Apache Grails 7
Installation and configuration guide for NES for Apache Grails 7.1.x
Overview
7.1.1 is the current NES release for Apache Grails 7.1.x. It is delivered as a Bill of Materials (BOM) — com.herodevs.nes:grails-nes-bom — that pins:
- Hibernate ORM 5.6 (jakarta variants) to its HeroDevs NES version. GORM 9 hard-pins
org.hibernate:hibernate-core-jakarta:5.6.15.Final, which is EOL in OSS and carries published CVEs (e.g. CVE-2026-0603). - The Spring Boot 3.5 stack (Spring Boot, Framework, Security, Data, Session) to its HeroDevs NES version — OSS support for Spring Boot 3.5 has ended, and NES now carries the patches.
Grails core and its plugins stay on their canonical Apache OSS versions (org.apache.grails:*:7.1.1) because no known CVEs exist in them so far.
Importing the BOM gives you a single, version-managed view of the stack: you declare dependencies without a version, and every Spring and Hibernate artifact in the resulting fat JAR is an NES build.
The BOM, the companion Gradle plugin, and the NES Spring/Hibernate JARs are served by the NES Maven registry:
https://registry.nes.herodevs.com/maven
You will need to configure credentials for this registry.
Gradle projects need one extra step compared to Grails 6.2.x. The Apache Grails Gradle plugins apply io.spring.dependency-management and import the OSS grails-bom through it, which re-pins Hibernate and Spring to their OSS versions in a way that overrides Gradle's native dependency management (strictly, force, enforcedPlatform). The NES companion plugin — com.herodevs.nes.grails7-bom — neutralises this automatically. Maven projects are not affected and only need the BOM import.
Setup Instructions
NES for Apache Grails 7.1.x requires Java 17 (Spring Boot 3.5 / Jakarta EE 10 baseline).
You will need:
- An NES access token (your HeroDevs portfolio token) for the NES Maven registry.
Configure Registry Credentials
Create or update your registry configuration:
<settings>
<servers>
<server>
<id>herodevs-nes-registry</id>
<username>any_text_here_not_used</username>
<password>YOUR_NES_ACCESS_TOKEN</password>
</server>
</servers>
</settings>
See the guides for Sonatype Nexus or JFrog Artifactory for setup to the HeroDevs NES registry.
Gradle only: declare the plugin repository
The NES companion plugin (plugin id com.herodevs.nes.grails7-bom) is resolved through pluginManagement as two artifacts served by the NES registry: the plugin marker com.herodevs.nes.grails7-bom:com.herodevs.nes.grails7-bom.gradle.plugin and its implementation com.herodevs.nes:grails7-bom-plugin. Add the NES registry to your settings.gradle:
pluginManagement {
repositories {
gradlePluginPortal()
maven {
url = uri(providers.gradleProperty('herodevs_nes_registry_url').get())
credentials {
username = providers.gradleProperty('herodevs_nes_registry_user').get()
password = providers.gradleProperty('herodevs_nes_registry_token').get()
}
authentication { basic(BasicAuthentication) }
}
}
}
Update Build Configuration
Import the BOM, then declare dependencies without versions — the BOM pins every Spring and Hibernate artifact to its NES version.
7.1.1 is the current NES Grails BOM release. See the "NES Maven Artifacts: Paid Versions" table for the published artifacts.
<!-- Import the NES Grails BOM -->
<dependencyManagement>
<dependencies>
<dependency>
<groupId>com.herodevs.nes</groupId>
<artifactId>grails-nes-bom</artifactId>
<version>7.1.1</version>
<type>pom</type>
<scope>import</scope>
</dependency>
</dependencies>
</dependencyManagement>
<!-- Declare your Spring Boot / Grails / GORM deps without versions -->
<dependencies>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-web</artifactId>
</dependency>
<dependency>
<groupId>org.apache.grails</groupId>
<artifactId>grails-web-boot</artifactId>
</dependency>
<dependency>
<groupId>org.apache.grails</groupId>
<artifactId>grails-data-hibernate5</artifactId>
</dependency>
</dependencies>
<!-- Add the NES registry -->
<repositories>
<repository>
<id>herodevs-nes-registry</id>
<url>https://registry.nes.herodevs.com/maven</url>
</repository>
</repositories>
<pluginRepositories>
<pluginRepository>
<id>herodevs-nes-registry</id>
<url>https://registry.nes.herodevs.com/maven</url>
</pluginRepository>
</pluginRepositories>
Gradle without the companion plugin. If you prefer not to add the plugin, the equivalent manual configuration is a dependencyManagement block with direct NES Hibernate pins plus a late import of the NES spring-boot-dependencies BOM:
dependencyManagement {
dependencies {
dependency 'org.hibernate:hibernate-core-jakarta:5.6.15-hibernate-orm-5.6.17'
dependency 'org.hibernate:hibernate-envers-jakarta:5.6.15-hibernate-orm-5.6.17'
dependency 'org.hibernate:hibernate-jpamodelgen-jakarta:5.6.15-hibernate-orm-5.6.17'
}
}
project.afterEvaluate {
project.dependencyManagement.imports {
mavenBom 'org.springframework.boot:spring-boot-dependencies:3.5.16-spring-boot-3.5.17'
}
}
Build
In order to remove potential obstacles before building your project, make sure the following domains are whitelisted by your firewall/networking team:
registry.nes.herodevs.comassets.nes.herodevs.com
This will ensure that your network/firewall allows connection to our registry.
Run your build tool:
mvn clean package
Verification
Inspect the fat JAR
To verify your installation, inspect the produced fat JAR and confirm every Spring and Hibernate-ORM artifact in BOOT-INF/lib/ carries an NES version suffix (-spring-boot-<patch>, -spring-framework-<patch>, -hibernate-orm-<patch>, etc.):
unzip -l build/libs/your-app-*.jar | grep -E 'BOOT-INF/lib/(spring|hibernate)-'
You should see entries like:
spring-boot-3.5.16-spring-boot-3.5.17.jar
spring-core-6.2.19-spring-framework-6.2.20.jar
spring-webmvc-6.2.19-spring-framework-6.2.20.jar
hibernate-core-jakarta-5.6.15-hibernate-orm-5.6.17.jar
A bare version such as spring-core-6.2.19.jar or hibernate-core-jakarta-5.6.15.Final.jar would indicate an OSS artifact slipped through — re-check that the BOM is imported with enforcedPlatform, that the companion plugin (or the manual snippet) is applied, and that the NES registry credentials are valid.
Inspect the dependency graph
Run the build-tool analysis reports against artifacts pinned by the BOM (see the Managed Versions page), for example spring-boot or hibernate-core-jakarta.
mvn dependency:tree -Dincludes="org.springframework.boot:spring-boot:*"
mvn dependency:tree -Dincludes="org.hibernate:hibernate-core-jakarta:*"
With grails-nes-bom:7.1.1 imported and the companion plugin applied, the reports should resolve to the NES versions:
org.springframework.boot:spring-boot:3.5.16-spring-boot-3.5.17 (forced)
org.hibernate:hibernate-core-jakarta:5.6.15-hibernate-orm-5.6.17
Selection reasons:
- By constraint: NES patch fixes CVE-2026-0603 and other Hibernate 5.6 EOL CVEs
If a report instead resolves to a bare OSS version (e.g. 3.5.14 or 5.6.15.Final), the Spring dependency-management rules registered by the Grails Gradle plugins are still winning — verify the companion plugin is applied before the Grails plugins in your plugins block.
Troubleshooting
One known OSS exception (no action required): spring-boot-jarmode-tools is injected by the Spring Boot Maven/Gradle plugins at the plugin's own pinned OSS version, bypassing every dependency-management mechanism. It has no known CVEs and is only used at JAR-extraction time, not at runtime. If you want to remove it entirely from the fat JAR you can disable the tools support:
<configuration>
<includeTools>false</includeTools>
</configuration>
hibernate-commons-annotations and hibernate-validator stay OSS. These are separate projects from Hibernate ORM, have no known CVEs affecting the shipped versions, and never had -jakarta NES variants. Seeing them without an NES suffix in the fat JAR is expected.
Manual Downloads
The direct download URL for the NES Grails BOM POM follows this format:
| Portion | Value |
|---|---|
| base_url | https://registry.nes.herodevs.com/maven/com/herodevs/nes/ |
| package_name | grails-nes-bom |
| version | 7.1.1 |
| filename | package_name + version + extension |