This is an automated email from the ASF dual-hosted git repository. matrei pushed a commit to branch spring-boot-4.1.1 in repository https://gitbox.apache.org/repos/asf/grails-core.git
commit 9a0ed70a0dd7c2875c4e0317a198a45f684b6719 Author: Mattias Reichel <[email protected]> AuthorDate: Fri Aug 21 14:17:27 2026 +0200 fix(deps): stop managing the log4j version Fixed version is managed upstream --- dependencies.gradle | 24 +----------------------- grails-bom/base/build.gradle | 6 ------ grails-bom/hibernate5-micronaut/build.gradle | 3 --- grails-bom/hibernate5/build.gradle | 3 --- grails-bom/hibernate7-micronaut/build.gradle | 3 --- grails-bom/hibernate7/build.gradle | 3 --- grails-bom/micronaut/build.gradle | 3 --- grails-bom/neo4j/build.gradle | 3 --- grails-gradle/bom/build.gradle | 3 --- 9 files changed, 1 insertion(+), 50 deletions(-) diff --git a/dependencies.gradle b/dependencies.gradle index 2d512bb38b..9ea81658d5 100644 --- a/dependencies.gradle +++ b/dependencies.gradle @@ -38,9 +38,6 @@ ext { 'jline.version' : '3.30.16', 'jna.version' : '5.19.1', 'jquery.version' : '4.0.0', - // Security: overrides spring-boot-dependencies (2.24.3). 2.25.5 fixes CVE-2026-49844 flagged against log4j-api. - // Also declared in bomDependencyVersions so app BOMs and the Gradle plugin BOM stay aligned. - 'log4j2.version' : '2.25.5', 'maven-model.version' : '3.9.16', 'objenesis.version' : '3.6', 'spring-boot.version' : '4.1.1', @@ -49,7 +46,6 @@ ext { // Note: the name of the dependency must be the prefix of the property name so properties in the pom are resolved correctly gradleBomPlatformDependencies = [ 'spring-boot-bom' : "org.springframework.boot:spring-boot-dependencies:${gradleBomDependencyVersions['spring-boot.version']}", - 'log4j2-bom' : "org.apache.logging.log4j:log4j-bom:${gradleBomDependencyVersions['log4j2.version']}", 'gradle-groovy-bom': "org.apache.groovy:groovy-bom:${gradleBomDependencyVersions['gradle-groovy.version']}", 'gradle-spock-bom' : "org.spockframework:spock-bom:${gradleBomDependencyVersions['gradle-spock.version']}", ] @@ -67,12 +63,6 @@ ext { 'javaparser-core' : "com.github.javaparser:javaparser-core:${gradleBomDependencyVersions['javaparser-core.version']}", 'jline' : "org.jline:jline:${gradleBomDependencyVersions['jline.version']}", 'jna' : "net.java.dev.jna:jna:${gradleBomDependencyVersions['jna.version']}", - // Security override of spring-boot-dependencies - see log4j2.version - 'log4j2-api' : "org.apache.logging.log4j:log4j-api:${gradleBomDependencyVersions['log4j2.version']}", - 'log4j2-core' : "org.apache.logging.log4j:log4j-core:${gradleBomDependencyVersions['log4j2.version']}", - 'log4j2-jul' : "org.apache.logging.log4j:log4j-jul:${gradleBomDependencyVersions['log4j2.version']}", - 'log4j2-slf4j2-impl' : "org.apache.logging.log4j:log4j-slf4j2-impl:${gradleBomDependencyVersions['log4j2.version']}", - 'log4j2-to-slf4j' : "org.apache.logging.log4j:log4j-to-slf4j:${gradleBomDependencyVersions['log4j2.version']}", 'objenesis' : "org.objenesis:objenesis:${gradleBomDependencyVersions['objenesis.version']}", 'spring-boot-cli' : "org.springframework.boot:spring-boot-cli:${gradleBomDependencyVersions['spring-boot.version']}", 'spring-boot-gradle' : "org.springframework.boot:spring-boot-gradle-plugin:${gradleBomDependencyVersions['spring-boot.version']}", @@ -102,8 +92,6 @@ ext { 'jquery.version' : '4.0.0', 'kotlin.version' : '2.2.21', 'liquibase-hibernate5.version' : '4.27.0', - // Security: overrides spring-boot-dependencies (2.24.3). 2.25.5 fixes CVE-2026-49844 flagged against log4j-api. - 'log4j2.version' : '2.25.5', 'mockito.version' : '5.23.0', 'mongodb.version' : '5.8.0', 'nimbus-jose-jwt.version' : '10.9.1', @@ -139,7 +127,6 @@ ext { bomPlatformDependencies = [ 'asset-pipeline-bom': "cloud.wondrify:asset-pipeline-bom:${bomDependencyVersions['asset-pipeline-bom.version']}", 'groovy-bom' : "org.apache.groovy:groovy-bom:${bomDependencyVersions['groovy.version']}", - 'log4j2-bom' : "org.apache.logging.log4j:log4j-bom:${bomDependencyVersions['log4j2.version']}", 'junit-bom' : "org.junit:junit-bom:${bomDependencyVersions['junit.version']}", 'spock-bom' : "org.spockframework:spock-bom:${bomDependencyVersions['spock.version']}", ] @@ -191,12 +178,6 @@ ext { 'jackson2-core' : "com.fasterxml.jackson.core:jackson-core:${bomDependencyVersions['jackson2.version']}", 'jackson2-databind' : "com.fasterxml.jackson.core:jackson-databind:${bomDependencyVersions['jackson2.version']}", 'jquery' : "org.webjars.npm:jquery:${bomDependencyVersions['jquery.version']}", - // Security override of spring-boot-dependencies - see log4j2.version - 'log4j2-api' : "org.apache.logging.log4j:log4j-api:${bomDependencyVersions['log4j2.version']}", - 'log4j2-core' : "org.apache.logging.log4j:log4j-core:${bomDependencyVersions['log4j2.version']}", - 'log4j2-jul' : "org.apache.logging.log4j:log4j-jul:${bomDependencyVersions['log4j2.version']}", - 'log4j2-slf4j2-impl' : "org.apache.logging.log4j:log4j-slf4j2-impl:${bomDependencyVersions['log4j2.version']}", - 'log4j2-to-slf4j' : "org.apache.logging.log4j:log4j-to-slf4j:${bomDependencyVersions['log4j2.version']}", // Security override of the transitive 3.5.1 - see plexus-utils.version 'plexus-utils' : "org.codehaus.plexus:plexus-utils:${bomDependencyVersions['plexus-utils.version']}", // Required alongside plexus-utils 4.x - see plexus-xml.version @@ -225,12 +206,9 @@ ext { // Because pom exclusions aren't properly supported by gradle, we can't inherit the grails-gradle-bom // this requires copying the platforms selectively to the grails-bom. Create a combined version for convenience. - // log4j2-bom is listed ahead of spring-boot-bom so published POM import order keeps CVE-2026-49844's - // Log4j 2.25.5 management ahead of Spring Boot's older Log4j pin (see each BOM's dependencies block). combinedPlatforms = [ - 'log4j2-bom' : bomPlatformDependencies['log4j2-bom'], 'spring-boot-bom': gradleBomPlatformDependencies['spring-boot-bom'], - ] + bomPlatformDependencies.findAll { it.key != 'log4j2-bom' } + ] + bomPlatformDependencies combinedDependencies = gradleBomDependencies + bomDependencies combinedVersions = gradleBomDependencyVersions + bomDependencyVersions diff --git a/grails-bom/base/build.gradle b/grails-bom/base/build.gradle index 91f107dfbe..03ac92d80c 100644 --- a/grails-bom/base/build.gradle +++ b/grails-bom/base/build.gradle @@ -51,9 +51,6 @@ ext { } dependencies { - // Import Log4j ahead of Spring Boot so Maven consumers resolve the full Log4j family to the - // BOM-managed 2.25.5 (CVE-2026-49844) instead of Spring Boot's older managed Log4j version. - api platform(gradleBomPlatformDependencies['log4j2-bom']) api platform(gradleBomPlatformDependencies['spring-boot-bom']), { exclude group: 'org.apache.groovy' exclude group: 'org.spockframework' @@ -63,9 +60,6 @@ dependencies { } for (def entry : bomPlatformDependencies.entrySet()) { - if (entry.key == 'log4j2-bom') { - continue - } api platform(entry.value) } diff --git a/grails-bom/hibernate5-micronaut/build.gradle b/grails-bom/hibernate5-micronaut/build.gradle index d245c68599..a2d3c62a02 100644 --- a/grails-bom/hibernate5-micronaut/build.gradle +++ b/grails-bom/hibernate5-micronaut/build.gradle @@ -66,9 +66,6 @@ def overriddenModules = customBomDependencies.values().collect { String coord -> Set<String> overriddenCoords = overriddenModules.collect { "${it.group}:${it.module}".toString() } as Set dependencies { - // Import Log4j ahead of inherited platforms so Maven consumers keep Log4j 2.25.5 - // (CVE-2026-49844) ahead of Spring Boot's older managed Log4j version. - api platform(gradleBomPlatformDependencies['log4j2-bom']) api(platform(project(':grails-base-bom'))) { overriddenModules.each { ovr -> exclude group: ovr.group, module: ovr.module diff --git a/grails-bom/hibernate5/build.gradle b/grails-bom/hibernate5/build.gradle index e5ff1c8bb2..0d3a7ee971 100644 --- a/grails-bom/hibernate5/build.gradle +++ b/grails-bom/hibernate5/build.gradle @@ -51,9 +51,6 @@ ext { } dependencies { - // Import Log4j ahead of inherited platforms so Maven consumers keep Log4j 2.25.5 - // (CVE-2026-49844) ahead of Spring Boot's older managed Log4j version. - api platform(gradleBomPlatformDependencies['log4j2-bom']) api platform(project(':grails-bom')) api platform(gradleBomPlatformDependencies['spring-boot-bom']), { exclude group: 'org.apache.groovy' diff --git a/grails-bom/hibernate7-micronaut/build.gradle b/grails-bom/hibernate7-micronaut/build.gradle index 3a9564ba3e..713152b61f 100644 --- a/grails-bom/hibernate7-micronaut/build.gradle +++ b/grails-bom/hibernate7-micronaut/build.gradle @@ -66,9 +66,6 @@ def overriddenModules = customBomDependencies.values().collect { String coord -> Set<String> overriddenCoords = overriddenModules.collect { "${it.group}:${it.module}".toString() } as Set dependencies { - // Import Log4j ahead of inherited platforms so Maven consumers keep Log4j 2.25.5 - // (CVE-2026-49844) ahead of Spring Boot's older managed Log4j version. - api platform(gradleBomPlatformDependencies['log4j2-bom']) api(platform(project(':grails-base-bom'))) { overriddenModules.each { ovr -> exclude group: ovr.group, module: ovr.module diff --git a/grails-bom/hibernate7/build.gradle b/grails-bom/hibernate7/build.gradle index 3762a299bd..619cc40c65 100644 --- a/grails-bom/hibernate7/build.gradle +++ b/grails-bom/hibernate7/build.gradle @@ -51,9 +51,6 @@ ext { } dependencies { - // Import Log4j ahead of inherited platforms so Maven consumers keep Log4j 2.25.5 - // (CVE-2026-49844) ahead of Spring Boot's older managed Log4j version. - api platform(gradleBomPlatformDependencies['log4j2-bom']) api platform(project(':grails-base-bom')) constraints { diff --git a/grails-bom/micronaut/build.gradle b/grails-bom/micronaut/build.gradle index 19561abfd3..75b21c5bd6 100644 --- a/grails-bom/micronaut/build.gradle +++ b/grails-bom/micronaut/build.gradle @@ -66,9 +66,6 @@ def overriddenModules = customBomDependencies.values().collect { String coord -> Set<String> overriddenCoords = overriddenModules.collect { "${it.group}:${it.module}".toString() } as Set dependencies { - // Import Log4j ahead of inherited platforms so Maven consumers keep Log4j 2.25.5 - // (CVE-2026-49844) ahead of Spring Boot's older managed Log4j version. - api platform(gradleBomPlatformDependencies['log4j2-bom']) api(platform(project(':grails-base-bom'))) { overriddenModules.each { ovr -> exclude group: ovr.group, module: ovr.module diff --git a/grails-bom/neo4j/build.gradle b/grails-bom/neo4j/build.gradle index 95d4623255..c36a1915ae 100644 --- a/grails-bom/neo4j/build.gradle +++ b/grails-bom/neo4j/build.gradle @@ -51,9 +51,6 @@ ext { } dependencies { - // Import Log4j ahead of inherited platforms so Maven consumers keep Log4j 2.25.5 - // (CVE-2026-49844) ahead of Spring Boot's older managed Log4j version. - api platform(gradleBomPlatformDependencies['log4j2-bom']) api platform(project(':grails-bom')) constraints { diff --git a/grails-gradle/bom/build.gradle b/grails-gradle/bom/build.gradle index 326d5d8bc7..e25b76771c 100644 --- a/grails-gradle/bom/build.gradle +++ b/grails-gradle/bom/build.gradle @@ -38,9 +38,6 @@ ext { } dependencies { - // Import Log4j ahead of Spring Boot so Maven consumers resolve the full Log4j family to the - // BOM-managed 2.25.5 (CVE-2026-49844) instead of Spring Boot's older managed Log4j version. - api platform(gradleBomPlatformDependencies['log4j2-bom']) api platform(gradleBomPlatformDependencies['spring-boot-bom']), { exclude group: 'org.apache.groovy' exclude group: 'org.spockframework'
