NES for Apache Grails Managed Dependency Versions
NES for Apache Grails managed dependency versions
Overview
Each NES Grails BOM pins every Spring Boot, Spring Framework, Spring Security, Spring Data, Spring Session and Hibernate ORM artifact used by its Grails line to the HeroDevs NES version. Grails core and its plugins stay on their canonical OSS versions because no known CVEs exist in them so far.
Grails 7.1.x (grails-nes-bom:7.1.1)
NES-pinned artifacts
| Component | OSS base | NES version |
|---|---|---|
| Spring Boot | 3.5.16 | 3.5.17 |
| Spring Framework | 6.2.19 | 6.2.20 |
| Spring Security | 6.5.11 | 6.5.12 |
| Spring Data (release train) | 2025.0.13 | 2025.0.14 |
| Spring Session | 3.5.7 | 3.5.8 |
| Hibernate ORM (jakarta) | 5.6.15 | 5.6.17 |
Resolved artifacts carry the dual-version suffix, e.g. spring-boot-3.5.16-spring-boot-3.5.17.jar, spring-core-6.2.19-spring-framework-6.2.20.jar, hibernate-core-jakarta-5.6.15-hibernate-orm-5.6.17.jar.
Spring Data modules are versioned per repository, not with the release train. Train 2025.0.13 corresponds to spring-data-jpa:3.5.13-spring-data-jpa-3.5.14, spring-data-mongodb:4.5.13-spring-data-mongodb-4.5.14, and so on — the BOM pins each module individually.
OSS components (no NES override)
The following are pinned by the BOM at their canonical OSS versions — no known CVEs apply:
| Component | Version |
|---|---|
Grails core / plugins (org.apache.grails) | 7.1.1 |
| Groovy | 4.0.31 |
| Embedded Tomcat | 10.1.55 |
| Jackson | 2.21.2 |
| MongoDB Java driver | 5.5.2 |
| Liquibase | 4.27.0 |
| JUnit | 5.13.3 |
| Spock | 2.3-groovy-4.0 |
Grails 6.2.x (grails-nes-bom:6.2.3)
NES-pinned artifacts
| Component | OSS base | NES version |
|---|---|---|
| Spring Boot | 2.7.18 | 2.7.38 |
| Spring Framework | 5.3.39 | 5.3.51 |
| Spring Security | 5.7.14 | 5.7.23 |
| Spring Data (BOM) | 2021.2.18 | 2021.2.26 |
| Spring Session (BOM) | 2021.2.3 | 2021.2.11 |
| Hibernate ORM | 5.6.15 | 5.6.17 |
Resolved artifacts carry the dual-version suffix, e.g. spring-core-5.3.39-spring-framework-5.3.51.jar, spring-boot-2.7.18-spring-boot-2.7.38.jar, hibernate-core-5.6.15-hibernate-orm-5.6.17.jar.
OSS components (no NES override)
The following are pinned by the BOM at their canonical OSS versions — no known CVEs apply:
| Component | Version |
|---|---|
| Grails core | 6.2.3 |
| Grails Gradle plugin | 6.2.4 |
| Grails GSP | 6.2.4 |
| Grails Views (JSON / Markup) | 3.2.3 |
| Grails Async / Events | 5.0.2 |
| Grails Testing Support | 3.2.2 |
| Grails Spring Security Core plugin | 6.0.3 |
| Grails Database Migration plugin | 4.2.1 |
| Groovy | 3.0.25 |
| Embedded Tomcat | 9.0.118 |
| Jackson | 2.15.4 |