We meet every week via a google meeting. The times alternate each week to encourage attendance from multiple time zones. Each week we will provide a summary here to facilitate historical preservation & further discussion. If you would like to join this meeting, you can do so here: https://meet.google.com/her-tjpt-xmf
cache-issue - https://github.com/apache/grails-core/pull/15935 - artifacts continue to timeout/not resolve from repo.grails.org; should we switch to maven central? we will get throttled if caching is not working - since switching away from the commercial gradle caching, we’ve had issues pulling too much from repositories - discussed switching back to the commercial version. Paul had an AI Summary that captures why people switched from the commercial offering: # -------------------------------------------------------------------------------- AI summary: The v6 update to the official Gradle GitHub Action caused controversy because Gradle extracted the caching component into a closed-source, proprietary library (gradle-actions-caching). Users objected to the sudden license transition, overly broad terms of service in the new license, and the lack of community consultation. [1, 2] The primary community concerns include: Closed-Source Component: The functionality in the setup-gradle action that saves and restores the Gradle User Home state transitioned from permissive open-source (MIT) to a proprietary license. [1] Overly Broad Terms: The initial Terms of Use were criticized for language that users feared allowed Gradle to claim ownership of—or exploit—their cached data and submissions. [1] Implicit Opt-In & Trust: Because the caching feature is enabled by default, users were automatically bound to the new terms if they upgraded, triggering trust issues and prompting some to migrate to custom setups using standard actions/cache. [1, 3] Logging Clutter: The update introduced a license notice printed directly into CI job logs and summaries, though Gradle later provided ways to mute it. [1] In response to the backlash, Gradle updated their Gradle Technologies Terms of Use to include a "Safe Harbor" clause explicitly stating they claim no ownership of your cache entries or their contents. They also clarified that basic caching will always remain a free alternative # -------------------------------------------------------------------------------- - the PR fixes the gradle cache (several gigs were being added by the groovy workflow, so we effectively were never caching because we ran out of space) - we decided to test the PR change and then revisit the decision. Likely going with the commercial option if we can't have an acceptable solution. .id & .getId() should not unwrap proxies - https://github.com/apache/grails-core/pull/15841 - PR eliminates the need for org.yakworks:hibernate-groovy-proxy library - regression in toString() involving proxies for hibernate7 was identified, now opt-in - agreement to move forward with PR We need to create our hackathon page for community over code - example PR: https://github.com/apache/comdev-events-site/pull/30/files - Paul suggested a combined groovy /grails session. - Paul to make a pass at creating an initial page Flaky tests - several passes made at waitFor { } where there was not a wait on the previous command - some security tests were only fixed in the 8.x so they were not backported, which left 7.x more flaky - James D back ported the changes; can iterate on reviews. Goal was to fix the build flakiness immediately - Dashboard: https://github.com/apache/grails-core/issues/15938 - Tool to help diagnosis: https://github.com/apache/grails-core/pull/15937 - sitemesh2 seems to expose a hang condition in security tests (:grails-test-examples-spring-security-ui-extended:check) - was due to Dumbster (mock smtp server), switched to greenmail spring security / mail / redis are merged - repos updated to reflect tehy were merged into 7.x code line - code merged all the way through 8.x - plugins required updates to support Groovy 5 - back ported most test flakiness changes from 8.x to 7.x to help build stability - `@Delegate` issue was found in Groovy: https://github.com/apache/groovy/pull/2670 vulnerability scanning - merged PR, updated dependencies due to vulnerabilities across all 7.x & 8.x branches - scan will need reviewed, but runs weekly - we will review in weekly meeting going forward - note: hibernate-core exemption needs looked at since it shouldn't be on the classpath next round of releases - 7.x - all 7.x branches have the merged plugins + updated dependencies that have known CVEs - 8.x - major changes include groovy 5 , merged plugins, updated dependencies, micronaut platform update, asset pipeline - Note: plexus-utils was split into 2 packages, this looks binary compatible so we've accepted the split all the way back to 7.x bindData - PR https://github.com/apache/grails-core/pull/15808 - Proposal to introduce best practices for data binding - we discussed the naming of "secureBindData" and the objections previously raised - we discussed how bindData can violate best secure coding practices - Mass Assignment Attacks & Stale Data Attacks - the concern being raised is how easy the default can be used to be insecure - decision to split the PR into 2 PRs - first targeting the mass assignment attack and second the stale data attack. - needs further design on the second part EnableWebMvc removal - Grails applications used to inject annotation which has side effect behavior - Was removed on accident via merge of https://github.com/apache/grails-core/pull/15916 - https://github.com/apache/grails-core/pull/13863 will clean up the differences - James D to follow-up with tests showing side effects and work with Scott bean dsl & bean registration * several PRs have been opened related to bean dsls (issue https://github.com/apache/grails-core/issues/14915) * https://github.com/apache/grails-core/pull/15824 - we are unsure what this PR was trying to do - originally we agreed to remove the bean dsl longer term - instead, we think we want it to convert the bean dsl to use the bean registrar but more work needs done (needs a volunteer) * https://github.com/apache/grails-core/pull/15934 - moves the bean registration up in the life cycle - this allows us to fully use the ConditionalOnBeans Plugin method based doWithSpring - PR https://github.com/apache/grails-core/pull/15939 - needs reviewers Light Dark Theme - https://github.com/apache/grails-core/pull/15941 - has issues with the plugin section, will revisit after revise Localization - https://github.com/apache/grails-core/pull/15940 - narrowing locales to actual translated values Regex timeout facility in Groovy - https://github.com/apache/groovy/pull/2668 - GROOVY-12122: Provide a Regex timeout facility - feedback needed CLI dependencies on runtime classpath - https://github.com/apache/grails-core/issues/15377 - discussed actually performing the split instead of a one off work around in the db migration plugin - James D to proceed with split More work from Fable 5 and ASF Security reviews from James Fredley, James is travelling - https://app.slack.com/client/T07LCCCSU/G07LE2X60 - several PRs were started with AI but need finishes - proposal to label these PRs since they’re started, but need more work and original author doesn’t have time to finish
