You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@grails.apache.org by ja...@apache.org on 2026/07/22 22:25:09 UTC
(grails-core) branch deps/cve-log4j-jansi-7.0.x updated: Align Log4j across published BOMs
This is an automated email from the ASF dual-hosted git repository.
jamesfredley pushed a commit to branch deps/cve-log4j-jansi-7.0.x
in repository https://gitbox.apache.org/repos/asf/grails-core.git
The following commit(s) were added to refs/heads/deps/cve-log4j-jansi-7.0.x by this push:
new 13cadadf83 Align Log4j across published BOMs
13cadadf83 is described below
commit 13cadadf83a4ebcef775b615b87116b5cd3fa6c4
Author: James Fredley <ja...@users.noreply.github.com>
AuthorDate: Wed Jul 22 18:23:29 2026 -0400
Align Log4j across published BOMs
Move Log4j 2.25.5 management into the shared Gradle BOM maps and import
the Log4j BOM from both published base BOMs so every Log4j module is
aligned at the fixed version.
Manage biz.aQute.bnd.annotation 7.1.0, which Log4j 2.25.5 requires, so
the dependency version validator matches the winning transitive version.
Assisted-by: opencode:gpt-5.6-sol codegraph
---
dependencies.gradle | 25 +++++++++++++++----------
grails-bom/base/build.gradle | 1 +
grails-gradle/bom/build.gradle | 1 +
3 files changed, 17 insertions(+), 10 deletions(-)
diff --git a/dependencies.gradle b/dependencies.gradle
index d8644ef417..77a4e72054 100644
--- a/dependencies.gradle
+++ b/dependencies.gradle
@@ -27,6 +27,7 @@ ext {
'asciidoctor-gradle-jvm.version': '4.0.5',
'asciidoctorj.version' : '3.0.0',
'asset-pipeline-gradle.version' : '5.0.34',
+ 'bnd.version' : '7.1.0',
'byte-buddy.version' : '1.18.3',
'commons-text.version' : '1.15.0',
'directory-watcher.version' : '0.19.1',
@@ -37,6 +38,8 @@ ext {
'jline.version' : '2.14.6',
'jna.version' : '5.17.0',
'jquery.version' : '3.7.1',
+ // Security: overrides spring-boot-dependencies (2.24.3). 2.25.5 fixes CVE-2026-49844 flagged against log4j-api.
+ 'log4j2.version' : '2.25.5',
'objenesis.version' : '3.4',
'spring-boot.version' : '3.5.16',
]
@@ -44,6 +47,7 @@ ext {
// Note: the name of the dependency must be the prefix of the property name so properties in the pom are resolved correctly
gradleBomPlatformDependencies = [
'spring-boot-bom' : "org.springframework.boot:spring-boot-dependencies:${gradleBomDependencyVersions['spring-boot.version']}",
+ 'log4j2-bom' : "org.apache.logging.log4j:log4j-bom:${gradleBomDependencyVersions['log4j2.version']}",
'gradle-spock-bom': "org.spockframework:spock-bom:${gradleBomDependencyVersions['gradle-spock.version']}",
]
@@ -56,6 +60,7 @@ ext {
'asciidoctor-gradle-jvm': "org.asciidoctor:asciidoctor-gradle-jvm:${gradleBomDependencyVersions['asciidoctor-gradle-jvm.version']}",
'asciidoctorj' : "org.asciidoctor:asciidoctorj:${gradleBomDependencyVersions['asciidoctorj.version']}",
'asset-pipeline-gradle' : "cloud.wondrify:asset-pipeline-gradle:${gradleBomDependencyVersions['asset-pipeline-gradle.version']}",
+ 'bnd-annotation' : "biz.aQute.bnd:biz.aQute.bnd.annotation:${gradleBomDependencyVersions['bnd.version']}",
'byte-buddy' : "net.bytebuddy:byte-buddy:${gradleBomDependencyVersions['byte-buddy.version']}",
'commons-text' : "org.apache.commons:commons-text:${gradleBomDependencyVersions['commons-text.version']}",
'directory-watcher' : "io.methvin:directory-watcher:${gradleBomDependencyVersions['directory-watcher.version']}",
@@ -64,6 +69,12 @@ ext {
'javaparser-core' : "com.github.javaparser:javaparser-core:${gradleBomDependencyVersions['javaparser-core.version']}",
'jline' : "jline:jline:${gradleBomDependencyVersions['jline.version']}",
'jna' : "net.java.dev.jna:jna:${gradleBomDependencyVersions['jna.version']}",
+ // Security override of spring-boot-dependencies - see log4j2.version
+ 'log4j2-api' : "org.apache.logging.log4j:log4j-api:${gradleBomDependencyVersions['log4j2.version']}",
+ 'log4j2-core' : "org.apache.logging.log4j:log4j-core:${gradleBomDependencyVersions['log4j2.version']}",
+ 'log4j2-jul' : "org.apache.logging.log4j:log4j-jul:${gradleBomDependencyVersions['log4j2.version']}",
+ 'log4j2-slf4j2-impl' : "org.apache.logging.log4j:log4j-slf4j2-impl:${gradleBomDependencyVersions['log4j2.version']}",
+ 'log4j2-to-slf4j' : "org.apache.logging.log4j:log4j-to-slf4j:${gradleBomDependencyVersions['log4j2.version']}",
'objenesis' : "org.objenesis:objenesis:${gradleBomDependencyVersions['objenesis.version']}",
'spring-boot-cli' : "org.springframework.boot:spring-boot-cli:${gradleBomDependencyVersions['spring-boot.version']}",
'spring-boot-gradle' : "org.springframework.boot:spring-boot-gradle-plugin:${gradleBomDependencyVersions['spring-boot.version']}",
@@ -87,8 +98,6 @@ ext {
'jackson.version' : '2.21.5',
// Security: overrides spring-boot-dependencies (1.5.34). 1.5.37 fixes CVE-2026-13006 flagged against logback-core.
'logback.version' : '1.5.37',
- // Security: overrides spring-boot-dependencies (2.24.3). 2.25.5 fixes CVE-2026-49844 flagged against log4j-api.
- 'log4j2.version' : '2.25.5',
'jquery.version' : '3.7.1',
'hibernate-groovy-proxy.version': '1.1',
'jakarta-servlet-api.version' : '6.1.0',
@@ -120,7 +129,6 @@ ext {
'asset-pipeline-bom': "cloud.wondrify:asset-pipeline-bom:${bomDependencyVersions['asset-pipeline-bom.version']}",
'spock-bom' : "org.spockframework:spock-bom:${bomDependencyVersions['spock.version']}",
'jackson-bom' : "com.fasterxml.jackson:jackson-bom:${bomDependencyVersions['jackson.version']}",
- 'log4j2-bom' : "org.apache.logging.log4j:log4j-bom:${bomDependencyVersions['log4j2.version']}",
'groovy-bom' : "org.apache.groovy:groovy-bom:${bomDependencyVersions['groovy.version']}",
'junit-bom' : "org.junit:junit-bom:${bomDependencyVersions['junit.version']}",
'selenium-bom' : "org.seleniumhq.selenium:selenium-bom:${bomDependencyVersions['selenium.version']}",
@@ -176,12 +184,6 @@ ext {
// Security override of spring-boot-dependencies - see logback.version
'logback-classic' : "ch.qos.logback:logback-classic:${bomDependencyVersions['logback.version']}",
'logback-core' : "ch.qos.logback:logback-core:${bomDependencyVersions['logback.version']}",
- // Security override of spring-boot-dependencies - see log4j2.version
- 'log4j2-api' : "org.apache.logging.log4j:log4j-api:${bomDependencyVersions['log4j2.version']}",
- 'log4j2-core' : "org.apache.logging.log4j:log4j-core:${bomDependencyVersions['log4j2.version']}",
- 'log4j2-jul' : "org.apache.logging.log4j:log4j-jul:${bomDependencyVersions['log4j2.version']}",
- 'log4j2-slf4j2-impl' : "org.apache.logging.log4j:log4j-slf4j2-impl:${bomDependencyVersions['log4j2.version']}",
- 'log4j2-to-slf4j' : "org.apache.logging.log4j:log4j-to-slf4j:${bomDependencyVersions['log4j2.version']}",
// start - boot & selenium conflict, so pin the version we want (newest)
'jakarta-servlet-api' : "jakarta.servlet:jakarta.servlet-api:${bomDependencyVersions['jakarta-servlet-api.version']}",
'jakarta-validation-api' : "jakarta.validation:jakarta.validation-api:${bomDependencyVersions['jakarta-validation-api.version']}",
@@ -234,7 +236,10 @@ ext {
// Because pom exclusions aren't properly supported by gradle, we can't inherit the grails-gradle-bom
// this requires copying the platforms selectively to the grails-bom. Create a combined version for convenience.
- combinedPlatforms = ['spring-boot-bom': gradleBomPlatformDependencies['spring-boot-bom']] + bomPlatformDependencies
+ combinedPlatforms = [
+ 'spring-boot-bom': gradleBomPlatformDependencies['spring-boot-bom'],
+ 'log4j2-bom' : gradleBomPlatformDependencies['log4j2-bom'],
+ ] + bomPlatformDependencies
combinedDependencies = gradleBomDependencies + bomDependencies
combinedVersions = gradleBomDependencyVersions + bomDependencyVersions
diff --git a/grails-bom/base/build.gradle b/grails-bom/base/build.gradle
index f95a891d6a..8633bbfce3 100644
--- a/grails-bom/base/build.gradle
+++ b/grails-bom/base/build.gradle
@@ -61,6 +61,7 @@ dependencies {
exclude group: 'jakarta.servlet'
exclude group: 'jakarta.validation'
}
+ api platform(gradleBomPlatformDependencies['log4j2-bom'])
for (def entry : bomPlatformDependencies.entrySet()) {
if (entry.key == 'groovy-bom') {
diff --git a/grails-gradle/bom/build.gradle b/grails-gradle/bom/build.gradle
index 228b307d58..33a530bbc2 100644
--- a/grails-gradle/bom/build.gradle
+++ b/grails-gradle/bom/build.gradle
@@ -43,6 +43,7 @@ dependencies {
exclude group: 'org.spockframework'
exclude group: 'com.fasterxml.jackson'
}
+ api platform(gradleBomPlatformDependencies['log4j2-bom'])
// Because gradle uses groovy 3, we must use groovy 3 compatible versions for the grails-gradle-bom
api platform("org.codehaus.groovy:groovy-bom:${GroovySystem.version}")