Migrate from unmaintained fusesource Jansi to the maintained org.jline fork by borinquenkid · Pull Request #16079 · apache/grails-core

borinquenkid · 2026-08-02T03:21:27Z

Summary

org.fusesource.jansi is unmaintained and flagged by CVE-2026-8484 with no fixed release. The JLine project maintains the fork and publishes it as org.jline:jansi (repackaged under org.jline.jansi), which Groovy 5 already uses for groovysh — its groovy-groovysh POM depends on org.jline:jansi:3.30.9 and explicitly excludes the fusesource coordinate. This PR adopts the fork per @jdaugherty's review comment on #16044, removing the last reason this repo's own builds resolve the vulnerable coordinate.

Changes

BOM: jansi now maps to org.jline:jansi:3.30.9 in dependencies.gradle; jline.version bumped 3.30.6 → 3.30.9 to match Groovy 5.0.7's transitives, with the two documented to stay in lockstep
Imports: org.fusesource.jansi → org.jline.jansi in GrailsConsole, AnsiConsoleUrlMappingsRenderer, forge's InteractiveShell, and their specs; CreateAppCommandSpec uses the Ansi.DISABLE constant instead of the old hardcoded property name
Generated apps: the base profile, forge's Scaffolding feature (+ spec), and the user guide dependency listing all emit org.jline:jansi
Version alignment: stray jansiVersion pins in grails-forge (2.4.2) and grails-data-neo4j (2.4.1) both moved to 3.30.9
SBOM/scan tooling: license mapping updated to org.jline:jline@3.30.9 (CycloneDX misreads JLine's license name as BSD-4-Clause); the ossIndexAudit exemption for org.fusesource.jansi:jansi:1.18 remains because previously published Grails 6/7 artifacts still pull it transitively on some scanned classpaths — its comment now records that removal condition

Relationship to #16044

This supersedes only the Jansi-exemption hunk of #16044 (org.fusesource.jansi:jansi:2.4.2 no longer resolves anywhere in this build, so there is no finding to exempt). The Log4j BOM changes in that PR are unaffected and still needed.

Verification

Tests pass for grails-bootstrap, grails-web-url-mappings, grails-shell-cli; full grails-console build green
grails-forge build green, including ScaffoldingSpec and the CLI compile
codeStyle passes across the repo

🤖 Generated with Claude Code

…e fork org.fusesource.jansi is unmaintained and flagged by CVE-2026-8484 with no fixed release. The JLine project maintains the fork and publishes it as org.jline:jansi (repackaged under org.jline.jansi), which Groovy 5 already uses for groovysh. - Manage org.jline:jansi:3.30.9 in dependencies.gradle and bump jline.version to 3.30.9 to match Groovy 5.0.7's transitives - Rename org.fusesource.jansi imports to org.jline.jansi in GrailsConsole, AnsiConsoleUrlMappingsRenderer, forge InteractiveShell, and their specs; CreateAppCommandSpec now uses the Ansi.DISABLE constant - Switch the coordinate in all build files, the base profile, the forge Scaffolding feature, and the user guide so generated apps get the fork - Align jansiVersion in grails-forge (2.4.2) and grails-data-neo4j (2.4.1) - Update the SBOM license mapping to org.jline:jline@3.30.9 and note the remaining ossIndexAudit exemption now only covers fusesource jansi pulled transitively by previously published Grails 6/7 artifacts Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Copilot

Pull request overview

Migrates Grails’ ANSI console support and related build/test/doc wiring from the unmaintained org.fusesource.jansi artifact to the maintained JLine fork org.jline:jansi, aligning versions with Groovy 5’s groovysh transitives and reducing exposure to the reported CVE affecting FuseSource Jansi.

Changes:

Updates the BOM to map jansi to org.jline:jansi:3.30.9 and aligns jline.version to 3.30.9.
Replaces org.fusesource.jansi.* imports/usages with org.jline.jansi.* across console-related code and tests (and uses Ansi.DISABLE where appropriate).
Updates generated app templates, example apps, docs, and SBOM/vulnerability-scan tooling to reflect the new coordinate and aligned JLine versions.

Reviewed changes

Copilot reviewed 56 out of 56 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
grails-web-url-mappings/src/main/groovy/org/grails/web/mapping/reporting/AnsiConsoleUrlMappingsRenderer.groovy	Switches imports/static imports to `org.jline.jansi`
grails-web-url-mappings/build.gradle	Replaces `org.fusesource.jansi:jansi` deps with `org.jline:jansi`
grails-test-examples/undertow/build.gradle	Updates runtime Jansi coordinate to `org.jline:jansi`
grails-test-examples/spring-security/ui/simple/build.gradle	Updates runtime Jansi coordinate to `org.jline:jansi`
grails-test-examples/spring-security/ui/extended/build.gradle	Updates runtime Jansi coordinate to `org.jline:jansi`
grails-test-examples/spring-security/ldap/retrieve-group-roles/build.gradle	Updates runtime Jansi coordinate to `org.jline:jansi`
grails-test-examples/spring-security/ldap/retrieve-db-roles/build.gradle	Updates runtime Jansi coordinate to `org.jline:jansi`
grails-test-examples/spring-security/ldap/functional-test-app/build.gradle	Updates runtime Jansi coordinate to `org.jline:jansi`
grails-test-examples/spring-security/ldap/custom-user-details-context-mapper/build.gradle	Updates runtime Jansi coordinate to `org.jline:jansi`
grails-test-examples/spring-security/cas/test1/build.gradle	Updates runtime Jansi coordinate to `org.jline:jansi`
grails-test-examples/spring-security/acl/functional-test-app/build.gradle	Updates runtime Jansi coordinate to `org.jline:jansi`
grails-test-examples/scaffolding/build.gradle	Updates runtime Jansi coordinate to `org.jline:jansi`
grails-test-examples/redis/build.gradle	Updates runtime Jansi coordinate to `org.jline:jansi`
grails-test-examples/mongodb/hibernate5/build.gradle	Updates runtime Jansi coordinate to `org.jline:jansi`
grails-test-examples/mongodb/database-per-tenant/build.gradle	Updates runtime Jansi coordinate to `org.jline:jansi`
grails-test-examples/mongodb/base/build.gradle	Updates runtime Jansi coordinate to `org.jline:jansi`
grails-test-examples/mail/build.gradle	Updates runtime Jansi coordinate to `org.jline:jansi`
grails-test-examples/jetty/build.gradle	Updates runtime Jansi coordinate to `org.jline:jansi`
grails-test-examples/hibernate7/async-events-pubsub-demo/build.gradle	Updates runtime Jansi coordinate to `org.jline:jansi`
grails-test-examples/gsp-sitemesh3/build.gradle	Updates runtime Jansi coordinate to `org.jline:jansi`
grails-test-examples/gsp-layout/build.gradle	Updates runtime Jansi coordinate to `org.jline:jansi`
grails-test-examples/geb/build.gradle	Updates runtime Jansi coordinate to `org.jline:jansi`
grails-test-examples/geb-gebconfig/build.gradle	Updates runtime Jansi coordinate to `org.jline:jansi`
grails-test-examples/geb-context-path/build.gradle	Updates runtime Jansi coordinate to `org.jline:jansi`
grails-test-examples/external-configuration/build.gradle	Updates runtime Jansi coordinate to `org.jline:jansi`
grails-test-examples/cache/build.gradle	Updates runtime Jansi coordinate to `org.jline:jansi`
grails-test-examples/async-events-pubsub-demo/build.gradle	Updates runtime Jansi coordinate to `org.jline:jansi`
grails-test-core/build.gradle	Switches API dependency from FuseSource Jansi to JLine Jansi
grails-spring-security/plugin/build.gradle	Switches CLI/compileOnly Jansi dependency to `org.jline:jansi`
grails-spring-security/oauth2/plugin/build.gradle	Switches CLI/compileOnly Jansi dependency to `org.jline:jansi`
grails-shell-cli/src/test/groovy/org/grails/cli/profile/commands/CreateAppCommandSpec.groovy	Uses `org.jline.jansi.Ansi` and `Ansi.DISABLE`
grails-shell-cli/build.gradle	Switches API dependency to `org.jline:jansi`
grails-scaffolding/build.gradle	Switches CLI/compileOnly dependency to `org.jline:jansi`
grails-profiles/base/profile.yml	Updates generated app dependency coordinate to `org.jline:jansi`
grails-gradle/model/build.gradle	Switches compileOnly dependency to `org.jline:jansi`
grails-gradle/gradle/docs-config.gradle	Switches docs classpath dependency to `org.jline:jansi`
grails-forge/grails-forge-core/src/test/groovy/org/grails/forge/feature/view/ScaffoldingSpec.groovy	Updates expected generated dependency string to `org.jline:jansi`
grails-forge/grails-forge-core/src/main/java/org/grails/forge/feature/view/Scaffolding.java	Updates generated dependency groupId to `org.jline`
grails-forge/grails-forge-cli/src/main/java/org/grails/forge/cli/InteractiveShell.java	Switches `AnsiConsole` import to `org.jline.jansi`
grails-forge/grails-forge-cli/build.gradle	Switches implementation dependency to `org.jline:jansi`
grails-forge/gradle.properties	Aligns `jansiVersion` to `3.30.9`
grails-doc/src/en/guide/commandLine/gradleBuild/gradleDependencies.adoc	Updates docs dependency snippet to `org.jline:jansi`
grails-data-neo4j/gradle.properties	Aligns `jansiVersion` to `3.30.9`
grails-data-neo4j/docs/build.gradle	Switches docs dependency to `org.jline:jansi`
grails-data-mongodb/docs/build.gradle	Switches docs dependency to `org.jline:jansi`
grails-data-hibernate7/docs/build.gradle	Switches docs dependency to `org.jline:jansi`
grails-data-hibernate5/docs/build.gradle	Switches docs dependency to `org.jline:jansi`
grails-controllers/build.gradle	Switches testRuntimeOnly dependency to `org.jline:jansi`
grails-console/build.gradle	Switches implementation dependency to `org.jline:jansi`
grails-bootstrap/src/test/groovy/grails/build/logging/GrailsConsoleSpec.groovy	Switches `Ansi` import to `org.jline.jansi`
grails-bootstrap/src/main/groovy/grails/build/logging/GrailsConsole.java	Switches Jansi imports/static imports to `org.jline.jansi`
grails-bootstrap/build.gradle	Switches compileOnly/testImplementation dependency to `org.jline:jansi`
gradle/docs-dependencies.gradle	Switches docs classpath dependency to `org.jline:jansi`
dependencies.gradle	Updates BOM version + coordinate mapping to `org.jline:jansi:3.30.9` and aligns `jline.version`
build-logic/plugins/src/main/groovy/org/apache/grails/buildsrc/VulnerabilityScanPlugin.groovy	Updates OSS Index exemption comment to reflect migration/removal condition
build-logic/plugins/src/main/groovy/org/apache/grails/buildsrc/SbomPlugin.groovy	Updates SBOM license mapping entries/comments for aligned JLine/Jansi versions

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

jdaugherty · 2026-08-02T03:45:54Z

@borinquenkid as explained on James's PR, I've opened a wider fix here: #16078

testlens-app · 2026-08-02T04:08:15Z

✅ All tests passed ✅

🏷️ Commit: 6fe5410
▶️ Tests: 1753 executed
⚪️ Checks: 63/63 completed

Learn more about TestLens at testlens.app.

codecov · 2026-08-02T04:08:21Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 51.8676%. Comparing base (2e2ce06) to head (6fe5410).

Additional details and impacted files

@@                Coverage Diff                 @@
##                8.0.x     #16079        +/-   ##
==================================================
- Coverage     51.8811%   51.8676%   -0.0135%     
+ Complexity      18118      18116         -2     
==================================================
  Files            2046       2046                
  Lines           96274      96274                
  Branches        16727      16727                
==================================================
- Hits            49948      49935        -13     
- Misses          38954      38971        +17     
+ Partials         7372       7368         -4

Files with missing lines	Coverage Δ
...ain/groovy/grails/build/logging/GrailsConsole.java	`37.4396% <ø> (ø)`
...ng/reporting/AnsiConsoleUrlMappingsRenderer.groovy	`56.5217% <ø> (ø)`

... and 3 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Copilot AI review requested due to automatic review settings August 2, 2026 03:21

github-project-automation Bot added this to Apache Grails Aug 2, 2026

Copilot started reviewing on behalf of borinquenkid August 2, 2026 03:22 View session

borinquenkid mentioned this pull request Aug 2, 2026

Import log4j-bom before Spring Boot in published BOMs #16044

Merged

Copilot AI reviewed Aug 2, 2026

View reviewed changes

jdaugherty closed this Aug 2, 2026

github-project-automation Bot moved this to Done in Apache Grails Aug 2, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

Migrate from unmaintained fusesource Jansi to the maintained org.jline fork - #16079

Migrate from unmaintained fusesource Jansi to the maintained org.jline fork#16079
borinquenkid wants to merge 1 commit into
8.0.xfrom
deps/adopt-jline-jansi

borinquenkid commented Aug 2, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

jdaugherty commented Aug 2, 2026

Uh oh!

testlens-app Bot commented Aug 2, 2026

Uh oh!

codecov Bot commented Aug 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Uh oh!

Conversation

borinquenkid commented Aug 2, 2026

Summary

Changes

Relationship to #16044

Verification

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

jdaugherty commented Aug 2, 2026

Uh oh!

testlens-app Bot commented Aug 2, 2026

✅ All tests passed ✅

Uh oh!

codecov Bot commented Aug 2, 2026

Codecov Report

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants