Grails 9 on Groovy 6.0.0-beta-2

.agents/skills/groovy-developer/SKILL.md

@@ -112,7 +112,7 @@ def firstTitle = books?.first()?.title ?: "No books"
 ### Ternary Operator
 ```groovy
 // Use ternary operators only for simple conditions.
-// Split long ternary expressions into multiple lines. 
+// Split long ternary expressions into multiple lines.
 // Align `?` and `:` branches for readability.
 String message = condition
         ? "Value when true"

.github/workflows/groovy-joint-workflow.yml

@@ -60,15 +60,21 @@ jobs:
         run: |
           # Extract the major version of `groovy.version` declared in this branch's
           # dependencies.gradle (e.g. '5.0.5' -> '5', '4.0.31' -> '4') and use it to
-          # pick the matching Apache Groovy development branch (GROOVY_<major>_0_X).
+          # pick the matching Apache Groovy development branch (GROOVY_<major>_0_X),
+          # or master for the current Groovy development line before a maintenance
+          # branch exists.
           # This keeps `7.0.x` PRs validating against Groovy 4 and `8.0.x` PRs
           # validating against Groovy 5 without hard-coding the branch here.
           GROOVY_MAJOR=$(grep -m 1 "'groovy\.version'" dependencies.gradle | sed -E "s/.*'([0-9]+)\.[0-9]+\.[0-9]+.*/\1/" | tr -d '[:space:]')
           if [ -z "$GROOVY_MAJOR" ]; then
             echo "::error::Could not determine Apache Groovy major version from dependencies.gradle"
             exit 1
           fi
-          GROOVY_BRANCH="GROOVY_${GROOVY_MAJOR}_0_X"
+          if [ "$GROOVY_MAJOR" = "6" ]; then
+            GROOVY_BRANCH="master"
+          else
+            GROOVY_BRANCH="GROOVY_${GROOVY_MAJOR}_0_X"
+          fi
           echo "Validating against Apache Groovy branch: $GROOVY_BRANCH"
           echo "value=$GROOVY_BRANCH" >> $GITHUB_OUTPUT
           rm dependencies.gradle
@@ -163,4 +169,4 @@ jobs:
           -PskipMicronautProjects
           -PmaxTestParallel=3
         env:
-          GRAILS_INCLUDE_MAVEN_LOCAL: true
+          GRAILS_INCLUDE_MAVEN_LOCAL: true

.sdkmanrc

@@ -8,4 +8,4 @@
 java=21.0.7-librca
 # Keep gradle version synced with gradle.properties (gradleToolingApiVersion).
 # Update the gradle-bootstrap project to propagate the version to all gradle-wrapper.properties files.
-gradle=9.6.0
+gradle=9.6.1

build-logic/gradle/wrapper/gradle-wrapper.properties

@@ -2,7 +2,7 @@
 # and grails-forge/grails-forge-core/src/main/java/org/grails/forge/feature/build/gradle/templates/gradleWrapperProperties.rocker.raw
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-9.6.0-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-9.6.1-bin.zip
 networkTimeout=10000
 retries=0
 retryBackOffMs=500

build-logic/plugins/src/main/groovy/org/apache/grails/buildsrc/CompilePlugin.groovy

@@ -33,6 +33,7 @@ import org.gradle.api.tasks.bundling.Jar
 import org.gradle.api.tasks.compile.GroovyCompile
 import org.gradle.api.tasks.compile.JavaCompile
 import org.gradle.api.tasks.javadoc.Javadoc
+import org.gradle.api.tasks.testing.Test
 import org.gradle.external.javadoc.StandardJavadocDocletOptions
 
 import static org.apache.grails.buildsrc.GradleUtils.lookupPropertyByType
@@ -112,7 +113,7 @@ class CompilePlugin implements Plugin<Project> {
                 it.options.fork = true
                 // always set an isolated build to ensure grails.factories aren't accidentally merged since every project
                 // in this mono repo should be an isolated projected
-                it.options.forkOptions.jvmArgs = ['-Xms128M', '-Xmx2G', '-Dgrails.isolated.build=true']
+                it.options.forkOptions.jvmArgs = ['-Xms128M', '-Xmx2G', '-Dgrails.isolated.build=true', '-Dspock.iKnowWhatImDoing.disableGroovyVersionCheck=true']
                 // Publish THIS project's base.dir to the forked Groovy compiler. Gradle reuses a forked
                 // compiler daemon for a task whose requested fork arguments the daemon already satisfies,
                 // so a compile that does NOT request base.dir can be handed a daemon started for another
@@ -133,6 +134,9 @@ class CompilePlugin implements Plugin<Project> {
                 it.groovyOptions.configurationScript =
                         GradleUtils.findRootGrailsCoreDir(project).file('gradle/groovy-compile-configscript.groovy').asFile
             }
+            project.tasks.withType(Test).configureEach {
+                it.jvmArgs('-Dspock.iKnowWhatImDoing.disableGroovyVersionCheck=true')
+            }
         }
     }
 

build-logic/plugins/src/main/groovy/org/apache/grails/buildsrc/SbomPlugin.groovy

@@ -104,12 +104,13 @@ class SbomPlugin implements Plugin<Project> {
             'pkg:maven/com.oracle.coherence.ce/coherence-bom@25.03.1?type=pom': 'UPL-1.0', // does not have map based on license id
             'pkg:maven/com.oracle.coherence.ce/coherence-bom@25.03.2?type=pom': 'UPL-1.0', // does not have map based on license id
             'pkg:maven/com.oracle.coherence.ce/coherence-bom@22.06.2?type=pom': 'UPL-1.0', // does not have map based on license id
-            'pkg:maven/jline/jline@2.14.6?type=jar'                           : 'BSD-2-Clause', // maps incorrectly because of https://github.com/CycloneDX/cyclonedx-core-java/issues/205
+            'pkg:maven/jline/jline@2.14.6?type=jar'                           : 'BSD-2-Clause', // legacy jline:jline group, BSD-2; maps incorrectly because of https://github.com/CycloneDX/cyclonedx-core-java/issues/205
             'pkg:maven/opensymphony/sitemesh@2.6.0?type=jar'                  : 'OpenSymphony', // custom license approved by legal LEGAL-707
             'pkg:maven/org.antlr/antlr4-runtime@4.7.2?type=jar'               : 'BSD-3-Clause', // maps incorrectly because of https://github.com/CycloneDX/cyclonedx-core-java/issues/205
             // The whole org.jline group declares "The BSD License", which maps incorrectly because of
             // https://github.com/CycloneDX/cyclonedx-core-java/issues/205 - the POMs point at BSD-3-Clause.
-            // jline.version tracks the JLine version Groovy ships, so every module resolves to one version.
+            // jline.version tracks the JLine version Groovy ships for the gradle BOM (3.x); Groovy 6
+            // may also pull JLine 4, handled by forcedLicenseFor below.
             'pkg:maven/org.jline/jansi@3.30.9?type=jar'                       : 'BSD-3-Clause',
             'pkg:maven/org.jline/jline@3.30.9?type=jar'                       : 'BSD-3-Clause',
             'pkg:maven/org.jline/jline-builtins@3.30.9?type=jar'              : 'BSD-3-Clause',
@@ -130,6 +131,18 @@ class SbomPlugin implements Plugin<Project> {
             'pkg:maven/org.bouncycastle/bcutil-jdk18on@1.84?type=jar'         : 'MIT',
     ]
 
+    private static String forcedLicenseFor(String bomRef) {
+        if (LICENSE_MAPPING.containsKey(bomRef)) {
+            return LICENSE_MAPPING[bomRef]
+        }
+        // JLine 4 LICENSE.txt confirms BSD-3-Clause, but CycloneDX misreports it as BSD-4-Clause
+        // (cyclonedx-core-java#205). This is limited to the org.jline Maven jar family resolved via Groovy 6.
+        if (bomRef.matches('pkg:maven/org\\.jline/[^/@?]+@4\\.[^?]+\\?type=jar')) {
+            return 'BSD-3-Clause'
+        }
+        null
+    }
+
     // we don't distribute these so these licenses are considered acceptable, but we still prefer ASF licenses.
     // Require a whitelist of any case of category X licenses to prevent accidental inclusion in a distributed artifact
     // this list will need to be updated anytime we change versions so we can revise the licenses
@@ -465,10 +478,10 @@ class SbomPlugin implements Plugin<Project> {
         }
 
         logger.info('Picking license for {} from {} choices', bomRef, licenseChoices.size())
-        if (LICENSE_MAPPING.containsKey(bomRef)) {
+        def licenseId = forcedLicenseFor(bomRef)
+        if (licenseId) {
             // There are several reasons that cyclone will get the license wrong, usually due to upstream not publishing information or publishing it incorrectly
             // see the licenseMapping map above for details
-            def licenseId = LICENSE_MAPPING[bomRef]
             logger.lifecycle('Forcing license for {} to {}', bomRef, licenseId)
 
             def licenseBlock = LICENSES[licenseId]

build-logic/plugins/src/test/groovy/org/apache/grails/buildsrc/SbomPluginSpec.groovy

@@ -34,6 +34,10 @@ class SbomPluginSpec extends Specification {
         [[license: [id: 'LGPL-2.1-only']]]
     }
 
+    private static List bsd4Choice() {
+        [[license: [id: 'BSD-4-Clause']]]
+    }
+
     static class FakeCliArtifactExtension {
         final Property<String> artifactId
         FakeCliArtifactExtension(Property<String> artifactId) { this.artifactId = artifactId }
@@ -97,4 +101,25 @@ class SbomPluginSpec extends Specification {
         e.message.contains('grails-data-hibernate5-dbmigration')
         e.message.contains('LGPL-2.1-only')
     }
+
+    void "JLine 4 Maven jars use the BSD-3-Clause correction for new versions"() {
+        expect:
+        SbomPlugin.pickLicense(LOGGER, 'grails-console', 'grails-console',
+                'pkg:maven/org.jline/jansi@4.3.1?type=jar', bsd4Choice()).id == 'BSD-3-Clause'
+    }
+
+    void "JLine 4 license correction is limited to JLine 4 Maven jars"() {
+        when:
+        SbomPlugin.pickLicense(LOGGER, 'grails-console', 'grails-console', bomRef, bsd4Choice())
+
+        then:
+        GradleException e = thrown(GradleException)
+        e.message.contains('BSD-4-Clause')
+
+        where:
+        bomRef << [
+                'pkg:maven/com.example/jansi@4.3.1?type=jar',
+                'pkg:maven/org.jline/jansi@3.3.1?type=jar'
+        ]
+    }
 }

dependencies.gradle

@@ -93,12 +93,16 @@ ext {
             // extended-scalars compatibility. See https://github.com/apache/grails-core/issues/15674
             'graphql-java.version'          : '25.0',
             'graphql-java-extended-scalars.version': '24.0',
-            'groovy.version'                : '5.0.8',
+            'groovy.version'                : '6.0.0-SNAPSHOT',
             'guava.version'                 : '33.6.0-jre',
             // Security: overrides spring-boot-dependencies (5.4.2). 5.4.3 fixes CVE-2026-54399 (httpcore5) and CVE-2026-54428 (httpcore5-h2).
             'httpcore5.version'             : '5.4.3',
-            // Security: overrides the transitive com.fasterxml Jackson 2.x. 2.21.5 fixes CVE-2026-54515 flagged against 2.21.4.
-            'jackson2.version'              : '2.21.5',
+            // Security + Groovy 6: overrides the transitive com.fasterxml Jackson 2.x. Bumped on this canary
+            // because groovy-yaml 6.0.0-SNAPSHOT and hibernate7-dbmigration resolve the com.fasterxml Jackson 2
+            // suite at 2.22.1; 2.22.1 is newer than 2.21.5 so it retains the CVE-2026-54515 fix while keeping the
+            // BOM >= every resolved Jackson 2 version (rule 14). jackson-annotations versions independently (2.22).
+            'jackson2.version'              : '2.22.1',
+            'jackson-annotations.version'   : '2.22',
             // Security: overrides spring-boot-dependencies (3.1.4). 3.1.5 fixes CVE-2026-59889 (JsonView bypass) flagged against jackson-databind.
             'jackson3.version'              : '3.1.5',
             'jquery.version'                : '4.0.0',
@@ -162,6 +166,7 @@ ext {
             'groovy'                   : "org.apache.groovy:groovy:${bomDependencyVersions['groovy.version']}",
             'groovy-ant'               : "org.apache.groovy:groovy-ant:${bomDependencyVersions['groovy.version']}",
             'groovy-astbuilder'        : "org.apache.groovy:groovy-astbuilder:${bomDependencyVersions['groovy.version']}",
+            'groovy-callsite'          : "org.apache.groovy:groovy-callsite:${bomDependencyVersions['groovy.version']}",
             'groovy-cli-commons'       : "org.apache.groovy:groovy-cli-commons:${bomDependencyVersions['groovy.version']}",
             'groovy-cli-picocli'       : "org.apache.groovy:groovy-cli-picocli:${bomDependencyVersions['groovy.version']}",
             'groovy-console'           : "org.apache.groovy:groovy-console:${bomDependencyVersions['groovy.version']}",
@@ -193,11 +198,14 @@ ext {
             // Security override of spring-boot-dependencies - see httpcore5.version
             'httpcore5'                   : "org.apache.httpcomponents.core5:httpcore5:${bomDependencyVersions['httpcore5.version']}",
             'httpcore5-h2'                : "org.apache.httpcomponents.core5:httpcore5-h2:${bomDependencyVersions['httpcore5.version']}",
-            // Security override of the transitive com.fasterxml Jackson 2.x - see jackson2.version. databind 2.21.5
-            // fixes CVE-2026-54515 and drags jackson-core to 2.21.5, so the BOM must manage core too (rule 14).
-            // jackson-annotations is out of lockstep (no 2.21.5 release) and stays transitively managed.
+            // Security override + Groovy 6 - see jackson2.version. groovy-yaml 6.0.0-SNAPSHOT pulls the com.fasterxml
+            // Jackson 2 suite at 2.22.0 (jackson-dataformat-yaml drags core/databind/datatype-jsr310), so the BOM must
+            // manage each of them at >= the resolved 2.22.0 (rule 14). jackson-annotations versions independently (2.22).
+            'jackson-annotations'         : "com.fasterxml.jackson.core:jackson-annotations:${bomDependencyVersions['jackson-annotations.version']}",
             'jackson2-core'               : "com.fasterxml.jackson.core:jackson-core:${bomDependencyVersions['jackson2.version']}",
             'jackson2-databind'           : "com.fasterxml.jackson.core:jackson-databind:${bomDependencyVersions['jackson2.version']}",
+            'jackson2-dataformat-yaml'    : "com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:${bomDependencyVersions['jackson2.version']}",
+            'jackson2-datatype-jsr310'    : "com.fasterxml.jackson.datatype:jackson-datatype-jsr310:${bomDependencyVersions['jackson2.version']}",
             // Security override of spring-boot-dependencies - see jackson3.version. databind 3.1.5 pins
             // jackson-core 3.1.5 via its parent pom, so the BOM must manage core in lockstep (rule 14).
             'jackson3-core'               : "tools.jackson.core:jackson-core:${bomDependencyVersions['jackson3.version']}",
@@ -313,7 +321,7 @@ ext {
         combinedDependencies += customBomDependencies
     } else if (project.name == 'grails-hibernate5-micronaut-bom') {
         customBomVersions = [
-                'groovy.version'             : bomDependencyVersions['groovy.version'],
+                'groovy.version'             : '5.0.8',
                 'liquibase-hibernate.version': '4.27.0',
                 'liquibase.version'          : '4.27.0',
                 'hibernate.version'          : '5.6.15.Final',

end-to-end/spring-dependency-management/build.gradle

@@ -70,6 +70,9 @@ dependencyManagement {
 // app hitting the same CVE would override the Spring-managed version property directly; reproduce that here,
 // sourcing the number from dependencies.gradle so it stays the single source of truth.
 apply from: rootProject.layout.projectDirectory.file('../dependencies.gradle')
+// Spring DM lets spring-boot-dependencies' Groovy property override the Grails BOM import.
+// Keep the canary runtime aligned with the Groovy version used to compile the framework.
+ext['groovy.version'] = bomDependencyVersions['groovy.version']
 ext['logback.version'] = bomDependencyVersions['logback.version']
 // Same situation for the Jackson 3 security override (CVE-2026-59889) - see jackson3.version in dependencies.gradle.
 ext['jackson-bom.version'] = bomDependencyVersions['jackson3.version']

end-to-end/spring-dependency-management/src/integration-test/groovy/springdm/HelloControllerSpec.groovy

@@ -35,11 +35,13 @@ import spock.lang.Tag
 @Tag('http-client')
 class HelloControllerSpec extends Specification implements HttpClientSupport {
 
-    void 'the application boots with Spring Dependency Management and serves a request'() {
+    void 'the application boots with Spring Dependency Management and serves controller and GSP requests'() {
         when:
-        def response = http('/hello')
+        def controllerResponse = http('/hello')
+        def gspResponse = http('/')
 
         then:
-        response.assertEquals(200, 'Hello from Spring Dependency Management')
+        controllerResponse.assertEquals(200, 'Hello from Spring Dependency Management')
+        gspResponse.assertContains(200, 'Spring Dependency Management Example')
     }
 }

gradle.properties

@@ -41,7 +41,7 @@ expectitCoreVersion=0.9.0
 gparsVersion=1.2.1
 # Keep gradle version synced with .sdkmanrc, all gradle-wrapper.properties files,
 # and grails-forge/grails-forge-core/src/main/java/org/grails/forge/feature/build/gradle/templates/gradleWrapperProperties.rocker.raw
-gradleToolingApiVersion=9.6.0
+gradleToolingApiVersion=9.6.1
 greenmailVersion=2.1.2
 javassistVersion=3.30.2-GA
 jnrPosixVersion=3.1.20
@@ -92,4 +92,7 @@ org.gradle.daemon=true
 #org.gradle.configureondemand=true
 # Note: groovydoc requires almost a doubling of this memory; if it could run in a process isolation, we could reduce this
 # This is a future TODO see groovydoc-tool-rewrite branch for experiementations with this
-org.gradle.jvmargs=-Dfile.encoding=UTF-8 -Xmx5G
+# grails8-groovy6-canary: carry Spock's compile-time Groovy version-check opt-out on the build JVM so
+# the forked gson/gsp view compiler (AbstractGroovyTemplateCompileTask) can propagate it; Spock's global
+# AST transform otherwise aborts view compilation under Groovy 6. Remove once Spock ships a groovy-6.0 build.
+org.gradle.jvmargs=-Dfile.encoding=UTF-8 -Xmx5G -Dspock.iKnowWhatImDoing.disableGroovyVersionCheck=true

gradle/functional-test-config.gradle

@@ -76,6 +76,10 @@ configurations.configureEach {
     }
 }
 
+tasks.withType(GroovyCompile).configureEach {
+    options.forkOptions.jvmArgs += ['-Dspock.iKnowWhatImDoing.disableGroovyVersionCheck=true']
+}
+
 List<String> debugArguments = [
         '-Xmx2g', '-Xdebug', '-Xnoagent', '-Djava.compiler=NONE',
         '-Xrunjdwp:transport=dt_socket,server=y,suspend=y,address=5005'

gradle/hibernate5-test-config.gradle

@@ -24,6 +24,10 @@ dependencies {
     add('testRuntimeOnly', 'org.objenesis:objenesis')
 }
 
+tasks.withType(GroovyCompile).configureEach {
+    options.forkOptions.jvmArgs += ['-Dspock.iKnowWhatImDoing.disableGroovyVersionCheck=true']
+}
+
 tasks.withType(Test).configureEach {
     // Honor DO_NOT_CACHE_TESTS=1 so developers can repeatedly invoke the same test command
     // without --rerun-tasks (and without recompiling everything else).

gradle/mongodb-forked-test-config.gradle

@@ -24,8 +24,12 @@ dependencies {
     add('testRuntimeOnly', 'org.objenesis:objenesis')
 }
 
+tasks.withType(GroovyCompile).configureEach {
+    options.forkOptions.jvmArgs += ['-Dspock.iKnowWhatImDoing.disableGroovyVersionCheck=true']
+}
+
 tasks.named('compileTestGroovy', GroovyCompile) {
-    groovyOptions.forkOptions.jvmArgs = ['-Xmx768m']
+    groovyOptions.forkOptions.jvmArgs = ['-Xmx768m', '-Dspock.iKnowWhatImDoing.disableGroovyVersionCheck=true']
 }
 
 tasks.withType(Test).configureEach {
@@ -51,7 +55,7 @@ tasks.withType(Test).configureEach {
 
     useJUnitPlatform()
     maxParallelForks = configuredTestParallel
-    jvmArgs = ['-Xmx768M']
+    jvmArgs = ['-Xmx768M', '-Dspock.iKnowWhatImDoing.disableGroovyVersionCheck=true']
     afterSuite {
         System.out.print('.')
         System.out.flush()
@@ -65,4 +69,4 @@ tasks.withType(Test).configureEach {
     }
     // Used in the TCK test to selectively enable/disable tests
     systemProperty('mongodb.gorm.suite', 'true')
-}
+}

gradle/mongodb-test-config.gradle

@@ -24,8 +24,12 @@ dependencies {
     add('testRuntimeOnly', 'org.objenesis:objenesis')
 }
 
+tasks.withType(GroovyCompile).configureEach {
+    options.forkOptions.jvmArgs += ['-Dspock.iKnowWhatImDoing.disableGroovyVersionCheck=true']
+}
+
 tasks.named('compileTestGroovy', GroovyCompile) {
-    groovyOptions.forkOptions.jvmArgs = ['-Xmx768m']
+    groovyOptions.forkOptions.jvmArgs = ['-Xmx768m', '-Dspock.iKnowWhatImDoing.disableGroovyVersionCheck=true']
 }
 
 tasks.withType(Test).configureEach {
@@ -51,7 +55,7 @@ tasks.withType(Test).configureEach {
 
     useJUnitPlatform()
     maxParallelForks = 1
-    jvmArgs = ['-Xmx1028M']
+    jvmArgs = ['-Xmx1028M', '-Dspock.iKnowWhatImDoing.disableGroovyVersionCheck=true']
     afterSuite {
         System.out.print('.')
         System.out.flush()