grails5 強制升級 plugin 相依

2024-04-28 工作雜記 grails

今天在為自己的專案做CVE 弱點掃描，解決過程中需要為專案進行 plugin 相依升級。在 build.gradle 設定如下

  • build.gradle

configurations{
    // 強制移除
    implementation {
        exclude group: 'com.h2database' //CVE-2022-45868,CVE-2022-23221,CVE-2021-42392
        exclude group: "org.graalvm.sdk"
        exclude group: "com.bertramlabs.plugins:asset-pipeline-core"
    }

    // 強制升級
    all{
        resolutionStrategy.eachDependency { DependencyResolveDetails details ->
            ModuleVersionSelector requested = details.requested
            List forcePlugins = [
                    [group: 'org.yaml', name: 'snakeyaml', useVersion: '1.33'],
            ]

            forcePlugins.each {forcePlugin ->
                if (requested.group == forcePlugin.group && requested.name == forcePlugin.name ) {
                    details.useVersion forcePlugin.useVersion
                }
            }
        }
    }
}

Recent Posts