feat(deps): Bump Micronaut platform to 5.0.0 (GA)

[jamesfredley]

Draft - stacked on deps/spring-boot-4.0.6 (#15676) so the Spring Boot 4.0.6 dependency fallout does not muddy this one.

Bumps micronautPlatformVersion from 5.0.0-M2 to 5.0.0 (GA).

Release notes: https://github.com/micronaut-projects/micronaut-platform/releases/tag/v5.0.0

The core problem

Micronaut 5.0.0 GA publishes JARs targeting JVM 25 bytecode and declares org.gradle.jvm.version=25. Grails 8 keeps its baseline at JDK 21. A sub-25 JDK cannot resolve or compile the Micronaut platform, so the Grails-Micronaut "island" - grails-micronaut, grails-micronaut-bom, and the micronaut-tied grails-test-examples-* - cannot be part of a JDK 21 build.

What this PR does

1. Platform bump

• gradle.properties: micronautPlatformVersion 5.0.0-M2 -> 5.0.0.
• dependencies.gradle: bump the grails-micronaut-bom Groovy override to 5.0.6 to match Micronaut 5 GA's managed groovy.version. Spock stays at 2.4-groovy-5.0.
• grails-bom/micronaut/build.gradle: the tools.jackson exclude stays so spring-boot-dependencies remains the single source of truth for Jackson 3 (Micronaut 5 GA ships jackson-bom 3.1.3, Spring Boot 4.0.6 ships 3.1.2).

2. The island is toggled automatically by the build JDK

settings.gradle now decides island membership from the JDK running the build:

• sub-25 JDK -> island auto-excluded. A plain ./gradlew build works on the Grails 8 baseline (JDK 21) with no flags.
• JDK 25+ -> island auto-included. The same command transparently builds the Micronaut island too.

Two presence-based overrides always win over the auto-detection:

• -PskipMicronautProjects - force-exclude on any JDK.
• -PincludeMicronautProjects - force-include on a sub-25 JDK (escape hatch; the island still cannot compile there).
• -PskipMicronautProjects wins if both are passed.

3. CI (gradle.yml)

• Java 21 jobs build/test everything except the island; Java 25 jobs build the full graph. This now follows purely from the JDK each job pins via setup-java - the old matrix.java == 21 && -PskipMicronautProjects conditionals are gone.
• Snapshot publish is split: the publish job (JDK 21) publishes everything except the island; a publishMicronaut job (JDK 25) publishes grails-micronaut + grails-micronaut-bom.

4. Apache release flow (release.yml) + reproducibility

ASF releases must be byte-for-byte reproducible against a pinned JDK. The flow keeps JAVA_VERSION=21.0.7 for everything outside the island and adds a second pin JAVA_VERSION_MICRONAUT=25.0.3 for the island:

• JDK 21 staging-publish steps build everything except the island (auto-pruned on JDK 21); a dedicated step switches to JDK 25 to sign + stage the two island artifacts against the same staging repo, then restores JDK 21 for the close + checksum-combine steps.
• etc/bin/Dockerfile: the verification container installs a second Liberica JDK 25 (pinned version + multi-arch SHA-512) exposed as $JDK_25_HOME; JDK 21 stays the default.
• etc/bin/verify-reproducible.sh + etc/bin/test-reproducible-builds.sh: each runs a JDK 21 pass for everything outside the island, then a JAVA_HOME=$JDK_25_HOME pass for the two island artifacts. Both fail fast when $JDK_25_HOME is unset.
• RELEASE.md documents the dual-JDK requirement.

The explicit -PskipMicronautProjects flag is retained only where it is not a JDK proxy:

• groovy-joint-workflow.yml - the island's Groovy 5 / Spock 2.4-groovy-5.0 pin clashes with the Groovy 4.x snapshot that build swaps in, a reason independent of the JDK (CI - Groovy Joint Validation Build is broken: spock-core:2.4-groovy-5.0 incompatible with Groovy 4.x snapshot #15613).
• the standalone verify scripts - their first pass must exclude the island regardless of the ambient default JDK on PATH.

5. Micronaut HTTP client removed from grails-data-graphql tests

GraphQLSpec previously pulled micronaut-rxjava2-http-client + micronaut-serde-jackson just to call the running app from integration tests. Micronaut 5 drops RxJava 2 from the BOM, so it now uses Spring Boot 4's RestClient with Groovy JsonOutput / JsonSlurper (no Jackson or Gson on the test classpath). gradle.properties loses the now-unused micronautRxjava2Version and micronautSerdeJacksonVersion pins. Nothing in grails-core now depends on Micronaut artifacts outside the island.

Consumer impact

The published grails-micronaut:8.0.0 artifact carries org.gradle.jvm.version=25. Grails 8 apps on JDK 21 will have Gradle variant resolution reject it - it is consumable only on JDK 25+. JDK 21 users get the rest of Grails 8 without the Micronaut integration. The release ships both audiences; choosing the right artifact set is on the consumer's build config.

Key versions in Micronaut 5.0.0 GA

Property	Version
micronaut.core.version	5.0.0
micronaut.data.version	5.0.1
micronaut.serde.version	3.0.0
jackson.version	3.1.3
groovy.version	5.0.6
spring.boot.version	4.0.6
spring.version	7.0.7

Platform-level breaking changes in v5.0.0 that are landmines for downstream Grails-on-Micronaut apps (not consumed by grails-core itself): RxJava 2 and MicroStream removed from the BOM, jaxrs.api.version 3 -> 4, kafka.version 3.9 -> 4.2.

grails-forge stays on micronautVersion=4.10.10 (the Forge is itself a Micronaut 4.x app) - out of scope for this platform bump.

Verification

# JDK 21 (Grails baseline): builds the full graph minus the island, no flags needed
./gradlew validateDependencyVersions compileGroovy compileTestGroovy

# JDK 25: builds the full graph including the island
./gradlew build

Project-graph toggle verified on JDK 21 via ./gradlew projects: island absent by default, present with -PincludeMicronautProjects, absent with both override flags (skip wins).

[jamesfredley]

Micronaut-leak audit (post-228f9a52ce)

Did a full grep for io.micronaut across every build.gradle in the main grails-core multi-project to confirm nothing JDK-25 lives outside the -PskipMicronautProjects gating. Clean result.

Every build.gradle referencing io.micronaut in the main build

build.gradle	Project	In the island gating?
grails-bom/micronaut/build.gradle	:grails-micronaut-bom	✅
grails-micronaut/build.gradle	:grails-micronaut	✅
grails-test-examples/micronaut/build.gradle	:grails-test-examples-micronaut	✅
grails-test-examples/plugins/issue-11767/build.gradle	:grails-test-examples-plugins-issue-11767	✅
grails-test-examples/plugins/micronaut-singleton/build.gradle	:grails-test-examples-plugins-micronaut-singleton	✅

Plus the two transitive consumers that depend on :grails-micronaut without naming io.micronaut directly:

• :grails-test-examples-issue-11767 (grails-test-examples/issue-11767/)
• :grails-test-examples-micronaut-groovy-only (grails-test-examples/micronaut-groovy-only/)

All seven live inside the if (!skipMicronautProjects) { ... } block at settings.gradle:511-520.

Heads up: island is 7 projects, not 5

I'd been referring to "5 island projects" in earlier commits and the PR description. The correct count from settings.gradle is 7 build-graph projects in the island (the two missing in my count were :grails-test-examples-issue-11767 and :grails-test-examples-plugins-issue-11767). The two issue-11767 projects exist to repro apache/grails-core#11767 and depend on :grails-micronaut + :grails-micronaut-bom, so they correctly belong in the island gating.

The PUBLISHED subset is still just 2 (grails-micronaut plugin + grails-micronaut-bom), which is what publishMicronaut in gradle.yml and the new JDK 25 publish step in release.yml stage. The three test-examples + two issue-11767 projects build inside the island but aren't published.

grails-data-graphql was the only real leak; it's fixed

grails-data-graphql/plugin was the only non-island main-build project with a direct io.micronaut.* dependency, via the rxjava2 HTTP client compileOnly in GraphQLSpec.groovy. Removed in 228f9a52ce (replaced with Spring RestClient + Groovy JsonSlurper).

grails-forge/ is intentionally separate

The 50+ io.micronaut.* references in grails-forge/*/build.gradle are all in the separate composite build which is itself a Micronaut 4.10.10 app (grails-forge/gradle.properties:27). Out of scope - the Forge stays on Micronaut 4.x regardless of what the main grails-core multi-project does with Micronaut 5.

Net

Nothing in grails-core outside the explicitly-gated 7-project Micronaut island pulls Micronaut 5 / JDK 25 onto the JDK 21 classpath. The Forge composite is its own Micronaut 4.x universe. Audit clean.

[jdaugherty]

Is this supposed to still be draft?

[Copilot]

Pull request overview

This PR bumps the Micronaut platform to 5.0.0 GA and adapts the build, CI, release, and GraphQL test infrastructure for Micronaut’s JDK 25 requirement while keeping the rest of Grails on the JDK 21 baseline.

Changes:

• Updates Micronaut/Groovy dependency versions and removes obsolete RxJava2/Serde test dependencies.
• Splits CI/release/reproducibility flows so non-Micronaut projects run on JDK 21 and the Grails-Micronaut island runs on JDK 25.
• Replaces GraphQL integration-test HTTP usage from Micronaut client APIs to Spring RestClient.

Reviewed changes

Copilot reviewed 34 out of 37 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
RELEASE.md	Documents the dual-JDK reproducibility and verification process.
.sdkmanrc	Documents the primary JDK pin and secondary JDK requirement.
gradle.properties	Bumps micronautPlatformVersion and removes unused Micronaut pins.
dependencies.gradle	Aligns the Micronaut BOM Groovy override with Micronaut 5 GA.
grails-bom/micronaut/build.gradle	Updates Jackson exclusion rationale.
grails-data-graphql/plugin/build.gradle	Replaces Micronaut client compile dependency with Spring Web.
grails-data-graphql/plugin/src/main/groovy/org/grails/gorm/graphql/plugin/testing/GraphQLSpec.groovy	Rewrites GraphQL test helper to use RestClient and Groovy JSON parsing.
grails-test-examples/graphql/grails-test-app/build.gradle	Removes Micronaut HTTP client and Serde dependencies.
grails-test-examples/graphql/grails-test-app/src/integration-test/groovy/grails/test/app/*.groovy	Updates GraphQL response body access for ResponseEntity.
grails-test-examples/graphql/grails-tenant-app/build.gradle	Removes Micronaut test HTTP dependencies.
grails-test-examples/graphql/grails-tenant-app/src/integration-test/groovy/grails/tenant/app/UserIntegrationSpec.groovy	Updates GraphQL response body access.
grails-test-examples/graphql/grails-multi-datastore-app/build.gradle	Removes Micronaut test HTTP dependencies.
grails-test-examples/graphql/grails-multi-datastore-app/src/integration-test/groovy/myapp/BarIntegrationSpec.groovy	Updates GraphQL response body access.
grails-test-examples/graphql/grails-multi-datastore-app/src/integration-test/groovy/myapp/FooIntegrationSpec.groovy	Updates GraphQL response body access.
grails-test-examples/graphql/grails-docs-app/build.gradle	Removes unused Micronaut test HTTP dependencies.
etc/bin/Dockerfile	Adds pinned secondary Liberica JDK 25 for reproducible Micronaut builds.
etc/bin/verify-reproducible.sh	Splits reproducibility verification into JDK 21 and JDK 25 passes.
etc/bin/test-reproducible-builds.sh	Splits local reproducibility testing into JDK 21 and JDK 25 passes.
.github/workflows/gradle.yml	Skips Micronaut projects on JDK 21 jobs and adds JDK 25 Micronaut snapshot publishing.
.github/workflows/release.yml	Splits release publishing between JDK 21 and JDK 25.
.github/workflows/release-publish-docs.yml	Skips Micronaut projects for JDK 21 docs publishing.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[bito-code-review]

The PR diff shows that the grails-micronaut and grails-micronaut-bom projects are skipped in Java 21 jobs using the -PskipMicronautProjects flag. This flag is applied in multiple build jobs to avoid compiling JVM-25-specific Micronaut code on Java 21. However, the final release step does not include these projects in the checksum and artifact aggregation, leading to incomplete CHECKSUMS.txt and PUBLISHED_ARTIFACTS.txt files. To fix this, the aggregation tasks aggregateChecksums and aggregatePublishedArtifacts should be added to the JDK 25 step to ensure the Micronaut artifacts are included in the final release files.

.github/workflows/gradle.yml

build:
      name: "Build Grails-Core (Java ${{ matrix.java }}, indy=${{ matrix.indy }})"
      strategy:
        matrix:
          java: [21, 25]
          indy: [true, false]
      runs-on: ubuntu-latest
      steps:
        - name: "Checkout code"
          uses: actions/checkout@v2
        - name: "🔍 Setup TestLens"
          uses: testlens-app/setup-testlens@v1
        - name: "🔨 Build project"
          run: >
            ./gradlew build :grails-shell-cli:installDist groovydoc
            --continue
            --stacktrace
            -PonlyCoreTests
            -PskipCodeStyle
            ${{ matrix.java == 21 && '-PskipMicronautProjects' || '' }}

[jamesfredley]

Forge behavior: the grails-micronaut feature and Java versions

Documenting the current Forge behavior (asked about earlier - it was already in place on this branch, committed in 5f94d86f79).

What happens

When the grails-micronaut feature is selected in Grails Forge (CLI, web UI, or API) and the requested target JDK is below 25, app generation is rejected - no project is produced. The feature's processSelectedFeatures hook throws:

grails-micronaut requires JDK 25 or later (selected: JDK <NN>).

Selecting the feature with JDK 25+ generates the app normally.

Where it is enforced

org.grails.forge.feature.micronaut.GrailsMicronaut#processSelectedFeatures:

JdkVersion jdk = featureContext.getJavaVersion();
if (jdk.majorVersion() < JdkVersion.JDK_25.majorVersion()) {
    throw new IllegalArgumentException(
        getName() + " requires JDK 25 or later (selected: JDK " + jdk.majorVersion() + ").");
}

Why JDK 25

micronaut-core's ScopedValues references java.lang.ScopedValue.CallableOp, which only exists on JDK 25+ (JEP 506). More broadly, the Micronaut 5.0.0 GA platform bumped in this PR publishes JARs with org.gradle.jvm.version=25 and JVM 25 bytecode. This is the same constraint that drives the consumer-side note in the PR description: the published grails-micronaut:8.0.0 artifact carries org.gradle.jvm.version=25, so Grails 8 apps on JDK 21 cannot resolve it. Forge fails fast at generation time rather than letting users discover the incompatibility at build time.

Related Forge validation

GrailsMicronautValidator#validatePreProcessing additionally rejects combining grails-micronaut with Spring Boot DevTools (see micronaut-projects/micronaut-spring#769):

Spring Boot DevTools are not supported with Grails Micronaut

Note on test coverage

The JDK 25 guard itself currently has no dedicated negative test - existing specs that exercise grails-micronaut simply supply JdkVersion.JDK_25 so they pass. If desired, I can add a Forge spec asserting that selecting grails-micronaut with a sub-25 JDK throws the expected IllegalArgumentException. Let me know and I'll include it.

[jamesfredley]

Added the negative test in cb75043 (GrailsMicronautSpec). It covers both directions of the guard:

• grails-micronaut + JDK 25 -> the org.apache.grails:grails-micronaut dependency is rendered.
• grails-micronaut + JDK 21 -> generation is rejected with IllegalArgumentException: grails-micronaut requires JDK 25 or later (selected: JDK 21).

Verified locally (run with -PskipMicronautProjects, which the Forge composite needs on JDK 21 because of includeBuild('..')):

GrailsMicronautSpec > test grails-micronaut adds the dependency when JDK 25 is selected PASSED
GrailsMicronautSpec > test grails-micronaut is rejected when the selected JDK is below 25 PASSED
BUILD SUCCESSFUL

[jamesfredley]

Local build now keys off the build JDK

Pushed a change to settings.gradle so the Grails-Micronaut island is selected by whatever JDK runs the build, instead of having to remember a flag:

• ./gradlew build on JDK 21 (the Grails 8 baseline) just works. The island is auto-excluded because Micronaut 5 GA bytecode targets JVM 25 and a sub-25 JDK cannot resolve or compile it. No -PskipMicronautProjects needed anymore.
• ./gradlew build on JDK 25+ also builds Micronaut locally. When the build JDK is 25 or newer the island is auto-included, so the same command builds the full graph - no flag, no separate task list.

Explicit flags still win over the detection:

• -PskipMicronautProjects force-excludes the island on any JDK (this is what groovy-joint-workflow.yml uses - that exclusion is a Groovy-version reason, not a JDK reason, so it must hold even on JDK 25).
• -PincludeMicronautProjects force-includes the island on a sub-25 JDK (escape hatch; it still won't compile there, but the tasks become addressable).
• If both are passed, -PskipMicronautProjects wins.

Because each CI job pins its JDK via setup-java, the now-redundant matrix.java == 21 && -PskipMicronautProjects conditionals and the unconditional JDK-21 skip flags were removed from gradle.yml, release.yml, and release-publish-docs.yml - the JDK the job runs on decides it. The explicit flag is kept only where it is not a JDK proxy: groovy-joint-workflow.yml (Groovy reason) and the standalone etc/bin verify scripts (their first pass must exclude the island regardless of the ambient default JDK).

Verified on JDK 21 with ./gradlew projects: island absent by default, present with -PincludeMicronautProjects, absent with both flags.

[testlens-app]

🔎 No tests executed 🔎

🏷️ Commit: 40d0bc6
▶️ Tests: 0 executed
⚪️ Checks: 35/35 completed

---

Learn more about TestLens at testlens.app.