jamesfredley opened a new pull request, #16044:
URL: https://github.com/apache/grails-core/pull/16044
## Description
Remediates the vulnerability findings relevant to `8.0.x`:
- **CVE-2026-49844**: overrides Spring Boot 4.1.0's Log4j `2.25.4`
management with fixed Log4j `2.25.5`. `grails-gradle-bom` and `grails-base-bom`
import the Log4j BOM before Spring Boot so Maven's first-import-wins behavior
aligns the full Log4j family. All three published Grails BOMs directly manage
the API, Core, JUL, SLF4J 2 implementation, and SLF4J bridge modules through
the shared `log4j2.version` property.
- **CVE-2026-8484**: documents and excludes the exact managed
`org.fusesource.jansi:jansi:2.4.2` coordinate from OSS Index. FuseSource Jansi
is unmaintained, every available release through `2.4.3` is affected, and no
fixed upstream release exists. The exemption includes a removal condition for a
future migration or patched release.
The Jansi coordinate is not replaced with `org.jline:jansi`: that artifact
uses different Java packages, and its native implementation is not confirmed as
a security fix for CVE-2026-8484.
## Verification
- Root `validateDependencyVersions`: **253 tasks successful**.
- Grails Gradle `validateDependencyVersions`: **11 tasks successful**.
- `grails-gradle-bom`, `grails-base-bom`, and `grails-bom` generated POMs
manage the five Log4j modules through `${log4j2.version}` with value `2.25.5`.
- `grails-gradle-bom` and `grails-base-bom` import `log4j-bom` before Spring
Boot through the same property.
- `git diff --check` passes.
No user-facing API changes or documentation updates are needed for this
dependency/security-scan configuration change.
> Generative AI tooling was used to assist with scan-log analysis, CVE
research, dependency resolution verification, and PR preparation. The resulting
changes were reviewed and verified by the submitter.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
