jdaugherty opened a new pull request, #16622: URL: https://github.com/apache/grails-core/pull/16622
Moves the 7.0.x build from Gradle 8.14.5 to 8.14.6, the patch release that fixes three high-severity advisories published on 2026-10-07: - [GHSA-mvvg-497x-hmj8](https://github.com/gradle/gradle/security/advisories/GHSA-mvvg-497x-hmj8): unauthenticated worker-to-daemon channel deserializes untrusted Java objects - [GHSA-xwqc-3h47-hg64](https://github.com/gradle/gradle/security/advisories/GHSA-xwqc-3h47-hg64): deserialization of untrusted Java objects before authentication in the client-daemon communication - [GHSA-j5m7-59rp-24f5](https://github.com/gradle/gradle/security/advisories/GHSA-j5m7-59rp-24f5): failure to disable repositories failing to establish an SSL connection can expose builds to malicious artifacts Release notes: https://docs.gradle.org/8.14.6/release-notes.html ### What changed - Wrappers regenerated with `gradle -p gradle-bootstrap` on 8.14.6 (root, `grails-gradle`, `grails-forge`). `build-logic` and the `grails-profiles` skeletons, which bootstrap does not reach, were refreshed from the same output, so the wrapper jar is byte-identical everywhere and matches Gradle's published `gradle-8.14.6-wrapper.jar.sha256` (`ad16bca4…`). - `gradlew` / `gradlew.bat` are unchanged, apart from bootstrap marking `grails-forge/gradlew.bat` executable like the others. - `.sdkmanrc`, `gradleToolingApiVersion` and Forge's `gradleWrapperProperties.rocker.raw` template move to 8.14.6. - The "keep this synced" header comments the Wrapper task strips from the properties files were restored. ### Verification `./gradlew --version` reports 8.14.6 and `./gradlew help` configures cleanly for the root build, `build-logic`, `grails-gradle` and `grails-forge`. Merges up to 7.1.x and 7.2.x. The 8.0.x counterpart (Gradle 9.8.1) is a separate PR. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
