Apache Groovy 3.0

Last reviewed Sep 23, 2026

Export as PDF

Prompt Details

Prompt Composition

2prompts
  1. Java 8120 lines · 5.6K tokens
  2. Apache Groovy 3.079 lines · 3.4K tokens
Total199 lines · 9K tokens

CWE Coverage

  • 20
  • 22
  • 59
  • 73
  • 78
  • 79
  • 88
  • 89
  • 90
  • 95
  • 117
  • 190
  • 208
  • 209
  • 214
  • 250
  • 295
  • 297
  • 306
  • 323
  • 327
  • 338
  • 347
  • 362
  • 367
  • 378
  • 427
  • 470
  • 471
  • 488
  • 494
  • 502
  • 532
  • 567
  • 611
  • 653
  • 681
  • 732
  • 770
  • 772
  • 776
  • 789
  • 807
  • 829
  • 862
  • 863
  • 915
  • 916
  • 918
  • 922
  • 942
  • 1336

Prompt Preview

Apply the Java 8 prompt first. Use these additional rules for Apache Groovy 3.0; they were checked against 3.0.25. The 3.0 line receives reduced maintenance and critical security fixes; retain it when legacy parser or legacy package compatibility is required.

Runtime, artifacts, and deployment scope

  • Align all org.codehaus.groovy modules on one version through org.codehaus.groovy:groovy-bom or a single version property so they move together, and inspect transitive dependencies for duplicate runtimes. Do not mix them with org.apache.groovy 4.x or later modules; select only required modules instead of accepting an unreviewed groovy-all graph.
  • Run on a supported, patched JDK with Java 8 as the minimum runtime. Building Groovy itself requires JDK 9+; the tagged CI matrix exercises Java 8, 11, 15, 16, and 17. Qualify the exact application and modules on newer JVMs instead of treating this historical matrix as a JDK support policy.
  • Put Groovy 3 on the classpath, not the Java module path: its split packages are not JPMS-compatible. Keep runtime JARs, compiler plugins, extension modules, and script/template roots protected from application or upload writes.

Source, compilation, and evaluation are code execution

  • Accept source only from trusted authors for Eval, GroovyShell.evaluate/parse, GroovyClassLoader.parseClass, GroovyScriptEngine, JSR-223 eval/compile, and groovyc. Pass request, database, and tenant values as data to fixed application code; never interpolate them into source.
  • Treat compile-only, lint, IDE indexing, and