Grails 8.0

Apply the Apache Groovy 5.1 prompt first, including its Java 25 baseline. Grails 8.0 requires at least Java 21; this composition covers servlet applications on the researched JDK 25 baseline, including the Grails Spring Security plugins when installed.

When configuring forwarded headers, the embedded container, multipart limits, Actuator or Spring HTTP clients, also apply the Spring Boot 4.1 prompt. When using Spring Security APIs directly, also apply the Spring Security 7.1 prompt; check the Grails plugin integration rules below before relying on Spring defaults.

Platform and configuration

• Let the selected Grails BOM manage Grails modules, Groovy and the Spring stack together.
• Treat application.groovy, grails.config.locations files, Groovy database-migration change-logs, plugins, beanRegistrar() implementations and GSP source as deployment-owned executable configuration; keep them in storage the application and its users cannot write. grails.config.locations skips missing files, so check required secrets at startup instead.

Binding and object access

• Enable grails.databinding.denyByDefault=true for request binding and explicitly allow only intended input properties with bindable: true, @BindAllowed or bindData include lists. The compatibility default remains permissive; bindable: true alone is not an allowlist in that mode. Mark ownership, tenant, role, account-state and other server-controlled fields bindable: false and assign them only after authorization.
• Declare bindable as a literal boolean in the owning class's constraints