Catalog / Spring Boot

4.1.2

yesterdaysecurityaddedfixedOriginal notes

:star: New Features

  • Add TWENTY_SEVEN to JavaVersion enum #51426

:lady_beetle: Bug Fixes

  • OriginTrackedResource does not implement equals correctly #52267
  • OriginTrackedPropertiesLoader drops properties whose name starts with # or ! #52265
  • JWTs are rejected when issuer-uri is empty and jwk-set-uri is set #52260
  • Package manifest attributes are missing for nested jars without directory entries #52258
  • Logback ColorConverter unnecessarily parses its options for every log event #52228
  • Empty system property in TestPropertyValues is cleared instead of being restored to its empty value #52208
  • Graceful shutdown of Tomcat or Jetty may call back with REQUESTS_ACTIVE when stop is called immediately after shutDownGracefully on an idle server #52197
  • NettyWebServer stop may hang when called immediately after shutDownGracefully #52196
  • gRPC client 'grpc' load balancing fails to bind with a NullPointerException when no child policies are configured #52193
  • Prevent gRPC client properties from overriding user customizations #52175
  • MongoDB fails to connect when credentials contain a space #52168
  • Authentication fails when password configured in spring.elasticsearch.uris contains a colon #52166
  • Logging can be lost when a context is paused by the test context framework #52088
  • Docker Compose support for MongoDB fails to connect when credentials contain a character that requires URL encoding #52084
  • Jersey does not use the endpoint ObjectMapper when Actuator is running on a separate port #51982
  • Fractions of a second are handled incorrectly when configuring gRPC service config durations #51957
  • Configuration property descriptions may be lost when building incrementally with Gradle #51925
  • BasicJsonParser mishandles escaped characters in nested lists and maps #51908
  • Zero week value conversion fails with 'intValue cannot be extracted from WEEKS' exception #51894
  • App fails to start when using DevTools and manually configuring JDBC or R2DBC without spring-boot-jdbc or spring-boot-r2dbc #51890
  • Docker Compose support incorrectly recognizes MARIADB_ALLOW_EMPTY_PASSWORD instead of MARIADB_ALLOW_EMPTY_ROOT_PASSWORD #51888
  • Auto-configured Kotlinx Serialization JSON codec customization is not applied #51877
  • NullPointerException can be thrown when using uber jars due to a race condition in NestedJarFileResources #51745
  • DevTools does not detect a reactive web environment #51730
  • spring.http.clients.cookie-handling has no effect when using a reactive client backed by an HttpComponents connector #51724
  • Connection fails when rabbitmq Docker Compose service is configured to use SSL #51667
  • SBOM-related manifest attributes are missing from Maven-packaged wars #51651
  • When server.reactive.session.cookie.same-site is not set, session cookies have no SameSite attribute #51639
  • OAuth2 resource server ignores authorities-claim-delimiter when set on its own #51630
  • developmentOnly and testAndDevelopmentOnly configurations do not specify any attributes causing potential resolution problems #51623
  • In a reactive web application, Cloud Foundry security integration returns a 500 rather than a 503 when the cloud controller URL is unavailable #51614
  • Layer temp file is not deleted when layer creation fails #51581
  • Docker Compose integration for RabbitMQ skips credential fallbacks when an environment variable has no value #51578
  • Some assertion messages name the wrong parameter #51574
  • OAuth2ResourceServerProperties.Jwt has a setter that does not match its getter #51562
  • jarmode tools commands print stacktrace instead of an error message #51547
  • Docker Compose ProcessRunner can hang or leave orphan processes #51538
  • NestedByteChannel.read(ByteBuffer) incorrectly returns 0 when buffer could not be filled #51520
  • Customizer null checks in HTTP client builders assert the wrong attribute #51513
  • SSL host config customizations may be lost during Tomcat initialization #51511
  • SQL Server Docker Compose integration may duplicate the JDBC URL's encrypt parameter #51481
  • WritableJson.toByteArray() may corrupt supplementary characters #51464
  • SSL host config customizations are lost when reloading SSL bundles #51457
  • OAuth2ClientProperties are not available when a user-defined ClientRegistrationRepository bean is provided #51450
  • LdapHealthIndicator reports UNKNOWN instead of UP when LDAP server doesn't expose a protocol version #51441
  • JmsHealthIndicator leaks watchdog threads if start fails immediately #51433
  • Source is not closed consistently by all JSON marshal testers #51418
  • File handle in SpringBootJoranConfigurator should be closed #51415
  • Honour a wrapper's unwrap when resolving the root DataSource #51410
  • Validation of deprecated io.buildpacks.stack.id is too aggressive #51400
  • ReactiveOAuth2ResourceServerWebSecurityAutoConfiguration annotated with wrong condition #50778

:notebook_with_decorative_cover: Documentation

  • Fix typo in gRPC testing documentation #52181
  • Fix Gradle example for servlet-based gRPC servers #51956
  • Fix actuator endpoint property names in Javadoc #51886
  • Document InetAddressFilter limitations with respect to proxy servers #51863
  • Document support for Java 27 #51825
  • Fix broken links from reference documentation to external Javadoc #51820
  • Remove reference to AppOptics in the reference guide as it has retired #51808
  • Fix broken links #51802
  • Update Spring Framework reference links #51771
  • Update testcontainers javadoc links #51765
  • Maven plugin documentation incorrectly references remote restart property #51747
  • Fix documented default of spring.test.database.replace #51728
  • Correct Jackson 3 Javadoc links #51663
  • Fix typo in deprecated Pushgateway base-url property metadata #51632
  • Document baggage propagation over gRPC #51597
  • Remove references to Spring Data Geode #51564
  • Fix typos in service containers javadoc and reference documentation #51445
  • Document SAML2 back-off in WebFlux security documentation #51435
  • Remove reference to removed SpringBootWebSecurityConfiguration #51413

:hammer: Dependency Upgrades

:heart: Contributors

Thank you to all the contributors who worked on this release:

@2heunxun, @CCCLL, @CHISANW, @COBI-98, @DevJunz, @JunggiKim, @LindseyZ1205, @MacAlsandair, @MycroCosmo, @NotAFlightRisk, @SebTardif, @dlwhdgus0810, @dlwldn30, @dmitrysulman, @fabio-grassi, @galenzo17, @geonheeryu, @hjm12223, @icikle, @janwaleed09, @jjh75607, @kdomo, @khopland, @ksky8864, @lavinhoque33, @msridhar, @ngocnhan-tran1996, @noojung, @o-shevchenko, @ohchanKyu, @padosol, @piyushrajyadav, @rvullriede, @ryujungkyun, @scordio, @scottfrederick, @timtebeek, @vlsi, @xoruddl, @xxxxxxjun, @yyuneu, and @zhoubiao188