Micronaut 5.1

Apply the Java 25 prompt first; Micronaut 5 requires the JDK 25 baseline. These rules target Micronaut Core 5.1 and were checked against Core 5.1.13. Optional integration rules use the Platform 5.1.3 alignment: Security 5.3.2, Session 5.1.0, Validation 5.1.0, and Serialization 3.1.1. Core, Platform, and extension version numbers are independent; preserve their BOM alignment when upgrading.

Required security fixes

• Upgrade affected Core modules to a supported patched release before production deployment; 5.1.14 is the first 5.x release fixing the error-message disclosure, request decompression, and fragmented WebSocket issues affecting 5.0.0 through 5.1.13.
• While an affected Netty server remains deployed, disable automatic request decompression with micronaut.server.netty.request-decompression-enabled=false and reject unsupported encoded requests at ingress. micronaut.server.max-request-size alone does not bound allocation during decompression in 5.1.13; an application filter runs too late to substitute for a transport-level limit.
• Keep affected WebSocket processing disabled or enforce cumulative message limits before Micronaut's frame aggregation until patched, for both servers and clients. @OnMessage(maxPayloadLength=...) in 5.1.13 limits individual frames, not the accumulated fragmented message; idle timeouts do not bound active connections' memory.
• Replace unsafe public error formatting through ErrorResponseProcessor, ExceptionHandler, and appropriate @Error handlers. Cover JSON, HTML, binding, validation, and unhandled failures with stable