Micronaut 3.8.15

Apply the Java 17 baseline first. These rules cover Micronaut Framework 3.8.15, its Netty HTTP server/client and session modules, and the BOM-aligned Micronaut Security 3.9.6 modules when installed. Treat this as a legacy deployment: Core 3.8.15 predates the 3.10.11 fix for the September 2026 request-decompression, fragmented-WebSocket, and error-disclosure advisories.

Version and deployment scope

• Use a maintained Java 17 distribution for applications following these rules. The Core tag's CI matrix includes JDK 8, 11, and 17; that compatibility matrix does not establish ongoing security support for a framework release or JDK distribution.
• Align Core dependencies through the io.micronaut:micronaut-bom that matches the Core release and inspect the resolved dependency graph, including the Security modules, Netty, Jackson, annotation processors, and native-image components, and fail the build on accidental downgrades. Optional Micronaut modules have their own versions; do not force every artifact to the Core version or assume BOM alignment establishes that all dependencies are patched.
• Plan migration to a maintained release; the September advisories name no 3.8 release with a fix. Read them on the Core repository's security page: they were published there without a CVE or GitHub Advisory Database entry, so don't count on a dependency scanner to flag 3.8.15 for them. Apply the compensating controls below while 3.8.15 remains deployed; newer configuration keys do not backport those fixes. The published security policy limits critical-fix eligibility to releases