jdaugherty opened a new pull request, #16530:
URL: https://github.com/apache/grails-core/pull/16530
Replaces the archived Sonatype `scan-gradle-plugin` (`ossIndexAudit`) with
our own `vulnerabilityScan` task in `build-logic/vulnerability-scan`, so the
scan no longer depends on a plugin Sonatype has moved into its commercial
offering. This backports the scanner from #16528, where it also had to replace
the old plugin because that plugin cannot be stored in the configuration cache.
## How it works
- `vulnerabilityScan` looks the resolved `runtimeClasspath` and
`compileClasspath` of each project up in two databases:
- [OSV](https://osv.dev), which needs no credentials.
- Sonatype Guide, through the same component report API the old plugin
used, when `SONATYPE_GUIDE_USERNAME` and `SONATYPE_GUIDE_TOKEN` are set.
- Each database knows of vulnerabilities the other doesn't yet:
- Sonatype flags CVEs that GitHub hasn't reviewed yet, and OSV can't match
those to Maven artifacts until it does.
- OSV has reviewed advisories Sonatype misses, for example three critical
Tomcat CVEs.
- A vulnerability both know of, by ID or alias, is reported once and lists
both sources.
- The credentials are read only when the scan runs.
- Both sources' answers are cached for an hour in the Gradle user home
(`vulnerabilityScan.cacheTtl`), so repeated scans don't spend Sonatype Guide
credits or hit rate limits.
- `vulnerabilityScanReport` on the root project writes
`build/reports/vulnerability-scan/summary.md`. It lists:
- each vulnerable dependency, with the projects and the dependency path
that bring it in;
- the fixed versions, and which database found each vulnerability;
- the excluded vulnerabilities;
- exclusions that no longer match anything. This list only appears when
every database was consulted.
- The workflow publishes that summary instead of parsing the `--info` log of
`ossIndexAudit`.
- The workflow no longer uses `pull_request_target`. A pull request from a
fork gets no secrets, so it is scanned against OSV only, and the summary says
Sonatype Guide wasn't consulted.
## Exclusions
An exclusion now names a vulnerability ID or alias plus a `group:artifact`,
instead of a whole `group:artifact:version`. A version bump no longer orphans
it, and each exclusion needs a reason.
The old plugin's 15 coordinate exclusions become 27 per-CVE entries. Each
keeps its original reason:
- Spring Framework 6.2 / Spring Security 6.5, whose fixes are Enterprise
Support only
- Micronaut 4.9
- jansi
- h2
- HdrHistogram
- logback
Excluding whole coordinates also hid CVEs the old comments didn't list.
Spring's advisories show the 6.x fixes for those are Enterprise Support only
too, so they are excluded under the same reasons:
- spring-security-web CVE-2026-47841 (WebAuthn) and CVE-2026-59276
- spring-web CVE-2026-47883 (Sonatype now reports it against spring-web
rather than spring-webmvc)
Two HdrHistogram CVEs (14684, 14685) are dropped: Sonatype Guide no longer
reports them.
## Verification
- The 21 new specs pass on this branch's toolchain (Gradle 8.14.5, Groovy
3), on both JDK 17 and JDK 21. They cover batching, paging, retries on
throttling, the disk cache and its expiry, credentials and their errors,
merging the two databases, exclusions, the summary, and configuration-cache
reuse.
- `rat` passes.
- A scan of the whole root build against both databases ran across 155
projects. The first run took 385 Sonatype Guide lookups, costing 25 credits;
the rerun was answered from the cache. All 27 exclusions match a current
finding.
## Findings that remain
None of these were excluded before, so the scan fails on them as it should:
| Dependency | Vulnerabilities | Fix |
| --- | --- | --- |
| `tomcat-embed-core` 10.1.55 | CVE-2026-65905, CVE-2026-65182,
CVE-2026-68525 (critical), CVE-2026-65927 | 10.1.58 |
| `pac4j-core` 6.4.3 | CVE-2026-82463, CVE-2026-82464 | 6.5.6 |
| `mongodb-driver-core` / `mongodb-driver-sync` 5.9.2 | CVE-2026-88033 | not
yet reviewed upstream |
| `LatencyUtils` 2.0.3 | CVE-2026-82596 (low) | no release to upgrade to |
Upgrades for these belong in separate dependency changes.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
