You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@grails.apache.org by ja...@apache.org on 2026/10/22 22:42:04 UTC
(grails-core) branch deps/spring-boot-4.1.2 created (now 25bcdc4e86)
This is an automated email from the ASF dual-hosted git repository.
jamesfredley pushed a change to branch deps/spring-boot-4.1.2
in repository https://gitbox.apache.org/repos/asf/grails-core.git
at 25bcdc4e86 Update Spring Boot to 4.1.2
This branch includes the following new commits:
new 25bcdc4e86 Update Spring Boot to 4.1.2
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
(grails-core) 01/01: Update Spring Boot to 4.1.2
Posted by ja...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
jamesfredley pushed a commit to branch deps/spring-boot-4.1.2
in repository https://gitbox.apache.org/repos/asf/grails-core.git
commit 25bcdc4e869904978212c4f46889c66766b5513a
Author: James Fredley <ja...@users.noreply.github.com>
AuthorDate: Thu Oct 22 18:41:21 2026 -0400
Update Spring Boot to 4.1.2
Spring Boot 4.1.2 is released. Inherit the versions it now manages and drop
the pins that would repeat or lag it: SLF4J 2.0.19, Byte Buddy 1.18.13, and
Tomcat 11.0.26. Boot 4.1.2 manages SLF4J 2.0.20, Byte Buddy 1.18.15, and
Tomcat 11.0.27.
Bring the Grails-owned updates from #16560: springdoc 3.1.1, swagger 2.2.55,
Undertow 2.4.4.Final / 2.0.3.Final, and the graphql-java 25.1 tripwire.
Hibernate 7 is strictly re-declared at Boot's 7.4.13.Final. Liquibase stays
at 4.27.0 because liquibase-hibernate5 stops there.
Replaces #16560.
Assisted-by: Sisyphus:grok-4.7
---
.../buildsrc/scan/VulnerabilityScanPlugin.groovy | 5 +-
dependencies.gradle | 75 +++++++++-------------
2 files changed, 32 insertions(+), 48 deletions(-)
diff --git a/build-logic/vulnerability-scan/src/main/groovy/org/apache/grails/buildsrc/scan/VulnerabilityScanPlugin.groovy b/build-logic/vulnerability-scan/src/main/groovy/org/apache/grails/buildsrc/scan/VulnerabilityScanPlugin.groovy
index 96cc34b088..2abcaa150b 100644
--- a/build-logic/vulnerability-scan/src/main/groovy/org/apache/grails/buildsrc/scan/VulnerabilityScanPlugin.groovy
+++ b/build-logic/vulnerability-scan/src/main/groovy/org/apache/grails/buildsrc/scan/VulnerabilityScanPlugin.groovy
@@ -88,8 +88,9 @@ class VulnerabilityScanPlugin implements Plugin<Project> {
'5.7.x through 6.5.10 as affected. The 7.x line already carries the fix for the preceding ' +
'CVE-2026-22747. Remove once Sonatype narrows its affected range'),
new VulnerabilityExclusion('CVE-2026-47842', 'org.springframework.security:spring-security-crypto',
- 'Sonatype flags 7.1.1, but https://spring.io/security/cve-2026-47842 explicitly lists 7.1.1 as ' +
- 'fixed. It is the latest stable 7.1.x release and the version Spring Boot 4.1.1 manages. ' +
+ 'Spring Boot 4.1.2 manages 7.1.2, which is past the fixed 7.1.1 listed at ' +
+ 'https://spring.io/security/cve-2026-47842. Sonatype\'s affected range was already wrong ' +
+ 'for that fixed release. ' +
'Remove once Sonatype corrects its affected range; reassess on any Spring Security upgrade'),
].asImmutable()
diff --git a/dependencies.gradle b/dependencies.gradle
index 4b9e400eb1..e2e84c678e 100644
--- a/dependencies.gradle
+++ b/dependencies.gradle
@@ -39,7 +39,7 @@ ext {
'jna.version' : '5.19.1',
'maven-model.version' : '3.9.16',
'objenesis.version' : '3.6',
- 'spring-boot.version' : '4.1.1',
+ 'spring-boot.version' : '4.1.2',
]
// Note: the name of the dependency must be the prefix of the property name so properties in the pom are resolved correctly
@@ -74,38 +74,34 @@ ext {
'cas-client-core.version' : '4.1.1',
'bootstrap-icons.version' : '1.13.2',
'bootstrap.version' : '5.3.8',
- // Overrides the 1.18.11 Spring Boot 4.1 manages, on every classpath, so the BOM manages the
- // version Selenium 4.49.0 pulls in transitively - see selenium.version. Can return to Boot's
- // version when the Selenium pin is dropped.
- 'byte-buddy.version' : '1.18.13',
'checker-qual.version' : '3.55.1',
'commons-codec.version' : '1.22.1',
'geb-spock.version' : '8.0.1',
- // Pinned deliberately as a drift tripwire even though it matches Spring Boot's
- // managed version: graphql-java-extended-scalars (below) is NOT managed by Spring
- // Boot and must be upgraded in lockstep with graphql-java. Keeping this pin makes
- // the dependency validator flag any Spring Boot graphql-java bump so we re-check
- // extended-scalars compatibility. See https://github.com/apache/grails-core/issues/15674
- 'graphql-java.version' : '25.0',
+ // Pinned as a drift tripwire even though 25.1 matches Spring Boot 4.1.2: graphql-java-
+ // extended-scalars is not managed by Spring Boot. Keeping this pin makes a later Boot
+ // graphql-java bump force a compatibility check of extended-scalars, not an equal-version
+ // upgrade. See https://github.com/apache/grails-core/issues/15674
+ 'graphql-java.version' : '25.1',
'graphql-java-extended-scalars.version': '24.0',
'groovy.version' : '5.1.3',
// Security: 33.7.2 addresses CVE-2026-102554 (uncontrolled resource consumption).
'guava.version' : '33.7.2-jre',
// Groovy YAML 5.1.0 requires a minimum of Jackson 2.22.1, and 2.22.3 also overrides the
- // 2.21.5 Spring Boot 4.1 manages: it adds the StreamReadConstraints length limit to
+ // 2.21.7 Spring Boot 4.1 manages: it adds the StreamReadConstraints length limit to
// GregorianCalendar/Duration (CVE-2026-68497) and restricts the URI schemes
// java.nio.file.Path deserialization accepts (CVE-2026-19032). Jackson 2 only releases
// jackson-annotations on the minor, hence the separate 2.22 below. 2.22.3 also fixes
// CVE-2026-89425, CVE-2026-89407, CVE-2026-91777 and CVE-2026-91776.
'jackson-2-bom.version' : '2.22.3',
'jackson2-annotations.version' : '2.22',
- // Security: overrides Jackson 3.1.5 from Spring Boot 4.1. The 3.2.3 BOM aligns the family
+ // Security: overrides Jackson 3.1.7 from Spring Boot 4.1. The 3.2.3 BOM aligns the family
// and fixes CVE-2026-89425, CVE-2026-89407, CVE-2026-91777 and CVE-2026-91776.
'jackson-bom.version' : '3.2.3',
'jquery.version' : '4.0.0',
- // Security: overrides the 1.5.38 Spring Boot 4.1 manages. 1.6.3 strips slashes from MDC
+ // Security: overrides the 1.5.38 Spring Boot 4.1.2 manages. 1.6.3 strips slashes from MDC
// values before SiftingAppender uses them as discriminating keys (CVE-2026-19880), and
// 1.6.5 completes that fix (CVE-2026-104721). The 1.6.x line keeps SLF4J 2.0.x and JDK 11.
+ // Spring Boot 4.1.2 manages SLF4J 2.0.20, so SLF4J is not pinned.
'logback.version' : '1.6.5',
// Security: overrides the 5.8.1 Spring Boot 4.1 manages. 5.9.2 stopped ProxySettings
// .toString() writing the SOCKS5 proxy credentials into the application log
@@ -136,32 +132,27 @@ ext {
// Boot's selenium-htmlunit.version (htmlunit3-driver) stays at 4.43.0: the newest
// htmlunit3-driver needs a HtmlUnit newer than Boot manages, and nothing here uses it.
'selenium.version' : '4.49.0',
- // Logback 1.6.5 requires 2.0.19; align the SLF4J family above Boot's managed 2.0.18.
- 'slf4j.version' : '2.0.19',
'spock.version' : '2.4-groovy-5.0',
// Not managed by spring-boot-dependencies. springdoc 3.x is the Spring Boot 4 /
// Spring Framework 7 line; the grails-openapi module compiles against its
// OpenApiCustomizer SPI and apps add the webmvc-ui starter for Swagger UI.
- 'springdoc-openapi.version' : '3.1.0',
- // Not managed by spring-boot-dependencies. Kept at the version springdoc-openapi
+ 'springdoc-openapi.version' : '3.1.1',
+ // Not managed by spring-boot-dependencies. Kept at the version springdoc-openapi 3.1.1
// resolves, which grails-openapi compiles against without requiring springdoc.
- 'swagger.version' : '2.2.52',
+ 'swagger.version' : '2.2.55',
'starter-sitemesh.version' : '3.3.0',
'spring-webmvc-sitemesh.version': '3.3.0',
// Spring Boot 4 no longer manages spring-retry; pin it here so the
// grails-shell-cli SpringRetryCompilerAutoConfiguration's unversioned
// reference resolves and consumer apps using @Retryable get a known version.
'spring-retry.version' : '2.0.13',
- // Security: overrides Tomcat 11.0.24 from Spring Boot 4.1. Includes the fixes for
- // CVE-2026-65905, CVE-2026-65182, CVE-2026-68525 and CVE-2026-65927 on the Servlet 6.1 line.
- 'tomcat.version' : '11.0.26',
// Undertow is no longer managed by spring-boot-dependencies: Spring Boot 4
// removed its Undertow support before GA. Servlet 6.1 support ships as
// undertow-core 2.4.x plus the io.undertow.ee servlet/websockets artifacts,
// consumed by the vendored grails-undertow-spring-boot module.
- 'undertow.version' : '2.4.3.Final',
- 'undertow-servlet.version' : '2.0.2.Final',
- 'undertow-websockets.version' : '2.0.2.Final',
+ 'undertow.version' : '2.4.4.Final',
+ 'undertow-servlet.version' : '2.0.3.Final',
+ 'undertow-websockets.version' : '2.0.3.Final',
]
// Note: the name of the dependency must be the prefix of the property name so properties in the pom are resolved correctly
@@ -171,7 +162,6 @@ ext {
'jackson-bom' : "tools.jackson:jackson-bom:${bomDependencyVersions['jackson-bom.version']}",
'opentelemetry-bom' : "io.opentelemetry:opentelemetry-bom:${bomDependencyVersions['opentelemetry.version']}",
'selenium-bom' : "org.seleniumhq.selenium:selenium-bom:${bomDependencyVersions['selenium.version']}",
- 'slf4j-bom' : "org.slf4j:slf4j-bom:${bomDependencyVersions['slf4j.version']}",
'spock-bom' : "org.spockframework:spock-bom:${bomDependencyVersions['spock.version']}",
]
@@ -179,10 +169,6 @@ ext {
bomDependencies = [
'bootstrap' : "org.webjars.npm:bootstrap:${bomDependencyVersions['bootstrap.version']}",
'bootstrap-icons' : "org.webjars.npm:bootstrap-icons:${bomDependencyVersions['bootstrap-icons.version']}",
- // Keeps the BOM authoritative for the version Selenium 4.49.0 pulls in - see byte-buddy.version.
- // Both artifacts are pinned so a classpath cannot mix Byte Buddy versions.
- 'byte-buddy' : "net.bytebuddy:byte-buddy:${bomDependencyVersions['byte-buddy.version']}",
- 'byte-buddy-agent' : "net.bytebuddy:byte-buddy-agent:${bomDependencyVersions['byte-buddy.version']}",
'cas-client-core' : "org.apereo.cas.client:cas-client-core:${bomDependencyVersions['cas-client-core.version']}",
'checker-qual' : "org.checkerframework:checker-qual:${bomDependencyVersions['checker-qual.version']}",
'commons-codec' : "commons-codec:commons-codec:${bomDependencyVersions['commons-codec.version']}",
@@ -220,13 +206,13 @@ ext {
'groovy-xml' : "org.apache.groovy:groovy-xml:${bomDependencyVersions['groovy.version']}",
'groovy-yaml' : "org.apache.groovy:groovy-yaml:${bomDependencyVersions['groovy.version']}",
'guava' : "com.google.guava:guava:${bomDependencyVersions['guava.version']}",
- // Security override of the 2.21.5 spring-boot-dependencies imports through
+ // Security override of the 2.21.7 spring-boot-dependencies imports through
// com.fasterxml.jackson:jackson-bom - see jackson-2-bom.version
'jackson2-annotations' : "com.fasterxml.jackson.core:jackson-annotations:${bomDependencyVersions['jackson2-annotations.version']}",
'jackson-2-bom-core' : "com.fasterxml.jackson.core:jackson-core:${bomDependencyVersions['jackson-2-bom.version']}",
'jackson-2-bom-databind' : "com.fasterxml.jackson.core:jackson-databind:${bomDependencyVersions['jackson-2-bom.version']}",
'jackson-2-bom-datatype-jsr310': "com.fasterxml.jackson.datatype:jackson-datatype-jsr310:${bomDependencyVersions['jackson-2-bom.version']}",
- // Security override of the 3.1.5 spring-boot-dependencies imports through
+ // Security override of the 3.1.7 spring-boot-dependencies imports through
// tools.jackson:jackson-bom - see jackson-bom.version
'jackson-bom-core' : "tools.jackson.core:jackson-core:${bomDependencyVersions['jackson-bom.version']}",
'jackson-bom-databind' : "tools.jackson.core:jackson-databind:${bomDependencyVersions['jackson-bom.version']}",
@@ -267,14 +253,6 @@ ext {
'swagger-models-jakarta' : "io.swagger.core.v3:swagger-models-jakarta:${bomDependencyVersions['swagger.version']}",
'starter-sitemesh' : "org.sitemesh:spring-boot-starter-sitemesh:${bomDependencyVersions['starter-sitemesh.version']}",
'spring-webmvc-sitemesh' : "org.sitemesh:spring-webmvc-sitemesh:${bomDependencyVersions['spring-webmvc-sitemesh.version']}",
- // Security override of spring-boot-dependencies - see tomcat.version
- 'tomcat-annotations-api' : "org.apache.tomcat:tomcat-annotations-api:${bomDependencyVersions['tomcat.version']}",
- 'tomcat-jdbc' : "org.apache.tomcat:tomcat-jdbc:${bomDependencyVersions['tomcat.version']}",
- 'tomcat-jsp-api' : "org.apache.tomcat:tomcat-jsp-api:${bomDependencyVersions['tomcat.version']}",
- 'tomcat-embed-core' : "org.apache.tomcat.embed:tomcat-embed-core:${bomDependencyVersions['tomcat.version']}",
- 'tomcat-embed-el' : "org.apache.tomcat.embed:tomcat-embed-el:${bomDependencyVersions['tomcat.version']}",
- 'tomcat-embed-jasper' : "org.apache.tomcat.embed:tomcat-embed-jasper:${bomDependencyVersions['tomcat.version']}",
- 'tomcat-embed-websocket' : "org.apache.tomcat.embed:tomcat-embed-websocket:${bomDependencyVersions['tomcat.version']}",
// Not managed by spring-boot-dependencies - see undertow.version
'undertow-core' : "io.undertow:undertow-core:${bomDependencyVersions['undertow.version']}",
'undertow-servlet' : "io.undertow.ee:undertow-servlet:${bomDependencyVersions['undertow-servlet.version']}",
@@ -309,8 +287,12 @@ ext {
'gradle-groovy.version',
]
bomRedundantVersionExemptions = [
- // Kept equal to Spring Boot's on purpose - see graphql-java.version
+ // Drift tripwire for extended-scalars compatibility on later Boot graphql-java bumps,
+ // not an equal-version upgrade of extended-scalars - see graphql-java.version.
'graphql-java.version',
+ // The Hibernate 7 BOM strictly re-declares Boot's version so enforcedPlatform consumers
+ // are forced to it; the pin matches Spring Boot 4.1.2 on purpose.
+ 'hibernate.version',
]
// Defaults for per-BOM overrides; populated in the if/else blocks below
@@ -324,7 +306,7 @@ ext {
if (project.name in ['grails-bom', 'grails-hibernate5-bom'] || project.name.startsWith('grails-data-hibernate5')) {
customBomVersions = [
'liquibase-hibernate.version': '4.27.0',
- 'liquibase.version' : '4.27.0',
+ 'liquibase.version' : '4.27.0', // liquibase-hibernate5 stops at 4.27.0, and Boot 4.1.2's Liquibase 5.0.4 is a new major.
'hibernate.version' : '5.6.15.Final',
]
combinedVersions += customBomVersions
@@ -366,14 +348,15 @@ ext {
customBomVersions = [
'cache-ri-impl.version' : '1.1.1',
'derby.version' : '10.17.1.0',
- // Spring Boot 4.1 can select Hibernate ORM 7.4.x through Spring Dependency
- // Management, and Hibernate ORM 7.4.x requires hibernate-models 1.1.x.
+ // Spring Boot 4.1.2 selects Hibernate ORM 7.4.13.Final. This BOM strictly re-declares
+ // that version so enforcedPlatform consumers are forced to it; a platform() import
+ // is not enforced. 7.4.13.Final still requires hibernate-models 1.1.2.
'hibernate-models.version' : '1.1.2',
'hibernate-tools.version' : '7.3.13.Final',
- 'hibernate.version' : '7.4.10.Final',
+ 'hibernate.version' : '7.4.13.Final',
'jandex.version' : '3.6.0',
'liquibase-test-harness.version': '1.0.11',
- 'liquibase.version' : '4.27.0',
+ 'liquibase.version' : '4.27.0', // liquibase-hibernate5 stops at 4.27.0, and Boot 4.1.2's Liquibase 5.0.4 is a new major.
'mockito-inline.version' : '5.2.0',
]
combinedVersions += customBomVersions