This is an automated email from the ASF dual-hosted git repository.
jdaugherty pushed a commit to branch 7.0.x
in repository https://gitbox.apache.org/repos/asf/grails-core.git
The following commit(s) were added to refs/heads/7.0.x by this push:
new e5626547ad Update dependencies
e5626547ad is described below
commit e5626547ad876f414a3512cd5634996b250eddc4
Author: James Daugherty <[email protected]>
AuthorDate: Sat Aug 22 23:16:02 2026 -0400
Update dependencies
---
.../grails/buildsrc/VulnerabilityScanPlugin.groovy | 23 ++++++++++++++++++----
dependencies.gradle | 14 +++++++++++++
grails-data-hibernate5/core/build.gradle | 2 ++
.../grails-hibernate-groovy-proxy/build.gradle | 2 ++
4 files changed, 37 insertions(+), 4 deletions(-)
diff --git
a/build-logic/plugins/src/main/groovy/org/apache/grails/buildsrc/VulnerabilityScanPlugin.groovy
b/build-logic/plugins/src/main/groovy/org/apache/grails/buildsrc/VulnerabilityScanPlugin.groovy
index a1cc879050..041ddd6bf6 100644
---
a/build-logic/plugins/src/main/groovy/org/apache/grails/buildsrc/VulnerabilityScanPlugin.groovy
+++
b/build-logic/plugins/src/main/groovy/org/apache/grails/buildsrc/VulnerabilityScanPlugin.groovy
@@ -61,7 +61,6 @@ class VulnerabilityScanPlugin implements Plugin<Project> {
extension.username = System.getenv('SONATYPE_GUIDE_USERNAME') ?: ''
extension.password = System.getenv('SONATYPE_GUIDE_TOKEN') ?: ''
extension.excludeCoordinates = [
- 'org.hibernate:hibernate-core:5.6.11.Final',
// CVE-2018-14335: Sonatype flags this against all H2 versions; no
upstream fix exists.
'com.h2database:h2:2.4.240',
// CVE-2026-8484: org.fusesource.jansi is unmaintained; all
versions through 2.4.3 are flagged and no
@@ -73,10 +72,19 @@ class VulnerabilityScanPlugin implements Plugin<Project> {
// The fix is HdrHistogram 2.2.3, which is not yet published to
Maven Central (2.2.2 is the latest
// release). Remove this exclusion once 2.2.3+ is available and
resolves on the classpath.
'org.hdrhistogram:HdrHistogram:2.2.2',
- // CVE-2026-47838: spring-security-web 6.5.11 is the latest
release on the 6.5.x line (a fix would
- // require the 7.0.x line, which needs Spring Boot 4 / Spring
Framework 7 and is incompatible here).
- // Remove this exclusion once a patched 6.5.x is released and
spring-boot.version is bumped.
+ // Spring Security 6.5.11 is the last open source release of the
6.5.x line: the 6.5.12 patch for the
+ // CVEs below is published to Enterprise Support customers only,
and the open source fixes are 7.0.7 and
+ // 7.1.1, which require Spring Boot 4 / Spring Framework 7 and are
incompatible with this line
+ // (spring-boot.version is 3.5.x). Remove these exclusions when
Grails moves to Spring Boot 4.
+ // CVE-2026-47838: SubjectDnX509PrincipalExtractor misreads
malformed X.509 CN values, so a crafted
+ // certificate can impersonate another user.
'org.springframework.security:spring-security-web:6.5.11',
+ // CVE-2026-59276: non-constant-time comparison of digests, token
keys and password hashes.
+ 'org.springframework.security:spring-security-core:6.5.11',
+ // CVE-2026-47842: AesBytesEncryptor encrypts deterministically,
so AES/CBC ciphertexts can be correlated.
+ 'org.springframework.security:spring-security-crypto:6.5.11',
+ // CVE-2026-41707: DPoPProofJwtDecoderFactory accepts replayed
DPoP proofs.
+ 'org.springframework.security:spring-security-oauth2-jose:6.5.11',
// CVE-2026-44241 (micronaut-context) / CVE-2026-44242
(micronaut-inject): a fix would require
// Micronaut 4.10+, which is incompatible here because it pulls
javaparser 3.28 while the
// grails-micronaut-bom pins javaparser-core to 3.27 (see
dependencies.gradle). Remove once
@@ -96,6 +104,13 @@ class VulnerabilityScanPlugin implements Plugin<Project> {
'org.springframework:spring-webmvc:6.2.19',
// CVE-2026-59280: path traversal in FreeMarker view resolution.
'org.springframework:spring-context-support:6.2.19',
+ // CVE-2026-59282: unbounded allocation from crafted property
paths, causing a denial of service.
+ 'org.springframework:spring-beans:6.2.19',
+ // CVE-2026-47885 (multipart size limit bypassed by
PartEventHttpMessageReader), CVE-2026-47889 (sameSite
+ // dropped from cookies written through
JettyCoreServerHttpResponse), CVE-2026-47891 (maxInMemorySize
+ // bypassed in Jaxb2Decoder), CVE-2026-59281 (reflected XSS when
rendering field errors) and
+ // CVE-2026-59314 (HTTP response splitting via a crafted
Content-Disposition header).
+ 'org.springframework:spring-web:6.2.19',
// CVE-2026-19880: fixed only in logback 1.6.3, and no Spring Boot
release manages the 1.6.x line
// (4.1.1 still pins 1.5.38), so adopting it would put logback two
minor lines ahead of the stack it
// integrates with. Grails ships no
SiftingAppender/MDCBasedDiscriminator configuration, so exposure is
diff --git a/dependencies.gradle b/dependencies.gradle
index d90ec677df..82c829e520 100644
--- a/dependencies.gradle
+++ b/dependencies.gradle
@@ -106,6 +106,9 @@ ext {
// for the one logback advisory this version does not clear.
'logback.version' : '1.5.38',
'jquery.version' : '3.7.1',
+ // Overrides spring-boot-dependencies (1.0.0): micrometer 1.16.x
annotates its API with JSpecify and
+ // pulls 1.0.1, so the BOM has to manage at least that - see
micrometer.version.
+ 'jspecify.version' : '1.0.1',
// Security: pulled transitively via groovy-console. 2.6.0 fixes
CVE-2026-26032, a path traversal in the
// PackagerResolver where '../' in module coordinates escapes the
configured buildRoot.
'ivy.version' : '2.6.0',
@@ -114,6 +117,10 @@ ext {
'jakarta-validation-api.version': '3.1.1',
'junit.version' : '5.13.3',
'junit-platform.version' : '1.13.3',
+ // Security: overrides spring-boot-dependencies (1.15.12). 1.16.7
is the oldest open source release that
+ // fixes CVE-2026-59295 (DoS in the Apache HttpAsyncClient
instrumentation) and CVE-2026-59296 (metric
+ // name/tag injection via unsanitised newlines); the 1.15.13 patch
is Enterprise Support only.
+ 'micrometer.version' : '1.16.7',
// Security: 5.9.2 fixes CVE-2026-18710, where
ProxySettings.toString() renders the SOCKS5 proxy
// username and password into application logs.
'mongodb.version' : '5.9.2',
@@ -197,6 +204,8 @@ ext {
// Security override of the version groovy-console pulls in - see
ivy.version
'ivy' :
"org.apache.ivy:ivy:${bomDependencyVersions['ivy.version']}",
'jquery' :
"org.webjars.npm:jquery:${bomDependencyVersions['jquery.version']}",
+ // Version override of spring-boot-dependencies - see
jspecify.version
+ 'jspecify' :
"org.jspecify:jspecify:${bomDependencyVersions['jspecify.version']}",
// Security override of spring-boot-dependencies - see
logback.version
'logback-classic' :
"ch.qos.logback:logback-classic:${bomDependencyVersions['logback.version']}",
'logback-core' :
"ch.qos.logback:logback-core:${bomDependencyVersions['logback.version']}",
@@ -219,6 +228,11 @@ ext {
'junit-platform-suite-engine' :
"org.junit.platform:junit-platform-suite-engine:${bomDependencyVersions['junit-platform.version']}",
// end - boot & spock conflict, so pin the version we want (newest)
'hibernate-groovy-proxy' :
"org.yakworks:hibernate-groovy-proxy:${bomDependencyVersions['hibernate-groovy-proxy.version']}",
+ // Security override of spring-boot-dependencies - see
micrometer.version
+ 'micrometer-commons' :
"io.micrometer:micrometer-commons:${bomDependencyVersions['micrometer.version']}",
+ 'micrometer-core' :
"io.micrometer:micrometer-core:${bomDependencyVersions['micrometer.version']}",
+ 'micrometer-jakarta9' :
"io.micrometer:micrometer-jakarta9:${bomDependencyVersions['micrometer.version']}",
+ 'micrometer-observation' :
"io.micrometer:micrometer-observation:${bomDependencyVersions['micrometer.version']}",
'mongodb-bson' :
"org.mongodb:bson:${bomDependencyVersions['mongodb.version']}",
'mongodb-driver-core' :
"org.mongodb:mongodb-driver-core:${bomDependencyVersions['mongodb.version']}",
'mongodb-driver-sync' :
"org.mongodb:mongodb-driver-sync:${bomDependencyVersions['mongodb.version']}",
diff --git a/grails-data-hibernate5/core/build.gradle
b/grails-data-hibernate5/core/build.gradle
index 73104d30f9..83f168dd9f 100644
--- a/grails-data-hibernate5/core/build.gradle
+++ b/grails-data-hibernate5/core/build.gradle
@@ -74,6 +74,8 @@ dependencies {
testImplementation 'org.yakworks:hibernate-groovy-proxy', {
// groovy proxy fixes bytebuddy to be a bit smarter when it comes to
groovy metaClass
exclude group: 'org.codehaus.groovy', module: 'groovy'
+ // exclude javax variant of hibernate-core 5.6
+ exclude group: 'org.hibernate', module: 'hibernate-core'
}
testRuntimeOnly 'org.hibernate:hibernate-ehcache', {
diff --git
a/grails-test-examples/hibernate5/grails-hibernate-groovy-proxy/build.gradle
b/grails-test-examples/hibernate5/grails-hibernate-groovy-proxy/build.gradle
index e7b213edb6..8d485ef352 100644
--- a/grails-test-examples/hibernate5/grails-hibernate-groovy-proxy/build.gradle
+++ b/grails-test-examples/hibernate5/grails-hibernate-groovy-proxy/build.gradle
@@ -35,6 +35,8 @@ dependencies {
implementation 'org.apache.grails:grails-core'
implementation 'org.yakworks:hibernate-groovy-proxy', {
exclude group: 'org.codehaus.groovy', module: 'groovy'
+ // exclude javax variant of hibernate-core 5.6
+ exclude group: 'org.hibernate', module: 'hibernate-core'
}
runtimeOnly 'com.h2database:h2'
