jamesfredley opened a new pull request, #16043:
URL: https://github.com/apache/grails-core/pull/16043
## Description
Remediates the vulnerability findings reported by the scheduled OSS Index
scan on `7.0.x`:
- **CVE-2026-49844**: overrides Spring Boot 3.5.16's Log4j `2.24.3`
management with fixed Log4j `2.25.5` through the Grails BOM. The Log4j BOM and
the API, Core, JUL, SLF4J 2 implementation, and SLF4J bridge modules share the
`log4j2.version` property.
- **CVE-2026-8484**: documents and excludes the exact managed
`org.fusesource.jansi:jansi:1.18` coordinate from OSS Index. FuseSource Jansi
is unmaintained, every available release through `2.4.3` is affected, and no
fixed upstream release exists. The exemption includes a removal condition for a
future migration or patched release.
The Jansi coordinate is not replaced with `org.jline:jansi`: that artifact
uses different Java packages, and its native implementation is not confirmed as
a security fix for CVE-2026-8484.
## Verification
- `:grails-base-bom:generatePomFileForMavenPublication` succeeds.
- `:grails-bom:generatePomFileForMavenPublication` succeeds.
- Both generated BOMs manage the five Log4j modules through
`${log4j2.version}` with value `2.25.5`; `grails-base-bom` imports `log4j-bom`
through the same property.
- `git diff --check` passes.
- The aggregate `validateDependencyVersions` reaches dependency validation
but reports the pre-existing `biz.aQute.bnd:biz.aQute.bnd.annotation` drift
(`7.1.0` resolved vs `7.0.0` managed) in unrelated modules.
No user-facing API changes or documentation updates are needed for this
dependency/security-scan configuration change.
> Generative AI tooling was used to assist with scan-log analysis, CVE
research, dependency resolution verification, and PR preparation. The resulting
changes were reviewed and verified by the submitter.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
