jdaugherty commented on code in PR #16077:
URL: https://github.com/apache/grails-core/pull/16077#discussion_r3699732771
##########
end-to-end/spring-dependency-management/build.gradle:
##########
@@ -63,7 +69,7 @@ dependencyManagement {
// the grails-bom import, so the security-patched logback isn't applied
automatically. A migrated Grails 7
// app hitting the same CVE would override the Spring-managed version property
directly; reproduce that here,
// sourcing the number from dependencies.gradle so it stays the single source
of truth.
-apply from: rootProject.layout.projectDirectory.file('dependencies.gradle')
+apply from: rootProject.layout.projectDirectory.file('../dependencies.gradle')
ext['logback.version'] = bomDependencyVersions['logback.version']
// Same situation for the Jackson 3 security override (CVE-2026-59889) - see
jackson3.version in dependencies.gradle.
ext['jackson-bom.version'] = bomDependencyVersions['jackson3.version']
Review Comment:
This is the downside of the spring dm plugin. The purpose of this is to
document compatibility and not try to revisit all of the problems with spring
dm so I'm going to forego this.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
