '4.1.2',
]
// Note: the name of the dependency must be the prefix of the property name so properties in the pom are resolved correctly
@@ -74,38 +74,34 @@ ext {
'cas-client-core.version' : '4.1.1',
'bootstrap-icons.version' : '1.13.2',
'bootstrap.version' : '5.3.8',
- // Overrides the 1.18.11 Spring Boot 4.1 manages, on every classpath, so the BOM manages the
- // version Selenium 4.49.0 pulls in transitively - see selenium.version. Can return to Boot's
- // version when the Selenium pin is dropped.
- 'byte-buddy.version' : '1.18.13',
'checker-qual.version' : '3.55.1',
'commons-codec.version' : '1.22.1',
'geb-spock.version' : '8.0.1',
- // Pinned deliberately as a drift tripwire even though it matches Spring Boot's
- // managed version: graphql-java-extended-scalars (below) is NOT managed by Spring
- // Boot and must be upgraded in lockstep with graphql-java. Keeping this pin makes
- // the dependency validator flag any Spring Boot graphql-java bump so we re-check
- // extended-scalars compatibility. See https://github.com/apache/grails-core/issues/15674
- 'graphql-java.version' : '25.0',
+ // Pinned as a drift tripwire even though 25.1 matches Spring Boot 4.1.2: graphql-java-
+ // extended-scalars is not managed by Spring Boot. Keeping this pin makes a later Boot
+ // graphql-java bump force a compatibility check of extended-scalars, not an equal-version
+ // upgrade. See https://github.com/apache/grails-core/issues/15674
+ 'graphql-java.version' : '25.1',
'graphql-java-extended-scalars.version': '24.0',
'groovy.version' : '5.1.3',
// Security: 33.7.2 addresses CVE-2026-102554 (uncontrolled resource consumption).
'guava.version' : '33.7.2-jre',
// Groovy YAML 5.1.0 requires a minimum of Jackson 2.22.1, and 2.22.3 also overrides the
- // 2.21.5 Spring Boot 4.1 manages: it adds the StreamReadConstraints length limit to
+ // 2.21.7 Spring Boot 4.1 manages: it adds the StreamReadConstraints length limit to
// GregorianCalendar/Duration (CVE-2026-68497) and restricts the URI schemes
// java.nio.file.Path deserialization accepts (CVE-2026-19032). Jackson 2 only releases
// jackson-annotations on the minor, hence the separate 2.22 below. 2.22.3 also fixes
// CVE-2026-89425, CVE-2026-89407, CVE-2026-91777 and CVE-2026-91776.
'jackson-2-bom.version' : '2.22.3',
'jackson2-annotations.version' : '2.22',
- // Security: overrides Jackson 3.1.5 from Spring Boot 4.1. The 3.2.3 BOM aligns the family
+ // Security: overrides Jackson 3.1.7 from Spring Boot 4.1. The 3.2.3 BOM aligns the family
// and fixes CVE-2026-89425, CVE-2026-89407, CVE-2026-91777 and CVE-2026-91776.
'jackson-bom.version' : '3.2.3',
'jquery.version' : '4.0.0',
- // Security: overrides the 1.5.38 Spring Boot 4.1 manages. 1.6.3 strips slashes from MDC
+ // Security: overrides the 1.5.38 Spring Boot 4.1.2 manages. 1.6.3 strips slashes from MDC
// values before SiftingAppender uses them as discriminating keys (CVE-2026-19880), and
// 1.6.5 completes that fix (CVE-2026-104721). The 1.6.x line keeps SLF4J 2.0.x and JDK 11.
+ // Spring Boot 4.1.2 manages SLF4J 2.0.20, so SLF4J is not pinned.
'logback.version' : '1.6.5',
// Security: overrides the 5.8.1 Spring Boot 4.1 manages. 5.9.2 stopped ProxySettings
// .toString() writing the SOCKS5 proxy credentials into the application log
@@ -136,32 +132,27 @@ ext {
// Boot's selenium-htmlunit.version (htmlunit3-driver) stays at 4.43.0: the newest
// htmlunit3-driver needs a HtmlUnit newer than Boot manages, and nothing here uses it.
'selenium.version' : '4.49.0',
- // Logback 1.6.5 requires 2.0.19; align the SLF4J family above Boot's managed 2.0.18.
- 'slf4j.version' : '2.0.19',
'spock.version' : '2.4-groovy-5.0',
// Not managed by spring-boot-dependencies. springdoc 3.x is the Spring Boot 4 /
// Spring Framework 7 line; the grails-openapi module compiles against its
// OpenApiCustomizer SPI and apps add the webmvc-ui starter for Swagger UI.
- 'springdoc-openapi.version' : '3.1.0',
- // Not managed by spring-boot-dependencies. Kept at the version springdoc-openapi
+ 'springdoc-openapi.version' : '3.1.1',
+ // Not managed by spring-boot-dependencies. Kept at the version springdoc-openapi 3.1.1
// resolves, which grails-openapi compiles against without requiring springdoc.
- 'swagger.version' : '2.2.52',
+ 'swagger.version' : '2.2.55',
'starter-sitemesh.version' : '3.3.0',
'spring-webmvc-sitemesh.version': '3.3.0',
// Spring Boot 4 no longer manages spring-retry; pin it here so the
// grails-shell-cli SpringRetryCompilerAutoConfiguration's unversioned
// reference resolves and consumer apps using @Retryable get a known version.
'spring-retry.version' : '2.0.13',
- // Security: overrides Tomcat 11.0.24 from Spring Boot 4.1. Includes the fixes for
- // CVE-2026-65905, CVE-2026-65182, CVE-2026-68525 and CVE-2026-65927 on the Servlet 6.1 line.
- 'tomcat.version' : '11.0.26',
// Undertow is no longer managed by spring-boot-dependencies: Spring Boot 4
// removed its Undertow support before GA. Servlet 6.1 support ships as
// undertow-core 2.4.x plus the io.undertow.ee servlet/websockets artifacts,
// consumed by the vendored grails-undertow-spring-boot module.
- 'undertow.version' : '2.4.3.Final',
- 'undertow-servlet.version' : '2.0.2.Final',
- 'undertow-websockets.version' : '2.0.2.Final',
+ 'undertow.version' : '2.4.4.Final',
+ 'undertow-servlet.version' : '2.0.3.Final',
+ 'undertow-websockets.version' : '2.0.3.Final',
]
// Note: the name of the dependency must be the prefix of the property name so properties in the pom are resolved correctly
@@ -171,7 +162,6 @@ ext {
'jackson-bom' : "tools.jackson:jackson-bom:${bomDependencyVersions['jackson-bom.version']}",
'opentelemetry-bom' : "io.opentelemetry:opentelemetry-bom:${bomDependencyVersions['opentelemetry.version']}",
'selenium-bom' : "org.seleniumhq.selenium:selenium-bom:${bomDependencyVersions['selenium.version']}",
- 'slf4j-bom' : "org.slf4j:slf4j-bom:${bomDependencyVersions['slf4j.version']}",
'spock-bom' : "org.spockframework:spock-bom:${bomDependencyVersions['spock.version']}",
]
@@ -179,10 +169,6 @@ ext {
bomDependencies = [
'bootstrap' : "org.webjars.npm:bootstrap:${bomDependencyVersions['bootstrap.version']}",
'bootstrap-icons' : "org.webjars.npm:bootstrap-icons:${bomDependencyVersions['bootstrap-icons.version']}",
- // Keeps the BOM authoritative for the version Selenium 4.49.0 pulls in - see byte-buddy.version.
- // Both artifacts are pinned so a classpath cannot mix Byte Buddy versions.
- 'byte-buddy' : "net.bytebuddy:byte-buddy:${bomDependencyVersions['byte-buddy.version']}",
- 'byte-buddy-agent' : "net.bytebuddy:byte-buddy-agent:${bomDependencyVersions['byte-buddy.version']}",
'cas-client-core' : "org.apereo.cas.client:cas-client-core:${bomDependencyVersions['cas-client-core.version']}",
'checker-qual' : "org.checkerframework:checker-qual:${bomDependencyVersions['checker-qual.version']}",
'commons-codec' : "commons-codec:commons-codec:${bomDependencyVersions['commons-codec.version']}",
@@ -220,13 +206,13 @@ ext {
'groovy-xml' : "org.apache.groovy:groovy-xml:${bomDependencyVersions['groovy.version']}",
'groovy-yaml' : "org.apache.groovy:groovy-yaml:${bomDependencyVersions['groovy.version']}",
'guava' : "com.google.guava:guava:${bomDependencyVersions['guava.version']}",
- // Security override of the 2.21.5 spring-boot-dependencies imports through
+ // Security override of the 2.21.7 spring-boot-dependencies imports through
// com.fasterxml.jackson:jackson-bom - see jackson-2-bom.version
'jackson2-annotations' : "com.fasterxml.jackson.core:jackson-annotations:${bomDependencyVersions['jackson2-annotations.version']}",
'jackson-2-bom-core' : "com.fasterxml.jackson.core:jackson-core:${bomDependencyVersions['jackson-2-bom.version']}",
'jackson-2-bom-databind' : "com.fasterxml.jackson.core:jackson-databind:${bomDependencyVersions['jackson-2-bom.version']}",
'jackson-2-bom-datatype-jsr310': "com.fasterxml.jackson.datatype:jackson-datatype-jsr310:${bomDependencyVersions['jackson-2-bom.version']}",
- // Security override of the 3.1.5 spring-boot-dependencies imports through
+ // Security override of the 3.1.7 spring-boot-dependencies imports through
// tools.jackson:jackson-bom - see jackson-bom.version
'jackson-bom-core' : "tools.jackson.core:jackson-core:${bomDependencyVersions['jackson-bom.version']}",
'jackson-bom-databind' : "tools.jackson.core:jackson-databind:${bomDependencyVersions['jackson-bom.version']}",
@@ -267,14 +253,6 @@ ext {
'swagger-models-jakarta' : "io.swagger.core.v3:swagger-models-jakarta:${bomDependencyVersions['swagger.version']}",
'starter-sitemesh' : "org.sitemesh:spring-boot-starter-sitemesh:${bomDependencyVersions['starter-sitemesh.version']}",
'spring-webmvc-sitemesh' : "org.sitemesh:spring-webmvc-sitemesh:${bomDependencyVersions['spring-webmvc-sitemesh.version']}",
- // Security override of spring-boot-dependencies - see tomcat.version
- 'tomcat-annotations-api' : "org.apache.tomcat:tomcat-annotations-api:${bomDependencyVersions['tomcat.version']}",
- 'tomcat-jdbc' : "org.apache.tomcat:tomcat-jdbc:${bomDependencyVersions['tomcat.version']}",
- 'tomcat-jsp-api' : "org.apache.tomcat:tomcat-jsp-api:${bomDependencyVersions['tomcat.version']}",
- 'tomcat-embed-core' : "org.apache.tomcat.embed:tomcat-embed-core:${bomDependencyVersions['tomcat.version']}",
- 'tomcat-embed-el' : "org.apache.tomcat.embed:tomcat-embed-el:${bomDependencyVersions['tomcat.version']}",
- 'tomcat-embed-jasper' : "org.apache.tomcat.embed:tomcat-embed-jasper:${bomDependencyVersions['tomcat.version']}",
- 'tomcat-embed-websocket' : "org.apache.tomcat.embed:tomcat-embed-websocket:${bomDependencyVersions['tomcat.version']}",
// Not managed by spring-boot-dependencies - see undertow.version
'undertow-core' : "io.undertow:undertow-core:${bomDependencyVersions['undertow.version']}",
'undertow-servlet' : "io.undertow.ee:undertow-servlet:${bomDependencyVersions['undertow-servlet.version']}",
@@ -309,8 +287,12 @@ ext {
'gradle-groovy.version',
]
bomRedundantVersionExemptions = [
- // Kept equal to Spring Boot's on purpose - see graphql-java.version
+ // Drift tripwire for extended-scalars compatibility on later Boot graphql-java bumps,
+ // not an equal-version upgrade of extended-scalars - see graphql-java.version.
'graphql-java.version',
+ // The Hibernate 7 BOM strictly re-declares Boot's version so enforcedPlatform consumers
+ // are forced to it; the pin matches Spring Boot 4.1.2 on purpose.
+ 'hibernate.version',
]
// Defaults for per-BOM overrides; populated in the if/else blocks below
@@ -324,7 +306,7 @@ ext {
if (project.name in ['grails-bom', 'grails-hibernate5-bom'] || project.name.startsWith('grails-data-hibernate5')) {
customBomVersions = [
'liquibase-hibernate.version': '4.27.0',
- 'liquibase.version' : '4.27.0',
+ 'liquibase.version' : '4.27.0', // liquibase-hibernate5 stops at 4.27.0, and Boot 4.1.2's Liquibase 5.0.4 is a new major.
'hibernate.version' : '5.6.15.Final',
]
combinedVersions += customBomVersions
@@ -366,14 +348,15 @@ ext {
customBomVersions = [
'cache-ri-impl.version' : '1.1.1',
'derby.version' : '10.17.1.0',
- // Spring Boot 4.1 can select Hibernate ORM 7.4.x through Spring Dependency
- // Management, and Hibernate ORM 7.4.x requires hibernate-models 1.1.x.
+ // Spring Boot 4.1.2 selects Hibernate ORM 7.4.13.Final. This BOM strictly re-declares
+ // that version so enforcedPlatform consumers are forced to it; a platform() import
+ // is not enforced. 7.4.13.Final still requires hibernate-models 1.1.2.
'hibernate-models.version' : '1.1.2',
'hibernate-tools.version' : '7.3.13.Final',
- 'hibernate.version' : '7.4.10.Final',
+ 'hibernate.version' : '7.4.13.Final',
'jandex.version' : '3.6.0',
'liquibase-test-harness.version': '1.0.11',
- 'liquibase.version' : '4.27.0',
+ 'liquibase.version' : '4.27.0', // liquibase-hibernate5 stops at 4.27.0, and Boot 4.1.2's Liquibase 5.0.4 is a new major.
'mockito-inline.version' : '5.2.0',
]
combinedVersions += customBomVersions