jdaugherty opened a new pull request, #16623: URL: https://github.com/apache/grails-core/pull/16623
Moves the 8.0.x build from Gradle 9.8.0 to 9.8.1, the patch release that fixes three high-severity advisories published on 2026-10-07: - [GHSA-mvvg-497x-hmj8](https://github.com/gradle/gradle/security/advisories/GHSA-mvvg-497x-hmj8): unauthenticated worker-to-daemon channel deserializes untrusted Java objects - [GHSA-xwqc-3h47-hg64](https://github.com/gradle/gradle/security/advisories/GHSA-xwqc-3h47-hg64): deserialization of untrusted Java objects before authentication in the client-daemon communication - [GHSA-j5m7-59rp-24f5](https://github.com/gradle/gradle/security/advisories/GHSA-j5m7-59rp-24f5): failure to disable repositories failing to establish an SSL connection can expose builds to malicious artifacts Release notes: https://docs.gradle.org/9.8.1/release-notes.html ### What changed - Wrappers regenerated with `gradle -p gradle-bootstrap` on 9.8.1 (root, `grails-gradle`, `grails-forge`, `end-to-end`). `build-logic`, the `grails-profiles` skeletons and the `grails-shell-cli` gradle-sample fixture, which bootstrap does not reach, were refreshed from the same output, so the wrapper jar is byte-identical everywhere and matches Gradle's published `gradle-9.8.1-wrapper.jar.sha256` (`3b8a2577…`). `gradlew` / `gradlew.bat` are unchanged. - `end-to-end/legacy-g7-command-plugin` follows Grails 7 and moves from 8.14.5 to 8.14.6 (the matching 7.0.x fix, apache/grails-core#16622); bootstrap's `legacyG7Wrapper` regenerated it from the fixture's own `.sdkmanrc`. - `.sdkmanrc`, `gradleToolingApiVersion`, Forge's `gradleWrapperProperties.rocker.raw` template, the `gradle-developer` and `grails-8-upgrade` skills and the end-to-end README move to the new versions. - The "keep this synced" header comments the Wrapper task strips from the properties files were restored. ### Verification `./gradlew --version` reports 9.8.1 and `./gradlew help` configures cleanly for the root build, `build-logic`, `grails-gradle`, `grails-forge` and `end-to-end`; the legacy Grails 7 fixture reports 8.14.6. Merges up to 8.1.x and 9.0.x. The 7.0.x counterpart (Gradle 8.14.6) is apache/grails-core#16622. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
