yuri
yuri
Just to mention, update to Logback 1.2.9 is desirable since the recent [CVE-2021-42550](https://nvd.nist.gov/vuln/detail/CVE-2021-42550) affecting Logback 1.2.7 and older.
@davidkron You are right, the H2 somehow slipped and is still a part of the 5.1.4 build artifact regardless of the `build.gradle` declaration. `$ ./gradlew dependencies --configuration productionRuntimeClasspath` suggests it's...
@davidkron Update: The default Grails web profile pulls a _newish_ `asset-pipeline-grails` version which seems to employ strange dependency configurations - attempting to [solve that via a PR](https://github.com/bertramdev/asset-pipeline/pull/300). The `rest-api` Grails...
> > H2 seems to be coming from micronaut-bom > > @davidkron That is true, but that is only 1 of the places. By default, there are multiple dependencies in...
The `gradleWrapperVersion` property seems to be used for [obtaining a CLI Gradle connection](https://github.com/grails/grails-core/blob/a73ba7b155b8c9bba5b34fc7f8e2bf549b2eeeb8/grails-shell/src/main/groovy/org/grails/cli/gradle/GradleUtil.groovy#L59). It is present even in 5.1.x, although the `gradleWrapperVersion` mention is absent from the 5.1.x documentation. So...
@billmurrin May I know what is the status? The issue makes whole UX horribly broken.
@davidkron Recently, [Grails 5.2.5](https://github.com/grails/grails-core/releases/tag/v5.2.5) has updated the [base profile to 5.1.1](https://github.com/grails-profiles/base/releases/tag/v5.1.1). That one includes updated [asset-pipeline to 3.4.7](https://github.com/bertramdev/asset-pipeline/releases/tag/rel-3.4.7) which includes the [PR](https://github.com/bertramdev/asset-pipeline/pull/300) fixing ~~it~~ the problem of exposed H2 dependency....
@jchharris You are right, I haven't checked the plugins... I'll see if I can go through at least some of them.
The liquibase-hibernate-related H2 leak can be tracked under https://github.com/liquibase/liquibase-hibernate/pull/444.
> Another option can be use a different XML via configuration. Let's say: > > * `logback-development.xml` -> ConsoleAppender > > * `logback.xml` -> FileAppender > > > You just...