Release notes for Groovy 5.1

Recursive deletion no longer follows symbolic links into their targets. This affects the deleteDir() extension methods for File and (in the groovy-nio module) Path, as well as the compiler’s internal recursive delete used for stub directories. A symbolic link encountered within the tree being deleted is now treated as a leaf: the link itself is removed but the directory it points at, and that directory’s contents, are left untouched. Similarly, calling deleteDir() directly on a symbolic link now removes just the link. Previously, a link pointing outside the tree being deleted could cause files elsewhere on the filesystem to be deleted (GROOVY-12125).

Grape now rejects dependency coordinates (group, module, version, etc.) containing .. sequences, closing a potential path traversal vector when coordinates are derived from untrusted input (GROOVY-12073).

The @ASTTest annotation executes its closure during compilation, so merely compiling source carrying the annotation runs that code, whether or not the compiled result is ever executed. Embedders which compile source they do not control can now disable the annotation by setting the groovy.asttest.enable system property to false, making it a no-op. The default (true) preserves existing behavior. This mirrors the existing groovy.grape.enable property for @Grab (GROOVY-12236).