You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@grails.apache.org by jd...@apache.org on 2026/07/07 19:33:17 UTC
(grails-core) branch 7.0.x updated: Add plexus-xml since it was split from plexus-utils
This is an automated email from the ASF dual-hosted git repository.
jdaugherty pushed a commit to branch 7.0.x
in repository https://gitbox.apache.org/repos/asf/grails-core.git
The following commit(s) were added to refs/heads/7.0.x by this push:
new 53ded00672 Add plexus-xml since it was split from plexus-utils
53ded00672 is described below
commit 53ded00672c26908934c12f23ae089311a664c27
Author: James Daugherty <jd...@jdresources.net>
AuthorDate: Tue Jul 7 15:33:09 2026 -0400
Add plexus-xml since it was split from plexus-utils
---
dependencies.gradle | 15 +++++++++++----
grails-shell-cli/build.gradle | 4 ++++
2 files changed, 15 insertions(+), 4 deletions(-)
diff --git a/dependencies.gradle b/dependencies.gradle
index 46b1103c4d..aae9349ee7 100644
--- a/dependencies.gradle
+++ b/dependencies.gradle
@@ -97,6 +97,11 @@ ext {
'nimbus-jose-jwt.version' : '10.5',
'opentelemetry.version' : '1.62.0',
'plexus-utils.version' : '4.0.3',
+ // Companion to plexus-utils 4.x: the org.codehaus.plexus.util.xml package (XmlStreamReader,
+ // Xpp3Dom, the pull parsers) moved out of plexus-utils into plexus-xml. maven-model 3.9.x
+ // still needs those classes, so any classpath where the BOM forces plexus-utils 4.x must
+ // also carry plexus-xml. The 3.x line is the Maven 3-compatible one.
+ 'plexus-xml.version' : '3.0.2',
'pac4j.version' : '6.4.3',
'rxjava.version' : '1.3.8',
'rxjava2.version' : '2.2.21',
@@ -204,14 +209,16 @@ ext {
'opentelemetry-sdk-extension-autoconfigure-spi' : "io.opentelemetry:opentelemetry-sdk-extension-autoconfigure-spi:${bomDependencyVersions['opentelemetry.version']}",
'opentelemetry-sdk-extension-autoconfigure' : "io.opentelemetry:opentelemetry-sdk-extension-autoconfigure:${bomDependencyVersions['opentelemetry.version']}",
// end - pin opentelemetry to prevent bom conflicts
- 'pac4j-core' : "org.pac4j:pac4j-core:${bomDependencyVersions['pac4j.version']}",
- 'pac4j-jakartaee' : "org.pac4j:pac4j-jakartaee:${bomDependencyVersions['pac4j.version']}",
- 'pac4j-oauth' : "org.pac4j:pac4j-oauth:${bomDependencyVersions['pac4j.version']}",
+ 'pac4j-core' : "org.pac4j:pac4j-core:${bomDependencyVersions['pac4j.version']}",
+ 'pac4j-jakartaee' : "org.pac4j:pac4j-jakartaee:${bomDependencyVersions['pac4j.version']}",
+ 'pac4j-oauth' : "org.pac4j:pac4j-oauth:${bomDependencyVersions['pac4j.version']}",
'plexus-utils' : "org.codehaus.plexus:plexus-utils:${bomDependencyVersions['plexus-utils.version']}",
+ // Required alongside plexus-utils 4.x - see plexus-xml.version
+ 'plexus-xml' : "org.codehaus.plexus:plexus-xml:${bomDependencyVersions['plexus-xml.version']}",
'rxjava' : "io.reactivex:rxjava:${bomDependencyVersions['rxjava.version']}",
'rxjava2' : "io.reactivex.rxjava2:rxjava:${bomDependencyVersions['rxjava2.version']}",
'rxjava3' : "io.reactivex.rxjava3:rxjava:${bomDependencyVersions['rxjava3.version']}",
- 'scribejava-core' : "com.github.scribejava:scribejava-core:${bomDependencyVersions['scribejava.version']}",
+ 'scribejava-core' : "com.github.scribejava:scribejava-core:${bomDependencyVersions['scribejava.version']}",
'sitemesh' : "opensymphony:sitemesh:${bomDependencyVersions['sitemesh.version']}",
'starter-sitemesh' : "org.sitemesh:spring-boot-starter-sitemesh:${bomDependencyVersions['starter-sitemesh.version']}",
]
diff --git a/grails-shell-cli/build.gradle b/grails-shell-cli/build.gradle
index 235806694d..2cd98099cb 100644
--- a/grails-shell-cli/build.gradle
+++ b/grails-shell-cli/build.gradle
@@ -83,6 +83,10 @@ dependencies {
implementation "org.apache.maven:maven-resolver-provider:$apacheMavenVersion"
implementation "org.apache.maven:maven-model-builder:$apacheMavenVersion"
implementation "org.apache.maven:maven-settings-builder:$apacheMavenVersion"
+ // grails-bom forces plexus-utils 4.x (CVE-2025-67030), which no longer contains the
+ // org.codehaus.plexus.util.xml package the maven-model/maven-settings readers need
+ // (XmlStreamReader, the Xpp3 pull parsers) - it moved to plexus-xml (BOM-managed).
+ implementation 'org.codehaus.plexus:plexus-xml'
//implementation "org.eclipse.sisu:org.eclipse.sisu.inject:0.9.0.M3" // upstream from the maven resolver examples project
testImplementation "net.sf.expectit:expectit-core:$expectitCoreVersion"