Micronaut 4.10

Apply the Java 21 baseline first. These rules cover Micronaut Core and Management 4.10, with Micronaut Security, Serialization, and Validation where installed, and were checked against Core 4.10.26, Security 4.18.0, Serialization 2.16.2, and Validation 4.12.0. Module versions are independent of the Core version.

Version scope and known limitations

• Use a maintained JDK 21 for applications following these rules. Micronaut 4 requires Java 17 or later; this Core tag tests Java 17 and 21, and Micronaut 4 continues to support both. A Micronaut 5 migration requires a separate Java 25 baseline review.
• Manage dependencies through the Micronaut platform BOM and inspect the resolved Core, Security, Serialization, Validation, Netty, and Jackson versions; a platform release number is not a Core or Security module version. Recheck official advisories on the Core repository's security page instead of treating a fixed historical patch floor as sufficient: the September 2026 advisories were published there without a CVE or GitHub Advisory Database entry, so don't count on a dependency scanner to flag 4.10.26 for them.
• Treat Core 4.10.0 through 4.10.26 as affected by exception-message disclosure, unbounded request decompression, and fragmented WebSocket memory exhaustion: they predate the 4.10.27 fix for all three. While one runs, apply the following interim controls, which do not make it a patched release.
• Replace the default error response processing with an ErrorResponseProcessor that emits stable public messages, and audit custom @Error and ExceptionHandler responses