I remember I read somewhere that new versions of G...
# questions
u
I remember I read somewhere that new versions of Grails will be released following spring framework release cadence but I now cannot find any reference of that. Can anyone help me? I would like to introduce some automatic minor version upgrade in our CI but I would like to document why it is a good idea
j
https://endoflife.date/grails documents the supported versions and in the weekly meetings we decided to follow spring’s release strategy. I am not sure if we have added all of it to documentation yet, @James Fredley would know
u
Thanks. I was sure but I couldn’t remember where I got that information from. We use Dependabot to manage dependencies updates but it does not check ‘grails.properties’ so I wrote my simple workflow to do that. Nothing really fancy.
u
To start I’m only following patch versions.
j
I had forgotten dependabot still doesn’t support gradle.properties: https://github.com/dependabot/dependabot-core/issues/1618
u
I’ve found the hard way.
j
if you are looking for an automated way to check; in addition to publishing to central we also publish to sdkman
i think sdkman may have apis you can call
u
Interesting, I’ll check tomorrow. I’m sort of parsing the output of Maven central.
j
we made it easy to publish and have been very strict about not having point releases have breaking changes
so it should be safe to go from 7.0.1 to 7.0.2 but minor versions like 7.1 could have small changes that would be breaking - we would document those cases though. major releases of course will almost always require effort to update to
u
I know, and after 7.0.0 you are making a very good job
j
the idea is point releases should be no effort, minor trivial effort, and major needs significant review due to api changes etc
u
Following spring is already good to get security patches from them. We have strict policies about security in our SDLC.
j
the only time we would likely break from that would be is because of security
as for policies all of our jar files now include a sbom file that security software like sonatype can make use of
so you can be confident which library we built with/tested with
u
Thanks @jdaugherty and @James Fredley
👍 2