You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@grails.apache.org by ja...@apache.org on 2026/07/23 00:51:20 UTC
(grails-core) 01/01: Align Log4j across published BOMs
This is an automated email from the ASF dual-hosted git repository.
jamesfredley pushed a commit to branch deps/align-log4j-boms-7.0.x
in repository https://gitbox.apache.org/repos/asf/grails-core.git
commit 811faed1614c666f3cfca6d85e2fb4b7474a9039
Author: James Fredley <ja...@users.noreply.github.com>
AuthorDate: Wed Jul 22 20:49:48 2026 -0400
Align Log4j across published BOMs
Move Log4j 2.25.5 management into the shared Gradle BOM maps and import
the Log4j BOM first from every published BOM so Maven and Gradle consumers
receive the fixed version across the complete family.
Manage biz.aQute.bnd.annotation 7.1.0, which Log4j 2.25.5 requires, so
the dependency version validator matches the winning transitive version.
Assisted-by: opencode:gpt-5.6-sol codegraph
---
dependencies.gradle | 25 +++++++++++++++----------
grails-bom/base/build.gradle | 1 +
grails-bom/hibernate5/build.gradle | 1 +
grails-bom/micronaut/build.gradle | 1 +
grails-gradle/bom/build.gradle | 1 +
5 files changed, 19 insertions(+), 10 deletions(-)
diff --git a/dependencies.gradle b/dependencies.gradle
index d8644ef417..77a4e72054 100644
--- a/dependencies.gradle
+++ b/dependencies.gradle
@@ -27,6 +27,7 @@ ext {
'asciidoctor-gradle-jvm.version': '4.0.5',
'asciidoctorj.version' : '3.0.0',
'asset-pipeline-gradle.version' : '5.0.34',
+ 'bnd.version' : '7.1.0',
'byte-buddy.version' : '1.18.3',
'commons-text.version' : '1.15.0',
'directory-watcher.version' : '0.19.1',
@@ -37,6 +38,8 @@ ext {
'jline.version' : '2.14.6',
'jna.version' : '5.17.0',
'jquery.version' : '3.7.1',
+ // Security: overrides spring-boot-dependencies (2.24.3). 2.25.5 fixes CVE-2026-49844 flagged against log4j-api.
+ 'log4j2.version' : '2.25.5',
'objenesis.version' : '3.4',
'spring-boot.version' : '3.5.16',
]
@@ -44,6 +47,7 @@ ext {
// Note: the name of the dependency must be the prefix of the property name so properties in the pom are resolved correctly
gradleBomPlatformDependencies = [
'spring-boot-bom' : "org.springframework.boot:spring-boot-dependencies:${gradleBomDependencyVersions['spring-boot.version']}",
+ 'log4j2-bom' : "org.apache.logging.log4j:log4j-bom:${gradleBomDependencyVersions['log4j2.version']}",
'gradle-spock-bom': "org.spockframework:spock-bom:${gradleBomDependencyVersions['gradle-spock.version']}",
]
@@ -56,6 +60,7 @@ ext {
'asciidoctor-gradle-jvm': "org.asciidoctor:asciidoctor-gradle-jvm:${gradleBomDependencyVersions['asciidoctor-gradle-jvm.version']}",
'asciidoctorj' : "org.asciidoctor:asciidoctorj:${gradleBomDependencyVersions['asciidoctorj.version']}",
'asset-pipeline-gradle' : "cloud.wondrify:asset-pipeline-gradle:${gradleBomDependencyVersions['asset-pipeline-gradle.version']}",
+ 'bnd-annotation' : "biz.aQute.bnd:biz.aQute.bnd.annotation:${gradleBomDependencyVersions['bnd.version']}",
'byte-buddy' : "net.bytebuddy:byte-buddy:${gradleBomDependencyVersions['byte-buddy.version']}",
'commons-text' : "org.apache.commons:commons-text:${gradleBomDependencyVersions['commons-text.version']}",
'directory-watcher' : "io.methvin:directory-watcher:${gradleBomDependencyVersions['directory-watcher.version']}",
@@ -64,6 +69,12 @@ ext {
'javaparser-core' : "com.github.javaparser:javaparser-core:${gradleBomDependencyVersions['javaparser-core.version']}",
'jline' : "jline:jline:${gradleBomDependencyVersions['jline.version']}",
'jna' : "net.java.dev.jna:jna:${gradleBomDependencyVersions['jna.version']}",
+ // Security override of spring-boot-dependencies - see log4j2.version
+ 'log4j2-api' : "org.apache.logging.log4j:log4j-api:${gradleBomDependencyVersions['log4j2.version']}",
+ 'log4j2-core' : "org.apache.logging.log4j:log4j-core:${gradleBomDependencyVersions['log4j2.version']}",
+ 'log4j2-jul' : "org.apache.logging.log4j:log4j-jul:${gradleBomDependencyVersions['log4j2.version']}",
+ 'log4j2-slf4j2-impl' : "org.apache.logging.log4j:log4j-slf4j2-impl:${gradleBomDependencyVersions['log4j2.version']}",
+ 'log4j2-to-slf4j' : "org.apache.logging.log4j:log4j-to-slf4j:${gradleBomDependencyVersions['log4j2.version']}",
'objenesis' : "org.objenesis:objenesis:${gradleBomDependencyVersions['objenesis.version']}",
'spring-boot-cli' : "org.springframework.boot:spring-boot-cli:${gradleBomDependencyVersions['spring-boot.version']}",
'spring-boot-gradle' : "org.springframework.boot:spring-boot-gradle-plugin:${gradleBomDependencyVersions['spring-boot.version']}",
@@ -87,8 +98,6 @@ ext {
'jackson.version' : '2.21.5',
// Security: overrides spring-boot-dependencies (1.5.34). 1.5.37 fixes CVE-2026-13006 flagged against logback-core.
'logback.version' : '1.5.37',
- // Security: overrides spring-boot-dependencies (2.24.3). 2.25.5 fixes CVE-2026-49844 flagged against log4j-api.
- 'log4j2.version' : '2.25.5',
'jquery.version' : '3.7.1',
'hibernate-groovy-proxy.version': '1.1',
'jakarta-servlet-api.version' : '6.1.0',
@@ -120,7 +129,6 @@ ext {
'asset-pipeline-bom': "cloud.wondrify:asset-pipeline-bom:${bomDependencyVersions['asset-pipeline-bom.version']}",
'spock-bom' : "org.spockframework:spock-bom:${bomDependencyVersions['spock.version']}",
'jackson-bom' : "com.fasterxml.jackson:jackson-bom:${bomDependencyVersions['jackson.version']}",
- 'log4j2-bom' : "org.apache.logging.log4j:log4j-bom:${bomDependencyVersions['log4j2.version']}",
'groovy-bom' : "org.apache.groovy:groovy-bom:${bomDependencyVersions['groovy.version']}",
'junit-bom' : "org.junit:junit-bom:${bomDependencyVersions['junit.version']}",
'selenium-bom' : "org.seleniumhq.selenium:selenium-bom:${bomDependencyVersions['selenium.version']}",
@@ -176,12 +184,6 @@ ext {
// Security override of spring-boot-dependencies - see logback.version
'logback-classic' : "ch.qos.logback:logback-classic:${bomDependencyVersions['logback.version']}",
'logback-core' : "ch.qos.logback:logback-core:${bomDependencyVersions['logback.version']}",
- // Security override of spring-boot-dependencies - see log4j2.version
- 'log4j2-api' : "org.apache.logging.log4j:log4j-api:${bomDependencyVersions['log4j2.version']}",
- 'log4j2-core' : "org.apache.logging.log4j:log4j-core:${bomDependencyVersions['log4j2.version']}",
- 'log4j2-jul' : "org.apache.logging.log4j:log4j-jul:${bomDependencyVersions['log4j2.version']}",
- 'log4j2-slf4j2-impl' : "org.apache.logging.log4j:log4j-slf4j2-impl:${bomDependencyVersions['log4j2.version']}",
- 'log4j2-to-slf4j' : "org.apache.logging.log4j:log4j-to-slf4j:${bomDependencyVersions['log4j2.version']}",
// start - boot & selenium conflict, so pin the version we want (newest)
'jakarta-servlet-api' : "jakarta.servlet:jakarta.servlet-api:${bomDependencyVersions['jakarta-servlet-api.version']}",
'jakarta-validation-api' : "jakarta.validation:jakarta.validation-api:${bomDependencyVersions['jakarta-validation-api.version']}",
@@ -234,7 +236,10 @@ ext {
// Because pom exclusions aren't properly supported by gradle, we can't inherit the grails-gradle-bom
// this requires copying the platforms selectively to the grails-bom. Create a combined version for convenience.
- combinedPlatforms = ['spring-boot-bom': gradleBomPlatformDependencies['spring-boot-bom']] + bomPlatformDependencies
+ combinedPlatforms = [
+ 'spring-boot-bom': gradleBomPlatformDependencies['spring-boot-bom'],
+ 'log4j2-bom' : gradleBomPlatformDependencies['log4j2-bom'],
+ ] + bomPlatformDependencies
combinedDependencies = gradleBomDependencies + bomDependencies
combinedVersions = gradleBomDependencyVersions + bomDependencyVersions
diff --git a/grails-bom/base/build.gradle b/grails-bom/base/build.gradle
index f95a891d6a..ee3901b436 100644
--- a/grails-bom/base/build.gradle
+++ b/grails-bom/base/build.gradle
@@ -51,6 +51,7 @@ ext {
}
dependencies {
+ api platform(gradleBomPlatformDependencies['log4j2-bom'])
api platform(gradleBomPlatformDependencies['spring-boot-bom']), {
exclude group: 'org.apache.groovy'
exclude group: 'org.spockframework'
diff --git a/grails-bom/hibernate5/build.gradle b/grails-bom/hibernate5/build.gradle
index 7d42b5bc6e..0540cc4d03 100644
--- a/grails-bom/hibernate5/build.gradle
+++ b/grails-bom/hibernate5/build.gradle
@@ -51,6 +51,7 @@ ext {
}
dependencies {
+ api platform(gradleBomPlatformDependencies['log4j2-bom'])
api platform(project(':grails-bom'))
api platform(gradleBomPlatformDependencies['spring-boot-bom']), {
exclude group: 'org.hibernate.orm'
diff --git a/grails-bom/micronaut/build.gradle b/grails-bom/micronaut/build.gradle
index f2b80723b8..6299af1548 100644
--- a/grails-bom/micronaut/build.gradle
+++ b/grails-bom/micronaut/build.gradle
@@ -66,6 +66,7 @@ def overriddenModules = customBomDependencies.values().collect { String coord ->
Set<String> overriddenCoords = overriddenModules.collect { "${it.group}:${it.module}".toString() } as Set
dependencies {
+ api platform(gradleBomPlatformDependencies['log4j2-bom'])
api(platform(project(':grails-bom'))) {
overriddenModules.each { ovr ->
exclude group: ovr.group, module: ovr.module
diff --git a/grails-gradle/bom/build.gradle b/grails-gradle/bom/build.gradle
index 228b307d58..5fedce2afe 100644
--- a/grails-gradle/bom/build.gradle
+++ b/grails-gradle/bom/build.gradle
@@ -38,6 +38,7 @@ ext {
}
dependencies {
+ api platform(gradleBomPlatformDependencies['log4j2-bom'])
api platform(gradleBomPlatformDependencies['spring-boot-bom']), {
exclude group: 'org.apache.groovy'
exclude group: 'org.spockframework'