Copilot commented on code in PR #16044:
URL: https://github.com/apache/grails-core/pull/16044#discussion_r3634605538
##########
build-logic/plugins/src/main/groovy/org/apache/grails/buildsrc/VulnerabilityScanPlugin.groovy:
##########
@@ -78,6 +78,11 @@ class VulnerabilityScanPlugin implements Plugin<Project> {
// latest release; no patched version exists upstream yet. Remove
once a fixed release ships and
// spring-boot.version is bumped.
'org.springframework.security:spring-security-web:7.1.0',
+ // CVE-2026-8484: org.fusesource.jansi is unmaintained; all
versions through 2.4.3 are flagged and no
+ // fixed release exists upstream. Grails still uses the fusesource
coordinate for ANSI console output
+ // (package org.fusesource.jansi). Remove once consumers migrate
off fusesource jansi or a patched
+ // release ships.
+ 'org.fusesource.jansi:jansi:2.4.2',
Review Comment:
The Jansi exemption is limited to `org.fusesource.jansi:jansi:2.4.2`, but
this repo also pins `jansiVersion=2.4.1` (e.g.,
`grails-data-neo4j/gradle.properties`). If `ossIndexAudit` runs for modules
resolving 2.4.1, the scan can still fail with CVE-2026-8484 findings despite
the intended exemption. Consider exempting the other pinned version as well (or
aligning all projects to the same managed Jansi version).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
