Apache Grails
Installation and configuration guide for NES for Apache Grails libraries
Overview
6.2.3 is the current NES release for Apache Grails 6.2.x. It is delivered as a single Bill of Materials (BOM) — com.herodevs.nes:grails-nes-bom — that pins every Spring Boot, Spring Framework, Spring Security, Spring Data, Spring Session and Hibernate ORM artifact used by Grails 6.2.x to its HeroDevs NES version. Grails core and its plugins stay on their canonical OSS versions because no known CVEs exist in them so far!
Importing the BOM gives you a single, version-managed view of the stack: you declare dependencies without a version, and every Spring/Hibernate artifact in the resulting fat JAR is an NES build.
The BOM, as well as the actual NES Spring/Hibernate JARs are published to GitHub Packages:
https://registry.nes.herodevs.com/maven
You will need to configure credentials for this registry.
Setup Instructions
NES for Apache Grails 6.2.x requires Java 11.
You will need:
- An NES access token (your HeroDevs portfolio token) for the NES Maven registry.
Configure Registry Credentials
Create or update your registry configuration:
<settings>
<servers>
<server>
<id>herodevs-nes-registry</id>
<username>any_text_here_not_used</username>
<password>YOUR_NES_ACCESS_TOKEN</password>
</server>
</servers>
</settings>
See the guides for Sonatype Nexus or JFrog Artifactory for setup to the HeroDevs NES registry.
Update Build Configuration
Import the BOM, then declare dependencies without versions — the BOM pins every Spring/Hibernate artifact to its NES version.
6.2.3 is the current NES Grails BOM release. See the "NES Maven Artifacts: Paid Versions" table for the published artifact.
<!-- Import the NES Grails BOM -->
<dependencyManagement>
<dependencies>
<dependency>
<groupId>com.herodevs.nes</groupId>
<artifactId>grails-nes-bom</artifactId>
<version>6.2.3</version>
<type>pom</type>
<scope>import</scope>
</dependency>
</dependencies>
</dependencyManagement>
<!-- Declare your Spring Boot / Grails / GORM deps without versions -->
<dependencies>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-web</artifactId>
</dependency>
<dependency>
<groupId>org.grails</groupId>
<artifactId>grails-web-boot</artifactId>
</dependency>
</dependencies>
<!-- Add the NES registry -->
<repositories>
<repository>
<id>herodevs-nes-registry</id>
<url>https://registry.nes.herodevs.com/maven</url>
</repository>
</repositories>
<pluginRepositories>
<pluginRepository>
<id>herodevs-nes-registry</id>
<url>https://registry.nes.herodevs.com/maven</url>
</pluginRepository>
</pluginRepositories>
Build
In order to remove potential obstacles before building your project, make sure the following domains are whitelisted by your firewall/networking team:
registry.nes.herodevs.comassets.nes.herodevs.com
This will ensure that your network/firewall allows connection to our registry.
Run your build tool:
mvn clean package
Verification
Inspect the fat JAR
To verify your installation, inspect the produced fat JAR and confirm every Spring/Hibernate-ORM artifact in BOOT-INF/lib/ carries an NES version suffix (-spring-framework-<patch>, -spring-boot-<patch>, -spring-security-<patch>, -hibernate-orm-<patch>, etc.):
unzip -l target/your-app-*.jar | grep -E 'BOOT-INF/lib/(spring|hibernate)-'
You should see entries like:
spring-core-5.3.39-spring-framework-5.3.51.jar
spring-boot-2.7.18-spring-boot-2.7.38.jar
spring-security-core-5.7.14-spring-security-5.7.23.jar
hibernate-core-5.6.15-hibernate-orm-5.6.17.jar
A bare version such as spring-core-5.3.39.jar would indicate an OSS artifact slipped through — re-check that the BOM is correctly imported and that the NES registry credentials in your settings file are valid.
Inspect the dependency graph
Maven and Gradle both ship analysis tools that let you confirm — without building the fat JAR — that the BOM has substituted the requested OSS coordinates with their NES equivalents. Run them against any of the artifacts pinned by the BOM (see the Managed Versions page), for example spring-boot or hibernate-core.
mvn dependency:tree -Dincludes="org.springframework.boot:spring-boot:*"
mvn dependency:tree -Dincludes="org.hibernate:hibernate-core:*"
With grails-nes-bom:6.2.3 imported, the reports should show Spring Boot and Hibernate resolved to their NES versions:
spring-boot
$ ./gradlew dependencyInsight --dependency spring-boot
> Task :dependencyInsight
org.springframework.boot:spring-boot:2.7.18-spring-boot-2.7.38 (selected by rule)
Variant apiElements:
| Attribute Name | Provided | Requested |
|------------------------------------|--------------|-------------------|
| org.gradle.status | release | |
| org.jetbrains.kotlin.platform.type | jvm | |
| org.gradle.category | library | library |
| org.gradle.dependency.bundling | external | external |
| org.gradle.jvm.environment | standard-jvm | standard-jvm |
| org.gradle.jvm.version | 8 | 11 |
| org.gradle.libraryelements | jar | classes+resources |
| org.gradle.usage | java-api | java-api |
org.springframework.boot:spring-boot:2.7.18-spring-boot-2.7.38
hibernate-core
$ ./gradlew dependencyInsight --dependency hibernate-core
> Task :dependencyInsight
org.hibernate:hibernate-core:5.6.15-hibernate-orm-5.6.17 (selected by rule)
Variant compile:
| Attribute Name | Provided | Requested |
|--------------------------------|----------|-------------------|
| org.gradle.status | release | |
| org.gradle.category | library | library |
| org.gradle.libraryelements | jar | classes+resources |
| org.gradle.usage | java-api | java-api |
| org.gradle.dependency.bundling | | external |
| org.gradle.jvm.environment | | standard-jvm |
| org.gradle.jvm.version | | 11 |
org.hibernate:hibernate-core -> 5.6.15-hibernate-orm-5.6.17
\--- compileClasspath
org.hibernate:hibernate-core:5.6.15.Final -> 5.6.15-hibernate-orm-5.6.17
+--- org.grails:grails-datastore-gorm-hibernate5:8.1.1
| \--- org.grails.plugins:hibernate5:8.1.1
| \--- compileClasspath (requested org.grails.plugins:hibernate5)
\--- org.grails.plugins:hibernate5:8.1.1 (*)
(*) - dependencies omitted (listed previously)
The trailing -spring-boot-<patch> / -hibernate-orm-<patch> suffixes confirm the NES build was selected. If the report instead resolves to a bare OSS version (e.g. 2.7.18 or 5.6.15.Final with no NES suffix), the BOM is not being applied — re-check the dependency-management import and registry credentials.
Troubleshooting
NoClassDefFoundError: Could not initialize class io.micronaut.inject.annotation.AnnotationMetadataSupport at startup.
Grails 6.2 transitively pulls in Micronaut 3.10, whose AnnotationMetadataSupport static initializer references jakarta.annotation.PreDestroy. Spring Boot 2.7's BOM pins jakarta.annotation:jakarta.annotation-api to 1.3.5 — which is published under the jakarta.annotation: coordinates but still ships the legacy javax.annotation.* classes inside. The jakarta.annotation.* classes Micronaut needs only appear in 2.x of that artifact.
Override the version explicitly in your build:
<dependencies>
<dependency>
<groupId>jakarta.annotation</groupId>
<artifactId>jakarta.annotation-api</artifactId>
<version>2.0.0</version>
</dependency>
</dependencies>
One known OSS exception (no action required): spring-boot-jarmode-layertools is injected by the Spring Boot Maven/Gradle plugins at the plugin's own pinned OSS version, bypassing every dependency-management mechanism. It has no known CVEs and is only used at JAR-extraction time, not at runtime. If you want to remove it entirely from the fat JAR you can disable the layered-JAR feature:
<configuration>
<layers>
<enabled>false</enabled>
</layers>
</configuration>
Manual Downloads
The direct download URL for the NES Grails BOM POM follows this format:
| Portion | Value |
|---|---|
| base_url | https://registry.nes.herodevs.com/maven/com/herodevs/nes/ |
| package_name | grails-nes-bom |
| version | 6.2.3 |
| filename | package_name + version + extension |