Apache Grails

Installation and configuration guide for NES for Apache Grails libraries

Overview

6.2.3 is the current NES release for Apache Grails 6.2.x. It is delivered as a single Bill of Materials (BOM) — com.herodevs:grails-nes-bom — that pins every Spring Boot, Spring Framework, Spring Security, Spring Data, Spring Session and Hibernate ORM artifact used by Grails 6.2.x to its HeroDevs NES version. Grails core and its plugins stay on their canonical OSS versions because no known CVEs exist in them so far!

Importing the BOM gives you a single, version-managed view of the stack: you declare dependencies without a version, and every Spring/Hibernate artifact in the resulting fat JAR is an NES build.

The BOM, as well as the actual NES Spring/Hibernate JARs are published to GitHub Packages:

https://registry.nes.herodevs.com/maven

You will need to configure credentials for this registry.

Setup Instructions

NES for Apache Grails 6.2.x requires Java 11.

You will need:

An NES access token (your HeroDevs portfolio token) for the NES Maven registry.

Configure Registry Credentials

Create or update your registry configuration:

Maven (~/.m2/settings.xml)

Gradle (~/.gradle/gradle.properties)

<settings>
  <servers>
    <server>
      <id>herodevs-nes-registry</id>
      <username>any_text_here_not_used</username>
      <password>YOUR_NES_ACCESS_TOKEN</password>
    </server>
  </servers>
</settings>

See the guides for Sonatype Nexus or JFrog Artifactory for setup to the HeroDevs NES registry.

Update Build Configuration

Import the BOM, then declare dependencies without versions — the BOM pins every Spring/Hibernate artifact to its NES version.

6.2.3 is the current NES Grails BOM release. See the "NES Maven Artifacts: Paid Versions" table for the published artifact.

Maven (pom.xml)

Gradle (build.gradle)

<!-- Import the NES Grails BOM -->
<dependencyManagement>
  <dependencies>
    <dependency>
      <groupId>com.herodevs.nes</groupId>
      <artifactId>grails-nes-bom</artifactId>
      <version>6.2.3</version>
      <type>pom</type>
      <scope>import</scope>
    </dependency>
  </dependencies>
</dependencyManagement>

<!-- Declare your Spring Boot / Grails / GORM deps without versions -->
<dependencies>
  <dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-web</artifactId>
  </dependency>
  <dependency>
    <groupId>org.grails</groupId>
    <artifactId>grails-web-boot</artifactId>
  </dependency>
</dependencies>

<!-- Add the NES registry -->
<repositories>
  <repository>
    <id>herodevs-nes-registry</id>
    <url>https://registry.nes.herodevs.com/maven</url>
  </repository>
</repositories>

<pluginRepositories>
  <pluginRepository>
    <id>herodevs-nes-registry</id>
    <url>https://registry.nes.herodevs.com/maven</url>
  </pluginRepository>
</pluginRepositories>

Build

In order to remove potential obstacles before building your project, make sure the following domains are whitelisted by your firewall/networking team:

registry.nes.herodevs.com
assets.nes.herodevs.com

This will ensure that your network/firewall allows connection to our registry.

Run your build tool:

Maven

Gradle

mvn clean package

Verification

To verify your installation, inspect the produced fat JAR and confirm every Spring/Hibernate-ORM artifact in BOOT-INF/lib/ carries an NES version suffix (-spring-framework-<patch>, -spring-boot-<patch>, -spring-security-<patch>, -hibernate-orm-<patch>, etc.):

unzip -l target/your-app-*.jar | grep -E 'BOOT-INF/lib/(spring|hibernate)-'

You should see entries like:

spring-core-5.3.39-spring-framework-5.3.51.jar
spring-boot-2.7.18-spring-boot-2.7.38.jar
spring-security-core-5.7.14-spring-security-5.7.23.jar
hibernate-core-5.6.15-hibernate-orm-5.6.17.jar

A bare version such as spring-core-5.3.39.jar would indicate an OSS artifact slipped through — re-check that the BOM is correctly imported and that the NES registry credentials in your settings file are valid.

Troubleshooting

NoClassDefFoundError: Could not initialize class io.micronaut.inject.annotation.AnnotationMetadataSupport at startup.

Grails 6.2 transitively pulls in Micronaut 3.10, whose AnnotationMetadataSupport static initializer references jakarta.annotation.PreDestroy. Spring Boot 2.7's BOM pins jakarta.annotation:jakarta.annotation-api to 1.3.5 — which is published under the jakarta.annotation: coordinates but still ships the legacy javax.annotation.* classes inside. The jakarta.annotation.* classes Micronaut needs only appear in 2.x of that artifact.

Override the version explicitly in your build:

Maven (pom.xml)

Gradle (build.gradle)

<dependencies>
  <dependency>
    <groupId>jakarta.annotation</groupId>
    <artifactId>jakarta.annotation-api</artifactId>
    <version>2.0.0</version>
  </dependency>
</dependencies>

One known OSS exception (no action required): spring-boot-jarmode-layertools is injected by the Spring Boot Maven/Gradle plugins at the plugin's own pinned OSS version, bypassing every dependency-management mechanism. It has no known CVEs and is only used at JAR-extraction time, not at runtime. If you want to remove it entirely from the fat JAR you can disable the layered-JAR feature:

Maven (spring-boot-maven-plugin <configuration>)

Gradle (bootJar task)

<configuration>
  <layers>
    <enabled>false</enabled>
  </layers>
</configuration>

Manual Downloads

The direct download URL for the NES Grails BOM POM follows this format:

Portion	Value
base_url	https://registry.nes.herodevs.com/maven/com/herodevs/nes/
package_name	grails-nes-bom
version	6.2.3
filename	package_name + version + extension

Example Link

https://registry.nes.herodevs.com/maven/com/herodevs/nes/grails-nes-bom/6.2.3/grails-nes-bom-6.2.3.pom