jamesfredley opened a new pull request, #16560: URL: https://github.com/apache/grails-core/pull/16560
Spring Boot 4.1.2 is not due until 2026-10-22 ([milestone 432](https://github.com/spring-projects/spring-boot/milestone/432)). These are the already-merged upgrades that Grails apps actually resolve. Each one stays on the line Boot is already moving to. None is a new major. Remove the ahead-of-Boot pins once `spring-boot.version` is 4.1.2 or newer. `validateBomProperties` rejects a pin that repeats the parent version. `graphql-java` is the exception: that pin stays, so a later Boot bump still forces an extended-scalars check. ## Taken because Spring Boot 4.1.2 has already merged them | Coordinate | Was | Now | Why this is safe | |---|---|---|---| | graphql-java | 25.0 | 25.1 | Boot 4.1.2. graphql-java uses major.minor, and the second number is the bug-fix line. extended-scalars stays at 24.0, the latest stable release. | | slf4j | 2.0.19 | 2.0.20 | Boot 4.1.2. Logback 1.6.5 already requires 2.0.19, so this is the next patch on that line. | | byte-buddy | 1.18.11 (Boot 4.1.1) | 1.18.14 | Boot 4.1.2 patch. Agent is pinned with it. | | hibernate-validator | 9.1.3.Final (Boot 4.1.1) | 9.1.4.Final | Boot 4.1.2 patch. Annotation processor is pinned with it. | | httpcore5 | 5.4.3 (Boot 4.1.1) | 5.4.4 | Boot 4.1.2 patch. h2 and reactive modules are pinned with it. | | postgresql | 42.7.13 (Boot 4.1.1) | 42.7.14 | Boot 4.1.2 patch on the 42.7 line. | | hibernate-core (Hibernate 7 BOM only) | 7.4.10.Final | 7.4.12.Final | Boot 4.1.2, still on 7.4. 7.4.12 declares hibernate-models 1.1.2, so that pin is not moved to 1.3.x. | ## Taken because Grails owns the line | Coordinate | Was | Now | Why | |---|---|---|---| | springdoc-openapi | 3.1.0 | 3.1.1 | Patch. Not managed by Boot. | | swagger | 2.2.52 | 2.2.55 | The version springdoc 3.1.1 resolves. Same lockstep as before. | | undertow-core | 2.4.3.Final | 2.4.4.Final | Patch. Boot dropped Undertow, so Grails owns this line. | | undertow-servlet / websockets | 2.0.2.Final | 2.0.3.Final | Matching patch of the EE artifacts that target core 2.4.4. | ## Not taken - Maven 3.10.0. Boot 4.1.2 is moving there, but 3.10.0 removes `MavenRepositorySystemUtils.newServiceLocator()`, which the shell CLI still calls, and it pulls Resolver 2 beside our Resolver 1.9.27. - MongoDB 5.13.0. That is a real minor, with no CVE, and Boot 4.1.2 is not taking it. The 5.12.0 security override stays. - Spock 2.5. Released 2026-10-06. Cleanup interactions stay active and can fail tests that previously passed. - Liquibase 4.33.0 and 5.0.4. `liquibase-hibernate5` stops at 4.27.0. Liquibase 5 is a new major. - Jackson 2.22.3 and 3.2.3. Already newer than Boot 4.1.2 (2.21.7 and 3.1.7). - Netty 4.2.19.Final. Boot only imports `netty-bom`. A second import does not reliably override it, and pinning every module is not worth two weeks. - Optional Boot stacks (Kafka, Jetty, jOOQ, Elasticsearch, R2DBC, Pulsar, ActiveMQ, Jaybird, SQLite, Jersey, FreeMarker) and the Spring snapshot trains on the milestone. `validateBomProperties` passed for `:grails-base-bom`, `:grails-bom`, `:grails-hibernate5-bom`, `:grails-hibernate7-bom`, and `:grails-neo4j-bom`. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
