fix: add Java 23+/24+ compatibility JVM args and upgrade commons-lang3 to 3.20.0

[jamesfredley]

Summary

• Add version-conditional JVM arguments in GrailsGradlePlugin to suppress warnings on Java 23+ and 24+
• Override commons-lang3 from 3.17.0 (Spring Boot managed) to 3.20.0 in the Grails BOM
• Include Gradle TestKit functional tests for the JVM arg configuration

Changes

1. Java compatibility JVM args in GrailsGradlePlugin (#15216, #15343)

Adds configureJavaCompatibilityArgs(Project) which conditionally applies JVM flags to all Test and JavaExec tasks based on the target Java version (toolchain-aware, falls back to current JVM):

Flag	Java Version	Why
--sun-misc-unsafe-memory-access=allow	23+	JEP 471/498 - Netty 4.1.x uses sun.misc.Unsafe.allocateMemory for off-heap buffers. Terminal deprecation warnings appear on 23+. Suppresses until Netty migrates to MemorySegment (Netty 4.2+).
--enable-native-access=ALL-UNNAMED	24+	JEP 472 - hawtjni (JLine 2.x) and Netty call System.loadLibrary/native methods. Warning-only now, becomes mandatory deny in a future JDK.

Flags are not added on Java 17-22, avoiding Unrecognized option errors.

Implementation approach: Uses project.plugins.withId('java') with lazy configureEach callbacks so toolchain configuration is read after build script evaluation. Each flag logs at INFO level when added (e.g. Grails: adding --enable-native-access=ALL-UNNAMED to test for Java 25 compatibility).

Note on #15343: The original issue suggested --add-opens=java.base/sun.misc=ALL-UNNAMED, but that flag addresses module visibility, not the sun.misc.Unsafe memory-access deprecation. The correct flag is --sun-misc-unsafe-memory-access=allow.

2. commons-lang3 BOM override to 3.20.0 (#15045)

Spring Boot 3.5.x manages commons-lang3 at 3.17.0, which has two issues:

• LANG-1786: FastDatePrinter uses deprecated three-letter timezone IDs (e.g. PST, CST, EST), causing a flood of WARNING: Use of the three-letter time zone ID "XYZ" is deprecated messages on Java 25
• CVE-2025-48924: StackOverflowError in ClassUtils.getClass with crafted input (fixed in 3.18.0+)

Non-breaking changes analysis (3.17.0 -> 3.20.0)

All versions in this range require Java 8+ (unchanged baseline). There are no breaking changes:

Category	Details
Removed methods	None
Changed signatures	None
Changed behavior	LocaleUtils.toLocale() now accepts 2-letter country codes it previously rejected (more lenient, not breaking)
New deprecations	Several methods deprecated in favor of newer alternatives - existing calls continue to work
New methods	Additions to StringUtils, ArrayUtils, ClassUtils, etc. - purely additive
Bug fixes	LANG-1786 (timezone), LANG-1770 (NumberUtils), LANG-1754 (DurationUtils), among others
Security fixes	CVE-2025-48924 (ClassUtils StackOverflow)

3. Tests

New GrailsGradlePluginJavaCompatSpec with 4 Gradle TestKit functional tests:

Test	Toolchain	Verifies
No toolchain (current JDK)	None	Args match current JDK version
Toolchain = current JDK	Dynamic	Args match current JDK version
Toolchain = 23	23	Only --sun-misc-unsafe-memory-access=allow
Toolchain = 24	24	Both flags on both Test and JavaExec tasks

Files Changed

• grails-gradle/plugins/.../GrailsGradlePlugin.groovy - Added configureJavaCompatibilityArgs(), applyCompatArgs(), resolveTargetJavaVersion(), new imports
• dependencies.gradle - Added commons-lang3.version: 3.20.0 and commons-lang3 BOM entry
• grails-gradle/plugins/.../GrailsGradlePluginJavaCompatSpec.groovy - New test spec
• grails-gradle/plugins/.../test-projects/java-compat-* - 4 new test fixture projects

Related Issues

• Closes WARNING: Use of the three-letter time zone ID "ABC" is deprecated and it will be removed in a future release #15045
• Closes grails-cli: java.lang.System::loadLibrary has been called by org.fusesource.hawtjni.runtime.Library in Java 25 #15216
• Closes sun.misc.Unsafe::allocateMemory has been called by io.netty.util.internal.PlatformDependent #15343

[Copilot]

Pull request overview

This pull request adds Java 23+ and 24+ compatibility by configuring JVM arguments to suppress warnings from deprecated APIs and native access restrictions. It also upgrades commons-lang3 from 3.17.0 to 3.20.0 to fix timezone deprecation warnings and a security vulnerability.

Changes:

• Added version-conditional JVM argument configuration in GrailsGradlePlugin to suppress Java 23+ sun.misc.Unsafe warnings and Java 24+ native access warnings
• Upgraded commons-lang3 to 3.20.0 in the Grails BOM to fix LANG-1786 (timezone ID deprecation) and CVE-2025-48924
• Comprehensive Gradle TestKit functional tests for JVM argument configuration with multiple toolchain scenarios

Reviewed changes

Copilot reviewed 15 out of 19 changed files in this pull request and generated no comments.

File	Description
grails-gradle/plugins/src/main/groovy/org/grails/gradle/plugin/core/GrailsGradlePlugin.groovy	Added configureJavaCompatibilityArgs() method to conditionally apply JVM flags based on target Java version, plus helper method resolveTargetJavaVersion() and new imports
dependencies.gradle	Added commons-lang3 3.20.0 version override in BOM to supersede Spring Boot's managed 3.17.0
grails-gradle/plugins/src/test/groovy/org/grails/gradle/plugin/core/GrailsGradlePluginJavaCompatSpec.groovy	New test spec with 4 test cases covering no-toolchain, current-toolchain, Java 23, and Java 24 scenarios
grails-gradle/plugins/src/test/resources/test-projects/java-compat-*	Four test fixture projects for functional testing of JVM arg configuration

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Changes pushed