Grails 7.0

Apply the Apache Groovy 4.0 and Java 21 prompts first. Apply these additional rules to Grails 7.0 controllers, binding, GORM, GSP, REST, configuration, and installed Spring Security modules; they were checked against 7.0.16.

Version, build, and plugin integrity

• Use a patched JDK 21 for these rules; Grails 7 requires at least Java 17. Let org.apache.grails:grails-bom manage Groovy, Spring Boot, and the Grails modules instead of choosing their versions separately, and verify the resolved graph after every plugin change.
• Use the Grails 7 org.apache.grails artifacts, including grails-spring-security; remove obsolete org.grails.plugins security dependencies during migration and avoid mixing independently chosen framework versions.
• Grails 7.0.16's Spring Boot manages Spring Security 6.5.11, and the August 2026 Spring Security fixes for the 6.5 line ship only under enterprise support. With Spring Security 6.5.0 through 6.5.11, which predate the 6.5.12 fix, don't accept DPoP-bound tokens through DPoPProofJwtDecoderFactory, because flooding its fixed-size jti cache lets a captured proof be replayed, and don't combine WebAuthn userVerification = REQUIRED with a distributed session store such as Spring Session on Redis or JDBC, because the requirement is lost when the session is deserialized.
• Build AesBytesEncryptor only from a random SecretKey with CipherAlgorithm.GCM, or with CBC and a random IV generator such as KeyGenerators.secureRandom(16). Its two-argument constructor and CBC without an IV generator use an all-zero IV, and its password