diff --git a/lucene/CHANGES.txt b/lucene/CHANGES.txt
index b0619301b4f..c531b5af542 100644
--- a/lucene/CHANGES.txt
+++ b/lucene/CHANGES.txt
@@ -130,6 +130,8 @@ Build
 * LUCENE-7935: Publish .sha512 hash files with the release artifacts and stop
   publishing .md5 hashes since the algorithm is broken (janhoy)
 
+* LUCENE-8230: Upgrade forbiddenapis to version 2.5.  (Uwe Schindler)
+
 ======================= Lucene 7.3.0 =======================
 
 API Changes
diff --git a/lucene/common-build.xml b/lucene/common-build.xml
index 5465220f40c..dafe935f29f 100644
--- a/lucene/common-build.xml
+++ b/lucene/common-build.xml
@@ -2419,7 +2419,7 @@ ${ant.project.name}.test.dependencies=${test.classpath.list}
 
   <!-- GROOVY scripting engine for ANT tasks -->
   <target name="resolve-groovy" unless="groovy.loaded" depends="ivy-availability-check,ivy-configure">
-    <ivy:cachepath organisation="org.codehaus.groovy" module="groovy-all" revision="2.4.13"
+    <ivy:cachepath organisation="org.codehaus.groovy" module="groovy-all" revision="2.4.15"
       inline="true" conf="default" type="jar" transitive="true" pathid="groovy.classpath"/>
     <taskdef name="groovy"
       classname="org.codehaus.groovy.ant.Groovy"
@@ -2433,7 +2433,7 @@ ${ant.project.name}.test.dependencies=${test.classpath.list}
   <property name="forbidden-sysout-excludes" value=""/>
   
   <target name="-install-forbidden-apis" unless="forbidden-apis.loaded" depends="ivy-availability-check,ivy-configure">
-    <ivy:cachepath organisation="de.thetaphi" module="forbiddenapis" revision="2.4.1"
+    <ivy:cachepath organisation="de.thetaphi" module="forbiddenapis" revision="2.5"
       inline="true" conf="default" transitive="true" pathid="forbidden-apis.classpath"/>
     <taskdef name="forbidden-apis" classname="de.thetaphi.forbiddenapis.ant.AntTask" classpathref="forbidden-apis.classpath"/>
     <property name="forbidden-apis.loaded" value="true"/>