diff --git a/CHANGES.md b/CHANGES.md
index f6671d2191..51d80b960f 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -13,6 +13,7 @@ We adhere to the [keepachangelog](https://keepachangelog.com/en/1.0.0/) format (
 ### Fixed
 * Don't treat `@Value` as a type annotation [#1367](https://github.com/diffplug/spotless/pull/1367)
 * Support `ktlint_disabled_rules` in `ktlint` 0.47.x [#1378](https://github.com/diffplug/spotless/pull/1378)
+* Upgrade org.codehaus.groovy:groovy-xml:3.0.10 to org.apache.groovy:groovy-xml:4.0.6 [#1405](https://github.com/diffplug/spotless/pull/1405)
 
 ## [2.30.0] - 2022-09-14
 ### Added
diff --git a/lib-extra/build.gradle b/lib-extra/build.gradle
index 38e7c37403..ee3288d71b 100644
--- a/lib-extra/build.gradle
+++ b/lib-extra/build.gradle
@@ -15,7 +15,7 @@ dependencies {
 	implementation "org.eclipse.jgit:org.eclipse.jgit:${VER_JGIT}"
 	implementation "com.googlecode.concurrent-trees:concurrent-trees:2.6.1"
 	// used for xml parsing in EclipseFormatter
-	implementation "org.codehaus.groovy:groovy-xml:3.0.10"
+	implementation "org.apache.groovy:groovy-xml:4.0.6"
 
 	// testing
 	testImplementation project(':testlib')