This is an automated email from the ASF dual-hosted git repository. jamesfredley pushed a commit to branch 9.0.x in repository https://gitbox.apache.org/repos/asf/grails-core.git
commit 5b5115ccd5276e84c3618b2f870244ad55bd6831 Author: James Fredley <[email protected]> AuthorDate: Thu Jul 30 10:28:46 2026 -0400 chore: setup 9.0.x branch Set the branch version to 9.0.0-SNAPSHOT and rebind the branch-scoped metadata that identifies the release line: - gradle.properties: projectVersion and githubBranch - end-to-end/gradle.properties: projectVersion, so the end-to-end build resolves the artifacts this branch publishes rather than 8.0.0-SNAPSHOT - GrailsUtilTests: the asserted framework version - THREAT_MODEL.md and threat-model.yaml: the version binding, per the document's own instruction that each release branch carries its own Plugin descriptor grailsVersion floors are left at '8.0.0-SNAPSHOT > *', which 9.0.0 still satisfies, and the version-parsing test fixtures are left alone as they do not track the project version. The guide still carries the Grails 8 what's-new and upgrade content, so {grailsMajorVersion} now renders 9 over Grails 8 prose. That scaffolding is a separate documentation change. Assisted-by: claude-code:claude-opus-5 --- THREAT_MODEL.md | 4 ++-- end-to-end/gradle.properties | 2 +- gradle.properties | 4 ++-- grails-core/src/test/groovy/grails/util/GrailsUtilTests.java | 2 +- threat-model.yaml | 2 +- 5 files changed, 7 insertions(+), 7 deletions(-) diff --git a/THREAT_MODEL.md b/THREAT_MODEL.md index 1452a1b84e..439e950702 100644 --- a/THREAT_MODEL.md +++ b/THREAT_MODEL.md @@ -19,7 +19,7 @@ limitations under the License. ## §1 Header - **Project**: Apache Grails (`apache/grails-core`) -- **Version binding**: 8.0.x branch. A report against version *N* is triaged against this document as it stood at *N*, not at HEAD. +- **Version binding**: 9.0.x branch. A report against version *N* is triaged against this document as it stood at *N*, not at HEAD. - **Date**: 2026-01 - **Author**: Apache Grails PMC and contributors (initial draft). - **Status**: **DRAFT** - not yet ratified by maintainers. Open questions in §14 must be resolved before this document is binding. @@ -400,7 +400,7 @@ The mirror of §11: patterns that scanners, fuzzers, AI analyzers, or human revi - **"Reflective `Class.forName` / `loadClass` in `ApplicationClassInjector` and AST infrastructure, and in `DatabaseMigrationCommand` (`passwordEncryptionCodec`) / `ConfigSupport` (`source`) / `ExecuteStep` (profile YAML `className`)"** - SAST flags the same reflective pattern across multiple modules. Discharged by the §6 trust assumption on `application.yml` / `application.groovy` / profile-YAML inputs ("trusted operator input"). Class names come from configuration files, not request da [...] - **"Groovy `evaluate()` / `ConfigSlurper` in `GroovyConfigPropertySourceLoader`, `ExternalConfigRunListener`, `HibernateMappingBuilder`, and `GroovyChangeLogParser`"** - SAST flags a code-injection sink. Discharged by the §6 trust assumption on `application.groovy`, domain `mapping {}` closures, external config locations, and migration files (all trusted developer/operator inputs). See the §9 Groovy-sandboxing disclaimer and §11 misuse patterns when the assumption does not hold. → `OUT- [...] - **"`GroovyShell` instantiation in `grails-console` (`GrailsShell`, `GroovyConsoleApplicationContext`) and `GrailsApplicationScriptRunner`"** - SAST flags arbitrary code execution. These are developer-only tools that take a `File` argument from the CLI, by design (§3). → `OUT-OF-MODEL: unsupported-component`. -- **"Every `@GroovyASTTransformation` implementation in framework JARs"** - SAST flags AST-rewriting code as code-injection surface. Discharged by §8 P7 ("AST transforms only act on developer-authored source") and the §6 trust assumption on annotated source. The set on 8.0.x at the time of this revision is the union of: `Cache{Put,Evict,able}Transformation`, `TransactionalTransform`, `RollbackTransform`, `OrderedGormTransformation`, `TenantTransform`, `ServiceTransformation`, `GormEntity [...] +- **"Every `@GroovyASTTransformation` implementation in framework JARs"** - SAST flags AST-rewriting code as code-injection surface. Discharged by §8 P7 ("AST transforms only act on developer-authored source") and the §6 trust assumption on annotated source. The set on 9.0.x at the time of this revision is the union of: `Cache{Put,Evict,able}Transformation`, `TransactionalTransform`, `RollbackTransform`, `OrderedGormTransformation`, `TenantTransform`, `ServiceTransformation`, `GormEntity [...] - **"Mass-assignment warning on domain-class binding"** when the developer has applied `bindable=false` or used a command object - the SAST heuristic does not see the allow-list. Discharged by §8 P6 ("data binding respects `bindable=false`"). Verify the allow-list exists; if it does, suppress. → `KNOWN-NON-FINDING`. - **"GSP `${raw(x)}` is unsafe"** when `x` is a trusted server-side value (e.g. a model attribute populated from a query, never touched by request input). Discharged by §6 (the source of `x` is not a request parameter). Verify by trace; if confirmed trusted, suppress. → `KNOWN-NON-FINDING`. - **"`SimpleDataBinder` uses reflection on user-class field types"** - SAST flags type-confusion risk. Discharged by §6 (the target class is developer-authored; reflection runs on the target, not on attacker-supplied class metadata). → `OUT-OF-MODEL: trusted-input`. diff --git a/end-to-end/gradle.properties b/end-to-end/gradle.properties index e94c603f75..2803e61028 100644 --- a/end-to-end/gradle.properties +++ b/end-to-end/gradle.properties @@ -17,7 +17,7 @@ # under the License. # -projectVersion=8.0.0-SNAPSHOT +projectVersion=9.0.0-SNAPSHOT org.gradle.jvmargs=-Dfile.encoding=UTF-8 -Xmx5G org.gradle.configuration-cache=false diff --git a/gradle.properties b/gradle.properties index e201edf656..1f0c7441e9 100644 --- a/gradle.properties +++ b/gradle.properties @@ -13,11 +13,11 @@ # See the License for the specific language governing permissions and # limitations under the License. -projectVersion=8.0.0-SNAPSHOT +projectVersion=9.0.0-SNAPSHOT javaVersion=21 -githubBranch=8.0.x +githubBranch=9.0.x githubSlug=apache/grails-core # Note: BOM dependencies are defined in dependencies.gradle files to allow for dependabot updates diff --git a/grails-core/src/test/groovy/grails/util/GrailsUtilTests.java b/grails-core/src/test/groovy/grails/util/GrailsUtilTests.java index 5d93cdb481..f1106bf9ad 100644 --- a/grails-core/src/test/groovy/grails/util/GrailsUtilTests.java +++ b/grails-core/src/test/groovy/grails/util/GrailsUtilTests.java @@ -33,7 +33,7 @@ public class GrailsUtilTests { @Test public void testGrailsVersion() { - assertEquals("8.0.0-SNAPSHOT", GrailsUtil.getGrailsVersion()); + assertEquals("9.0.0-SNAPSHOT", GrailsUtil.getGrailsVersion()); } @AfterEach diff --git a/threat-model.yaml b/threat-model.yaml index 0a2a84edb8..b50b29c309 100644 --- a/threat-model.yaml +++ b/threat-model.yaml @@ -21,7 +21,7 @@ project: name: apache/grails-core - version_binding: "8.0.x" + version_binding: "9.0.x" threat_model: THREAT_MODEL.md status: draft date: "2026-01"
