I would need some help with this security vulnerability CVE-2019-9628 - We see that grails package uses the OpenSAML -> XMLtooling package which has the following CVE-2019-9628. https://mvnrepository.com/artifact/org.opensaml/xmltooling Is grails affected by this vulnerable or any guidance on remediation? CVE-2016-1000027 - Is there a way to remove the httpInvoker package that is deprecated. Right now its showing in scan reports from microsoft defender and tagging it as critical, some of our federal customers have concerns, as they have security policy to not install applications with critical vulnerability. We are using grails 6.2.2 and can't move to 7 as its still in MVP, where this has been resolved. Also do you have an ETA when Grails 7 with be GA

"Also do you have an ETA when Grails 7 with be GA" - https://github.com/orgs/grails/discussions/13561#discussioncomment-11004893. That isn't talking about GA but is a data point. FYI... At https://github.com/grails/grails-core/issues/13757#issue-2589881216 the team indicates that the first milestone of Grails 8 may be less than a year away at this point (October '25) and GA just a little over a year away (January '26).

Here is a link with more information, it is not the solution but it may help https://github.com/grails/grails-core/issues/13834

I don't see OpenSAML included by default in a grails installation of moderate size on 6.2.1. @User have you run

./gradlew dependencies

on your project to see where that library is coming from?

Let me run the gradle dependency and get back to you.