jamesfredley opened a new pull request, #15809: URL: https://github.com/apache/grails-core/pull/15809
## Summary - reject non-HTTPS remote Grails wrapper repository URLs before metadata or artifact downloads - validate each redirect target and reject redirects that downgrade to HTTP - document that local filesystem repositories remain supported while remote repositories must use HTTPS ## Verification - `./gradlew.bat --no-daemon --no-parallel --max-workers=1 :grails-wrapper:check` - Review gate: Oracle GREEN, Codex GREEN ## Notes - Follow-up from audit `FINDING-005`. - Full aggregate verification was attempted locally, but Docker/Testcontainers is unavailable on this machine and the run hit unrelated GSP example integration failures that require Docker. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
