This is an automated email from the ASF dual-hosted git repository. matrei pushed a commit to branch spring-boot-4.1.1 in repository https://gitbox.apache.org/repos/asf/grails-core.git
commit 7851d40d6854ed1ea42da523d20ae7a852c8a8d0 Author: Mattias Reichel <[email protected]> AuthorDate: Fri Aug 21 12:00:50 2026 +0200 build: conditionally transfer versions in end-to-end for sdp The overrides were removed in `dependencies.gradle` but if they were to re-appear in the future this will handle that situation and also stay as a reminder of this gotcha instead of just removing it. --- end-to-end/spring-dependency-management/build.gradle | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/end-to-end/spring-dependency-management/build.gradle b/end-to-end/spring-dependency-management/build.gradle index ac4f7e9edb..40d00874b5 100644 --- a/end-to-end/spring-dependency-management/build.gradle +++ b/end-to-end/spring-dependency-management/build.gradle @@ -65,14 +65,15 @@ dependencyManagement { } } -// io.spring.dependency-management lets spring-boot-dependencies' own logback.version property win over -// the grails-bom import, so the security-patched logback isn't applied automatically. A migrated Grails 7 -// app hitting the same CVE would override the Spring-managed version property directly; reproduce that here, -// sourcing the number from dependencies.gradle so it stays the single source of truth. +// Spring Dependency Management may let Spring Boot's version properties win over the Grails BOM +// import. Apply Grails' version map and mirror these security overrides when they are present. apply from: rootProject.layout.projectDirectory.file('../dependencies.gradle') -ext['logback.version'] = bomDependencyVersions['logback.version'] -// Same situation for the Jackson 3 security override (CVE-2026-59889) - see jackson3.version in dependencies.gradle. -ext['jackson-bom.version'] = bomDependencyVersions['jackson3.version'] +if (bomDependencyVersions.containsKey('logback.version')) { + ext['logback.version'] = bomDependencyVersions['logback.version'] +} +if (bomDependencyVersions.containsKey('jackson3.version')) { + ext['jackson-bom.version'] = bomDependencyVersions['jackson3.version'] +} dependencies { implementation 'org.apache.grails:grails-dependencies-starter-web'
