Grails 7.1

Apply the Apache Groovy 4.0 and Java 21 prompts first. Grails 7 requires at least Java 17. Apply these additional rules to Grails 7.1 controllers, GSPs, GORM, configuration, and the integrated Spring Security modules that the application actually installs; they were checked against 7.1.6.

Establish the platform and patch boundary

• Manage every org.apache.grails module through org.apache.grails:grails-bom, including org.apache.grails:grails-spring-security when using its security integration, and move them together. Grails 7.1.6 manages Groovy 4.0.33 and Spring Boot 3.5.16; keep that platform and the BOM's deliberate security overrides, and review the resolved graph rather than assuming the BOM makes every dependency safe.
• Check maintenance and patch availability before deploying this line. Spring Boot 3.5.16 was the last open-source 3.5 release, and the Grails BOM leaves Spring Security and the embedded server at the versions Boot manages. Later Spring Security 6.5 fixes ship only under Spring's enterprise support, so a scanner finding there may have no open-source fixed release, and a scanner that reads only the GitHub Advisory Database or OSV may not raise one at all, since those databases carried the 6.5.11 advisories without Maven version ranges; read Spring's advisory index for the Spring Security release the BOM resolves, and check the embedded server against its own project's advisories as well. If you can't obtain a compatible fixed release, disable the affected feature or migrate the integrated platform; Spring Security 7 is not a drop-in replacement