Apache Groovy 4.0

Apply the Java 21 prompt first for Apache Groovy 4.0 deployments on JDK 21. Apply these additional rules to Groovy scripts, compiler extensions, dynamic dispatch, data access, parsing, templates, and deployment helpers; they were checked against 4.0.33.

Scripts and compiler authority

• Keep source passed to GroovyShell.evaluate or parse, GroovyClassLoader.parseClass, Eval, GroovyScriptEngine, and Groovy's JSR-223 engine trusted. Pass external values as data to reviewed scripts instead of interpolating them into source; use a small parsed grammar for user-authored expressions.
• Treat ConfigSlurper.parse(String), parse(URL), and script-based configuration as code execution. Use a non-executable data format for configuration supplied by users or external services.
• Apply the script trust boundary before compilation: local and global AST transformations, including @ASTTest, can execute before Script.run(). Keep compiler configuration scripts, type-checking extensions, script base classes, classpaths, and transformation artifacts under application control.
• Compile and execute unavoidable third-party scripts in an isolated worker process with no application credentials, restricted filesystem and network access, and enforced CPU, memory, output, and lifetime limits. Do not use Groovy's optional Security Manager integration as the isolation boundary.
• Use @ThreadInterrupt or @TimedInterrupt only as cooperative checks for reviewed code. They do not impose a hard deadline on compilation or blocking library calls; @TimedInterrupt does not cover