This commit adds a new section in the Spring Boot reference
documentation to mention potential throughput limitations with Java
virtual threads support.
This section links to the official Java documentation which expands much
more on this matter.
Closes gh-38883
Prior to the introduction of SSL bundles, the `server.ssl` properties
allowed PEM and JKS certificate files types to be mixed when
configuring keystores and truststores. This was lost when adapting to
SSL bundles using `WebServerSslBundle`. This commit restores the
previous behavior for back compatibility.
Fixes gh-39105
Address a series of minor typos and phrasing inconsistencies
identified in few sections of documentation to enhance overall
clarity and readability.
See gh-38942
Improve `SpringApplication` by removing the unreachable throw statement
in favor of returning an exception from `handleRunFailure`. This commit
also removes the if statements in favor of dedicated catch blocks.
See gh-39107
Update `TestcontainersLifecycleBeanPostProcessor` so that containers
are now initialized either on the first `postProcessAfterInitialization`
call with a frozen configuration or just before a test container
property is supplied.
Prior to this commit, it was assumed that the first post-process call
after the configuration was frozen was suitably early to initialize
the containers. This turns out to not be no always the case.
Specifically, in the `finishBeanFactoryInitialization` method of
`AbstractApplicationContext` we see that `LoadTimeWeaverAware` beans
are obtained before the configuration is frozen. One such bean is
`DefaultPersistenceUnitManager` which is likely to need datasource
properties that will require a started container.
To fix the problem, the `TestcontainersPropertySource` now publishes
a `BeforeTestcontainersPropertySuppliedEvent` to the ApplicationContext
just before any value is supplied. By listening for this event, we can
ensure that containers are initialized and started before any dynamic
property is read.
Fixes gh-38913
Prior to this commit, the Micrometer annotations support (`@Timed`,
`@Counted`...) was guarded by the presence of both Micrometer and
AspectJ on the classpath.
This signal is too weak, considering the startup performance impact and
the fact that the AspectJ dependency can be brought transitively in many
cases.
This commit adds a new `micrometer.observations.annotations.enabled`
property that is set to `false` by default to only process the
annotations support when this property is enabled.
Fixes gh-39128
This is a follow-on from afad358 and ensures that the auto-configured
security for Actuator in a WebFlux app has an authentication manager
to back its use of HTTP basic and form login.
Fixes gh-39069
PatternParseException.toDetailedString() return a String
with a mark to specify the error position in the pattern.
The mark takes place in the second line in the String
returned. Because PatternParseFailureAnalyzer.analyze
appended "Invalid mapping pattern detected:" at the
beginning of the returned String, the mark was not well
positioned.
Now, a "\n" is inserted after "Invalid mapping pattern detected:"
and the mark is well positioned
See gh-38944
Update `NestedJarFile` so that the `getManifest()` method returns the
manifest from the parent jar file for nested jars based on directory
entries.
This restores the previous behavior supported by Spring Boot 3.1 and
allows class methods such as `getPackage().getImplementationVersion()`
to return non `null` results.
Fixes gh-38996
Update `AutoConfigurationSorter` so that `getClassesRequestedAfter()`
results are sorted to match the earlier name/order sorting. Prior to
this commit the order of items added via `@AutoConfigureAfter` was in
an undetermined order which could cause very subtle `@ConditionalOnBean`
bugs.
Thanks very much to Alexandre Baron for their help in diagnosing and
reproducing this issue.
Fixes gh-38904
Update `ZipContent` so that `META-INF` entries are no longer duplicated
in nested jars created from directory entries. This aligns with the
behavior of the classic loader and prevents the same META-INF file from
being discovered twice.
Fixes gh-38862
Update log4j configuration so that an empty value is used when
`LOGGED_APPLICATION_NAME` is missing. Prior to this commit when
`logging.include-application-name` was `false` the logged output
would include the raw `${sys:LOGGED_APPLICATION_NAME}` value.
See gh-38847
Update `JarFileArchive` so that unpacked jars use `file:` URLs rather
than `jar:file:`. This aligns with the behavior of Spring Boot 3.1 and
allows calls to `class.getSigners()` to work again.
Fixes gh-38833
Update `PulsarPropertiesMapper` to use JSON encoded parameters rather
than a `Map` since the `Map` method is deprecated in Pulsar. This
commit simply takes the auth params map and converts them to the
expected encoded JSON string of auth parameters.
See gh-38839
Update `TestcontainersLifecycleBeanPostProcessor` so that containers
can actually be started in parallel.
Prior to this commit, `initializeStartables` would collect beans
and in the process trigger the `postProcessAfterInitialization` method
on each bean. This would see that `startablesInitialized` was `true`
and call `startableBean.start` directly. The result of this was that
beans were actually started sequentially and when the `start` method
was finally called it had nothing to do.
The updated code uses an enum rather than a boolean so that the
`postProcessAfterInitialization` method no longer attempts to start
beans unless `initializeStartables` has finished.
Fixes gh-38831
Update `SpringApplication` so that `ApplicationRunner` and
`CommandLineRunner` beans are not considered from the parent
`ApplicationContext`.
The restores the behavior that applied before commit 7d6532cac4
whilst still retaining the correct run order.
Fixes gh-38647
Update `LoadedPemSslStore` so that it loads content lazily. This
restores the behavior of Spring Boot 3.1 and allows bundles to be
defined with files that don't exist as long as they are never accessed.
Fixes gh-38659
This commit removes the now defunkt `ErrorAttributes.ERROR_ATTRIBUTE`
that was introduce to register handled errors as metrics. This has been
replaced since 3.0 by a direct support in Spring Framework and had no
effect whatsoever since that release.
This also updates the documentation to point to the Framework mechanism
that replaced it.
Fixes gh-33731
There are some notable differences in the behavior of Spring
Security's reactive and servlet-based web security. Notably,
Servlet-based web security (`@EnableWebSecurity`) works without
any authentication manager, rejecting requests as not authorized.
By contrast reactive-based web security (`@EnableWebFluxSecurity`)
fails to start up when there's no authentication manager, either
provided directly as a bean or derived from a
ReactiveUserDetailsService. There are also further differences at
runtime where empty Monos from all ReactiveAuthenticationManagers
results in an internal error and a 500 response whereas a similar
situation in the servlet implementation results in a 401.
Previously, to accommodate these differences in behavior, Spring
Boot's auto-configuration would behave differently. In the Servlet
case, web security would be enabled whenever the necessary
dependencies were on the classpath. In the reactive case, web
security would back off in the absence of an authentication manager
to prevent a start up failure. While this difference is rooted in
Spring Security, it is undesirable and something that we want to
avoid Spring Boot users being exposed to where possible.
Unfortunately, the situation is more likely to occur than before
as ReactiveUserDetailsServiceAutoConfiguration now backs off more
readily (gh-35338). This makes it more likely that the context will
contain neither a reactive authetication manager not a reactive
user details service.
This commit reworks the auto-configurations related to reactive
security. ReactiveSecurityAutoConfiguration will now auto-configure
an "empty" reactive authentication manager that denies access through
Mono.error in the absence of a ReactiveAuthenticationManager,
ReactiveUserDetailsService, or SecurityWebFilterChain. The last of
these is to allow for the situation where a filter chain has been
defined with an authentication manager configured directly on it.
This configuration of an authentication manager allows
`@EnableWebFluxSecurity` to be auto-configured more readily,
removing one of the differences between reactive- and Servlet-based
security.
Corresponding updates to the auto-configurations for reactive OAuth2
support have also been made. They no longer try to auto-configure
`@EnableWebFluxSecurity`, relying instead upon
ReactiveSecurityAutoConfiguration, which they are ordered before, to
do that instead.
Closes gh-38713
The stream auto-configuration is tested in RabbitStreamConfigurationTests,
and excluding it prevents the creation of the "rabbitStreamEnvironment"
Environment bean, which delays the application context close by 1 second
because it has to wait for some Netty resources to gracefully shut down.
Closes gh-38750
If @AutoConfigureObservability is applied to a sliced test, it
auto-configures:
- An in-memory MeterRegistry
- A no-op Tracer
- An ObservationRegistry
Closes gh-38568
This auto-configuration ensures, if Micrometer Tracing is on the
classpath, that there is always a tracer. It backs off if there is
already a tracer, for example contributed by the Brave or the Otel
auto-configurations, which are run before.
See gh-38568
Following the changes in gh-37504, the reactive resource server
auto-configuration could enable WebFlux security in situations where
it was otherwise in active. This could then result in an application
failing to start as no authentication manager is available.
This commit updates the configurations that enable WebFlux security
so that they fully back off unless their related configurations are
active. Previously, only the configuration of the
SecurityWebFilterChain would back off. This has been expanded to
cover `@EnableWebFluxSecurity` as well. This has required splitting
the configuration classes up so that the condition evaluation order
can be controlled more precisely. We need to ensure that the JWT
decoder bean or the opaque token introspector bean has been defined
before evaluation of the conditions for `@EnableWebFluxSecurity`.
Without this control, the import through `@EnableWebFluxSecurity` in
one location where the conditions do not matchcan prevent a
successful import in another where they do.
Fixes gh-38713
1. remove unused imports
2. remove redundant semicolon
3. remove empty class body
4. remove redundant 'constructor' keyword
5. remove redundant 'Unit' return type
6. use non-null type if possible
See gh-38708
Phillip Webb
Jan Engehausen
Moritz Halbritter
Vaibhav Jaiswal
Andy Wilkinson
Wzy19930507
Scott Frederick
Sébastien Deleuze
Brian Clozel
amparab
Won Joon Thomas Choi
BenchmarkingBuffalo
Tobias Lippert
Onur Kagan Ozcan
skcskitano
Fabrice Bibonne
Christoph Dreis
Chris Bono
Sandra Ahlgrimm
meiyese
Yanming Zhou
Iliès BELDJILALI
Donghun Shin
Georg Pirklbauer