Update Log4j to 2.25.5 and document unfixed Jansi CVE

[jamesfredley]

Description

Remediates the vulnerability findings reported by the scheduled OSS Index scan on 7.0.x:

• CVE-2026-49844: overrides Spring Boot 3.5.16's Log4j 2.24.3 management with fixed Log4j 2.25.5. grails-gradle-bom and grails-base-bom import the Log4j BOM, and all three published Grails BOMs directly manage the API, Core, JUL, SLF4J 2 implementation, and SLF4J bridge modules through the shared log4j2.version property.
• CVE-2026-8484: documents and excludes the exact managed org.fusesource.jansi:jansi:1.18 coordinate from OSS Index. FuseSource Jansi is unmaintained, every available release through 2.4.3 is affected, and no fixed upstream release exists. The exemption includes a removal condition for a future migration or patched release.

The Log4j upgrade also brings biz.aQute.bnd.annotation:7.1.0; the shared BOM maps now manage that winning version instead of Spring Boot's older 7.0.0, fixing the dependency-version validation failure from the initial PR run.

The Jansi coordinate is not replaced with org.jline:jansi: that artifact uses different Java packages, and its native implementation is not confirmed as a security fix for CVE-2026-8484.

Verification

• Root validateDependencyVersions: 214 tasks successful.
• Grails Gradle validateDependencyVersions: 11 tasks successful.
• grails-gradle-bom, grails-base-bom, and grails-bom generated POMs manage Bnd 7.1.0 and the five Log4j modules through shared properties.
• grails-gradle-bom and grails-base-bom import log4j-bom through ${log4j2.version} with value 2.25.5.
• git diff --check passes.

No user-facing API changes or documentation updates are needed for this dependency/security-scan configuration change.

Generative AI tooling was used to assist with scan-log analysis, CVE research, dependency resolution verification, and PR preparation. The resulting changes were reviewed and verified by the submitter.

[Copilot]

Pull request overview

Updates Grails’ dependency management and vulnerability-scan configuration to address a newly reported Log4j vulnerability and to document/exempt an unfixed Jansi CVE in Sonatype OSS Index scanning. This fits into the codebase’s BOM-driven dependency governance and the existing build-logic conventions for vulnerability scanning.

Changes:

• Override Spring Boot-managed Log4j from 2.24.3 to 2.25.5 via the Grails BOM, including importing log4j-bom and managing key Log4j modules through the shared log4j2.version property.
• Add a documented OSS Index exclusion for org.fusesource.jansi:jansi:1.18 due to a CVE with no fixed upstream release.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
dependencies.gradle	Adds log4j2.version and wires Log4j BOM + module constraints to ensure Grails BOM manages Log4j at 2.25.5.
build-logic/plugins/src/main/groovy/org/apache/grails/buildsrc/VulnerabilityScanPlugin.groovy	Documents and excludes the specific Jansi coordinate from OSS Index scans due to no available upstream fix.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[testlens-app]

🚨 TestLens detected 2 failed tests 🚨

Here is what you can do:

1. Inspect the test failures carefully.
2. If you are convinced that some of the tests are flaky, you can mute them below.
3. Finally, trigger a rerun by checking the rerun checkbox.

Test Summary

CI - Groovy Joint Validation Build / build_grails > :grails-test-examples-app1:integrationTest

Test	Runs	Flakiness
AsyncPromiseSpec > async service processes string input	❌	1% 🟡

CI - Groovy Joint Validation Build / build_grails > :grails-test-examples-scaffolding:integrationTest

Test	Runs	Flakiness
UserControllerSpec > User list	❌	3% 🟡

🏷️ Commit: 23c2c58
▶️ Tests: 47564 executed
⚪️ Checks: 52/52 completed

Test Failures

AsyncPromiseSpec > async service processes string input (:grails-test-examples-app1:integrationTest in CI - Groovy Joint Validation Build / build_grails)

java.net.http.HttpTimeoutException: request timed out
	at java.net.http/jdk.internal.net.http.HttpClientImpl.send(HttpClientImpl.java:898)
	at java.net.http/jdk.internal.net.http.HttpClientFacade.send(HttpClientFacade.java:133)
	at org.apache.grails.testing.http.client.HttpClientSupport$Trait$Helper.send(HttpClientSupport.groovy:1113)
	at org.apache.grails.testing.http.client.HttpClientSupport$Trait$Helper.send(HttpClientSupport.groovy:1102)
	at org.apache.grails.testing.http.client.HttpClientSupport$Trait$Helper.http(HttpClientSupport.groovy:202)
	at org.apache.grails.testing.http.client.HttpClientSupport$Trait$Helper.http(HttpClientSupport.groovy:168)
	at functionaltests.async.AsyncPromiseSpec.async service processes string input(AsyncPromiseSpec.groovy:138)

UserControllerSpec > User list (:grails-test-examples-scaffolding:integrationTest in CI - Groovy Joint Validation Build / build_grails)

geb.waiting.WaitTimeoutException: condition did not pass in 30 seconds (failed with exception)
	at geb.waiting.Wait.waitFor(Wait.groovy:128)
	at geb.waiting.DefaultWaitingSupport.doWaitFor(DefaultWaitingSupport.groovy:55)
	at geb.waiting.DefaultWaitingSupport.waitFor(DefaultWaitingSupport.groovy:41)
	at geb.Page.waitFor(Page.groovy:120)
	at com.example.pages.LoginPage.login(LoginPage.groovy:39)
	at com.example.UserControllerSpec.User list(UserControllerSpec.groovy:48)
Caused by: Assertion failed: 

title && title != pageTitle
|     |  |     |  |
|     |  |     |  'Please sign in'
|     |  |     false
|     |  'Please sign in'
|     false
'Please sign in'

	at com.example.pages.LoginPage.login_closure1(LoginPage.groovy:39)
	at com.example.pages.LoginPage.login_closure1(LoginPage.groovy)
	at geb.waiting.Wait.waitFor(Wait.groovy:117)
	... 5 more

Muted Tests

Select tests to mute in this pull request:

• AsyncPromiseSpec > async service processes string input
• UserControllerSpec > User list

Reuse successful test results:

• ♻️ Only rerun the tests that failed or were muted before

Click the checkbox to trigger a rerun:

• Rerun jobs

---

Learn more about TestLens at testlens.app.

[borinquenkid]

This is just dependency and only flaky tests failed