jamesfredley opened a new pull request, #16045: URL: https://github.com/apache/grails-core/pull/16045
## Description Follow-up to merged PR #16043. That PR correctly upgraded Log4j to `2.25.5`, but its CI run exposed two publication issues that this change resolves: - Log4j `2.25.5` transitively selects `biz.aQute.bnd.annotation:7.1.0`, while Spring Boot 3.5.16 manages `7.0.0`. The shared Grails BOM maps now manage the winning `7.1.0` version, fixing `Validate Dependency Versions`. - Log4j management now lives in the shared Gradle BOM maps and every published BOM imports `log4j-bom` before inherited platforms. This prevents Maven's first-import-wins behavior and Gradle `enforcedPlatform` variants from leaving non-explicit Log4j modules at Spring Boot's older `2.24.3` version. The affected publications are: - `grails-gradle-bom` - `grails-base-bom` - `grails-bom` - `grails-hibernate5-bom` - `grails-micronaut-bom` ## Verification - Root POM generation plus all dependency validators: **216 tasks successful**. - Grails Gradle POM generation plus all dependency validators: **11 tasks successful**. - Generated Gradle, base, Hibernate 5, and Micronaut POMs import `log4j-bom` before Spring Boot/Grails/Micronaut inherited platforms. - A temporary real Gradle consumer imported each of the five published BOM POMs and resolved the non-explicit `org.apache.logging.log4j:log4j-layout-template-json` module to **2.25.5** in every case. - `git diff --check` passes. > Generative AI tooling was used to assist with dependency analysis, generated-POM verification, consumer resolution testing, review, and PR preparation. The resulting changes were reviewed and verified by the submitter. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
