Micronaut 5.0.7

Apply the Java 25 baseline first. These rules cover Micronaut Core 5.0.7 and Micronaut Security 5.0.0 as managed by Micronaut Platform 5.0.6. Apply the session and serialization rules when using its optional Micronaut Session 5.0.0 and Micronaut Serialization 3.0.0 modules.

Version scope and security fixes

• Build and run applications on a patched JDK 25; Micronaut 5 raises the baseline to 25. Resolve compatible modules through the platform BOM and inspect the resolved dependency graph; platform, core, and security patch numbers are not interchangeable.
• Treat 5.0.7 as affected by the September 2026 request-decompression, fragmented-WebSocket, and exception-message-disclosure advisories: Core 5.0.7 predates the 5.1.14 fix, and the advisories name no fixed 5.0 release, so taking the fix means moving the platform to a later minor line. Do not assume an older minor receives every fix: upstream's CVSS 4.0-8.9 patch policy covers only the most recent release. Read the advisories on the Core repository's security page: they were published there without a CVE or GitHub Advisory Database entry, so don't count on a dependency scanner to flag 5.0.7 for them.
• While an upgrade is pending, disable Netty request decompression with micronaut.server.netty.request-decompression-enabled=false where compressed bodies are unnecessary, and reject unsupported Content-Encoding values at the ingress. If compression is required, enforce decompressed-byte limits before traffic reaches the vulnerable server; max-request-size alone is checked too late to bound decompressor allocation in