This is an automated email from the ASF dual-hosted git repository. jdaugherty pushed a commit to branch 8.0.x in repository https://gitbox.apache.org/repos/asf/grails-core.git
commit b5e583a6bf8fbfed6aa40fc9fc20c922273060d7 Author: James Daugherty <[email protected]> AuthorDate: Thu Jul 9 18:32:21 2026 -0400 Bump jackson3 --- dependencies.gradle | 6 ++++++ grails-test-examples/spring-dependency-management/build.gradle | 2 ++ 2 files changed, 8 insertions(+) diff --git a/dependencies.gradle b/dependencies.gradle index 7725dddfc0..72bd87a6b3 100644 --- a/dependencies.gradle +++ b/dependencies.gradle @@ -89,6 +89,8 @@ ext { 'httpcore5.version' : '5.4.3', // Security: overrides the transitive com.fasterxml Jackson 2.x. 2.21.5 fixes CVE-2026-54515 flagged against 2.21.4. 'jackson2.version' : '2.21.5', + // Security: overrides spring-boot-dependencies (3.1.4). 3.1.5 fixes CVE-2026-59889 (JsonView bypass) flagged against jackson-databind. + 'jackson3.version' : '3.1.5', 'jquery.version' : '3.7.1', 'kotlin.version' : '2.2.21', 'liquibase-hibernate5.version' : '4.27.0', @@ -176,6 +178,10 @@ ext { // jackson-annotations is out of lockstep (no 2.21.5 release) and stays transitively managed. 'jackson2-core' : "com.fasterxml.jackson.core:jackson-core:${bomDependencyVersions['jackson2.version']}", 'jackson2-databind' : "com.fasterxml.jackson.core:jackson-databind:${bomDependencyVersions['jackson2.version']}", + // Security override of spring-boot-dependencies - see jackson3.version. databind 3.1.5 pins + // jackson-core 3.1.5 via its parent pom, so the BOM must manage core in lockstep (rule 14). + 'jackson3-core' : "tools.jackson.core:jackson-core:${bomDependencyVersions['jackson3.version']}", + 'jackson3-databind' : "tools.jackson.core:jackson-databind:${bomDependencyVersions['jackson3.version']}", 'jquery' : "org.webjars.npm:jquery:${bomDependencyVersions['jquery.version']}", // Security override of spring-boot-dependencies - see logback.version 'logback-classic' : "ch.qos.logback:logback-classic:${bomDependencyVersions['logback.version']}", diff --git a/grails-test-examples/spring-dependency-management/build.gradle b/grails-test-examples/spring-dependency-management/build.gradle index 98c3a840d2..be0ec5acbb 100644 --- a/grails-test-examples/spring-dependency-management/build.gradle +++ b/grails-test-examples/spring-dependency-management/build.gradle @@ -65,6 +65,8 @@ dependencyManagement { // sourcing the number from dependencies.gradle so it stays the single source of truth. apply from: rootProject.layout.projectDirectory.file('dependencies.gradle') ext['logback.version'] = bomDependencyVersions['logback.version'] +// Same situation for the Jackson 3 security override (CVE-2026-59889) - see jackson3.version in dependencies.gradle. +ext['jackson-bom.version'] = bomDependencyVersions['jackson3.version'] dependencies { implementation 'org.apache.grails:grails-dependencies-starter-web'
