Merge branch '8.0.x' into feat/i18n-available-locale-selector

Author: codeconsole

dependencies.gradle

@@ -74,6 +74,7 @@ ext {
             'bootstrap-icons.version'       : '1.13.1',
             'bootstrap.version'             : '5.3.8',
             'checker-qual.version'          : '3.55.1',
+            'commons-codec.version'         : '1.22.0',
             'geb-spock.version'             : '8.0.1',
             // Pinned deliberately as a drift tripwire even though it matches Spring Boot's
             // managed version: graphql-java-extended-scalars (below) is NOT managed by Spring
@@ -88,6 +89,8 @@ ext {
             'httpcore5.version'             : '5.4.3',
             // Security: overrides the transitive com.fasterxml Jackson 2.x. 2.21.5 fixes CVE-2026-54515 flagged against 2.21.4.
             'jackson2.version'              : '2.21.5',
+            // Security: overrides spring-boot-dependencies (3.1.4). 3.1.5 fixes CVE-2026-59889 (JsonView bypass) flagged against jackson-databind.
+            'jackson3.version'              : '3.1.5',
             'jquery.version'                : '3.7.1',
             'kotlin.version'                : '2.2.21',
             'liquibase-hibernate5.version'  : '4.27.0',
@@ -132,6 +135,7 @@ ext {
             'bootstrap-icons'          : "org.webjars.npm:bootstrap-icons:${bomDependencyVersions['bootstrap-icons.version']}",
             'cas-client-core'          : "org.apereo.cas.client:cas-client-core:${bomDependencyVersions['cas-client-core.version']}",
             'checker-qual'             : "org.checkerframework:checker-qual:${bomDependencyVersions['checker-qual.version']}",
+            'commons-codec'            : "commons-codec:commons-codec:${bomDependencyVersions['commons-codec.version']}",
             'geb-spock'                : "org.apache.groovy.geb:geb-spock:${bomDependencyVersions['geb-spock.version']}",
             'graphql-java'             : "com.graphql-java:graphql-java:${bomDependencyVersions['graphql-java.version']}",
             'graphql-java-extended-scalars': "com.graphql-java:graphql-java-extended-scalars:${bomDependencyVersions['graphql-java-extended-scalars.version']}",
@@ -174,6 +178,10 @@ ext {
             // jackson-annotations is out of lockstep (no 2.21.5 release) and stays transitively managed.
             'jackson2-core'               : "com.fasterxml.jackson.core:jackson-core:${bomDependencyVersions['jackson2.version']}",
             'jackson2-databind'           : "com.fasterxml.jackson.core:jackson-databind:${bomDependencyVersions['jackson2.version']}",
+            // Security override of spring-boot-dependencies - see jackson3.version. databind 3.1.5 pins
+            // jackson-core 3.1.5 via its parent pom, so the BOM must manage core in lockstep (rule 14).
+            'jackson3-core'               : "tools.jackson.core:jackson-core:${bomDependencyVersions['jackson3.version']}",
+            'jackson3-databind'           : "tools.jackson.core:jackson-databind:${bomDependencyVersions['jackson3.version']}",
             'jquery'                   : "org.webjars.npm:jquery:${bomDependencyVersions['jquery.version']}",
             // Security override of spring-boot-dependencies - see logback.version
             'logback-classic'            : "ch.qos.logback:logback-classic:${bomDependencyVersions['logback.version']}",

grails-test-examples/spring-dependency-management/build.gradle

@@ -65,6 +65,8 @@ dependencyManagement {
 // sourcing the number from dependencies.gradle so it stays the single source of truth.
 apply from: rootProject.layout.projectDirectory.file('dependencies.gradle')
 ext['logback.version'] = bomDependencyVersions['logback.version']
+// Same situation for the Jackson 3 security override (CVE-2026-59889) - see jackson3.version in dependencies.gradle.
+ext['jackson-bom.version'] = bomDependencyVersions['jackson3.version']
 
 dependencies {
     implementation 'org.apache.grails:grails-dependencies-starter-web'