Visit NES for Apache Grails Home Page

Apache Grails 7

Installation and configuration guide for NES for Apache Grails 7.1.x

Overview

7.1.1 is the current NES release for Apache Grails 7.1.x. It is delivered as a Bill of Materials (BOM)com.herodevs.nes:grails-nes-bom — that pins:

  • Hibernate ORM 5.6 (jakarta variants) to its HeroDevs NES version. GORM 9 hard-pins org.hibernate:hibernate-core-jakarta:5.6.15.Final, which is EOL in OSS and carries published CVEs (e.g. CVE-2026-0603).
  • The Spring Boot 3.5 stack (Spring Boot, Framework, Security, Data, Session) to its HeroDevs NES version — OSS support for Spring Boot 3.5 has ended, and NES now carries the patches.

Grails core and its plugins stay on their canonical Apache OSS versions (org.apache.grails:*:7.1.1) because no known CVEs exist in them so far.

Importing the BOM gives you a single, version-managed view of the stack: you declare dependencies without a version, and every Spring and Hibernate artifact in the resulting fat JAR is an NES build.

The BOM, the companion Gradle plugin, and the NES Spring/Hibernate JARs are served by the NES Maven registry:

  • https://registry.nes.herodevs.com/maven

You will need to configure credentials for this registry.

Setup Instructions

Configure Registry Credentials

Create or update your registry configuration:

Maven (~/.m2/settings.xml)
Gradle (~/.gradle/gradle.properties)
<settings>
  <servers>
    <server>
      <id>herodevs-nes-registry</id>
      <username>any_text_here_not_used</username>
      <password>YOUR_NES_ACCESS_TOKEN</password>
    </server>
  </servers>
</settings>

Gradle only: declare the plugin repository

The NES companion plugin (plugin id com.herodevs.nes.grails7-bom) is resolved through pluginManagement as two artifacts served by the NES registry: the plugin marker com.herodevs.nes.grails7-bom:com.herodevs.nes.grails7-bom.gradle.plugin and its implementation com.herodevs.nes:grails7-bom-plugin. Add the NES registry to your settings.gradle:

Gradle (settings.gradle)
pluginManagement {
    repositories {
        gradlePluginPortal()
        maven {
            url = uri(providers.gradleProperty('herodevs_nes_registry_url').get())
            credentials {
                username = providers.gradleProperty('herodevs_nes_registry_user').get()
                password = providers.gradleProperty('herodevs_nes_registry_token').get()
            }
            authentication { basic(BasicAuthentication) }
        }
    }
}

Update Build Configuration

Import the BOM, then declare dependencies without versions — the BOM pins every Spring and Hibernate artifact to its NES version.

Maven (pom.xml)
Gradle (build.gradle)
<!-- Import the NES Grails BOM -->
<dependencyManagement>
  <dependencies>
    <dependency>
      <groupId>com.herodevs.nes</groupId>
      <artifactId>grails-nes-bom</artifactId>
      <version>7.1.1</version>
      <type>pom</type>
      <scope>import</scope>
    </dependency>
  </dependencies>
</dependencyManagement>

<!-- Declare your Spring Boot / Grails / GORM deps without versions -->
<dependencies>
  <dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-web</artifactId>
  </dependency>
  <dependency>
    <groupId>org.apache.grails</groupId>
    <artifactId>grails-web-boot</artifactId>
  </dependency>
  <dependency>
    <groupId>org.apache.grails</groupId>
    <artifactId>grails-data-hibernate5</artifactId>
  </dependency>
</dependencies>

<!-- Add the NES registry -->
<repositories>
  <repository>
    <id>herodevs-nes-registry</id>
    <url>https://registry.nes.herodevs.com/maven</url>
  </repository>
</repositories>

<pluginRepositories>
  <pluginRepository>
    <id>herodevs-nes-registry</id>
    <url>https://registry.nes.herodevs.com/maven</url>
  </pluginRepository>
</pluginRepositories>

Build

In order to remove potential obstacles before building your project, make sure the following domains are whitelisted by your firewall/networking team:

  • registry.nes.herodevs.com
  • assets.nes.herodevs.com

This will ensure that your network/firewall allows connection to our registry.

Run your build tool:

Maven
Gradle
mvn clean package

Verification

Inspect the fat JAR

To verify your installation, inspect the produced fat JAR and confirm every Spring and Hibernate-ORM artifact in BOOT-INF/lib/ carries an NES version suffix (-spring-boot-<patch>, -spring-framework-<patch>, -hibernate-orm-<patch>, etc.):

unzip -l build/libs/your-app-*.jar | grep -E 'BOOT-INF/lib/(spring|hibernate)-'

You should see entries like:

spring-boot-3.5.16-spring-boot-3.5.17.jar
spring-core-6.2.19-spring-framework-6.2.20.jar
spring-webmvc-6.2.19-spring-framework-6.2.20.jar
hibernate-core-jakarta-5.6.15-hibernate-orm-5.6.17.jar

A bare version such as spring-core-6.2.19.jar or hibernate-core-jakarta-5.6.15.Final.jar would indicate an OSS artifact slipped through — re-check that the BOM is imported with enforcedPlatform, that the companion plugin (or the manual snippet) is applied, and that the NES registry credentials are valid.

Inspect the dependency graph

Run the build-tool analysis reports against artifacts pinned by the BOM (see the Managed Versions page), for example spring-boot or hibernate-core-jakarta.

Maven (dependency:tree)
Gradle (dependencyInsight)
mvn dependency:tree -Dincludes="org.springframework.boot:spring-boot:*"
mvn dependency:tree -Dincludes="org.hibernate:hibernate-core-jakarta:*"

With grails-nes-bom:7.1.1 imported and the companion plugin applied, the reports should resolve to the NES versions:

org.springframework.boot:spring-boot:3.5.16-spring-boot-3.5.17 (forced)

org.hibernate:hibernate-core-jakarta:5.6.15-hibernate-orm-5.6.17
   Selection reasons:
      - By constraint: NES patch fixes CVE-2026-0603 and other Hibernate 5.6 EOL CVEs

If a report instead resolves to a bare OSS version (e.g. 3.5.14 or 5.6.15.Final), the Spring dependency-management rules registered by the Grails Gradle plugins are still winning — verify the companion plugin is applied before the Grails plugins in your plugins block.

Troubleshooting

Manual Downloads

The direct download URL for the NES Grails BOM POM follows this format:

PortionValue
base_urlhttps://registry.nes.herodevs.com/maven/com/herodevs/nes/
package_namegrails-nes-bom
version7.1.1
filenamepackage_name + version + extension

Example Link

https://registry.nes.herodevs.com/maven/com/herodevs/nes/grails-nes-bom/7.1.1/grails-nes-bom-7.1.1.pom