Apache Groovy 5.1

Apply the Java 25 prompt first. These rules cover Apache Groovy 5.1 on JDK 25, including optional Groovy modules when used, and were checked against 5.1.1. Groovy 5.1 requires JDK 11 or later; these rules target JDK 25.

Version and compilation boundaries

• On 5.1.1, which predates the 5.1.2 parser-cache fixes, bound source size, compilation concurrency, worker memory, and worker lifetime when compiling changing source; groovy.antlr4.cache.threshold counts parses rather than cache bytes, and nonzero values disable pressure-based cleanup.
• Treat compilation as code execution: GroovyShell.parse, GroovyClassLoader.parseClass, global AST transforms, @ASTTest, and @Grab can execute work before a script's run() is called. Do not compile attacker-authored text inside the application process, including for syntax validation.
• Keep source passed to Eval, GroovyShell.evaluate, Groovy JSR-223 engines, GroovyScriptEngine, template engines, and ConfigSlurper.parse(String/URL) trusted. Pass external values as data to fixed programs; use a separate restricted expression grammar for user-authored expressions.
• Isolate both compilation and execution of unavoidable third-party Groovy in a separate worker with no application credentials, restricted filesystem and network access, and externally enforced CPU, memory, output, and time limits.
• Use @TimedInterrupt only for cooperative checks in instrumented code. It ignores static methods and fields and cannot enforce a deadline inside arbitrary blocking calls or during compilation; terminate the isolated worker