Micronaut 3.10

Apply the Java 17 baseline first. These rules cover Micronaut Core 3.10 and its BOM-aligned Micronaut Security on Java 17. They were checked against Core 3.10.10 and Security 3.11.1. Micronaut 3 configuration and APIs below do not imply the protections of later releases.

Version scope and known vulnerabilities

• Treat Core 3.10.0 through 3.10.10 as vulnerable, not as recommended deployment versions: they predate the 3.10.11 fix for the error-message disclosure, request-decompression, and fragmented-WebSocket advisories. While one runs, apply the error-response, ingress-decompression, and WebSocket workarounds below, and verify current advisories on the Core repository's security page before choosing a deployment release: these three were published there without a CVE or GitHub Advisory Database entry, so don't count on a dependency scanner to flag those releases for them.
• Use Java 17 for applications following these rules. The Core tag's CI matrix includes Java 8, 11, and 17, but the included Java 17 baseline does not describe Java 8 or 11 deployments.
• Align Core modules, Security modules, and annotation processors through the Micronaut BOM and inspect resolved dependencies for accidental downgrades. Security and Core use different version numbers, so check the Security modules' patch status separately.
• Plan migration according to the official security support policy: critical fixes cover releases from the preceding three months, while moderate and high fixes target the most recent release. A historical 3.x backport is not a promise of continuing maintenance.