Update `AutoConfigurationSorter` so that `getClassesRequestedAfter()`
results are sorted to match the earlier name/order sorting. Prior to
this commit the order of items added via `@AutoConfigureAfter` was in
an undetermined order which could cause very subtle `@ConditionalOnBean`
bugs.
Thanks very much to Alexandre Baron for their help in diagnosing and
reproducing this issue.
Fixes gh-38904
Update `ZipContent` so that `META-INF` entries are no longer duplicated
in nested jars created from directory entries. This aligns with the
behavior of the classic loader and prevents the same META-INF file from
being discovered twice.
Fixes gh-38862
Update log4j configuration so that an empty value is used when
`LOGGED_APPLICATION_NAME` is missing. Prior to this commit when
`logging.include-application-name` was `false` the logged output
would include the raw `${sys:LOGGED_APPLICATION_NAME}` value.
See gh-38847
Update `JarFileArchive` so that unpacked jars use `file:` URLs rather
than `jar:file:`. This aligns with the behavior of Spring Boot 3.1 and
allows calls to `class.getSigners()` to work again.
Fixes gh-38833
Update `PulsarPropertiesMapper` to use JSON encoded parameters rather
than a `Map` since the `Map` method is deprecated in Pulsar. This
commit simply takes the auth params map and converts them to the
expected encoded JSON string of auth parameters.
See gh-38839
Update `TestcontainersLifecycleBeanPostProcessor` so that containers
can actually be started in parallel.
Prior to this commit, `initializeStartables` would collect beans
and in the process trigger the `postProcessAfterInitialization` method
on each bean. This would see that `startablesInitialized` was `true`
and call `startableBean.start` directly. The result of this was that
beans were actually started sequentially and when the `start` method
was finally called it had nothing to do.
The updated code uses an enum rather than a boolean so that the
`postProcessAfterInitialization` method no longer attempts to start
beans unless `initializeStartables` has finished.
Fixes gh-38831
Update `SpringApplication` so that `ApplicationRunner` and
`CommandLineRunner` beans are not considered from the parent
`ApplicationContext`.
The restores the behavior that applied before commit 7d6532cac4
whilst still retaining the correct run order.
Fixes gh-38647
Update `LoadedPemSslStore` so that it loads content lazily. This
restores the behavior of Spring Boot 3.1 and allows bundles to be
defined with files that don't exist as long as they are never accessed.
Fixes gh-38659
This commit removes the now defunkt `ErrorAttributes.ERROR_ATTRIBUTE`
that was introduce to register handled errors as metrics. This has been
replaced since 3.0 by a direct support in Spring Framework and had no
effect whatsoever since that release.
This also updates the documentation to point to the Framework mechanism
that replaced it.
Fixes gh-33731
There are some notable differences in the behavior of Spring
Security's reactive and servlet-based web security. Notably,
Servlet-based web security (`@EnableWebSecurity`) works without
any authentication manager, rejecting requests as not authorized.
By contrast reactive-based web security (`@EnableWebFluxSecurity`)
fails to start up when there's no authentication manager, either
provided directly as a bean or derived from a
ReactiveUserDetailsService. There are also further differences at
runtime where empty Monos from all ReactiveAuthenticationManagers
results in an internal error and a 500 response whereas a similar
situation in the servlet implementation results in a 401.
Previously, to accommodate these differences in behavior, Spring
Boot's auto-configuration would behave differently. In the Servlet
case, web security would be enabled whenever the necessary
dependencies were on the classpath. In the reactive case, web
security would back off in the absence of an authentication manager
to prevent a start up failure. While this difference is rooted in
Spring Security, it is undesirable and something that we want to
avoid Spring Boot users being exposed to where possible.
Unfortunately, the situation is more likely to occur than before
as ReactiveUserDetailsServiceAutoConfiguration now backs off more
readily (gh-35338). This makes it more likely that the context will
contain neither a reactive authetication manager not a reactive
user details service.
This commit reworks the auto-configurations related to reactive
security. ReactiveSecurityAutoConfiguration will now auto-configure
an "empty" reactive authentication manager that denies access through
Mono.error in the absence of a ReactiveAuthenticationManager,
ReactiveUserDetailsService, or SecurityWebFilterChain. The last of
these is to allow for the situation where a filter chain has been
defined with an authentication manager configured directly on it.
This configuration of an authentication manager allows
`@EnableWebFluxSecurity` to be auto-configured more readily,
removing one of the differences between reactive- and Servlet-based
security.
Corresponding updates to the auto-configurations for reactive OAuth2
support have also been made. They no longer try to auto-configure
`@EnableWebFluxSecurity`, relying instead upon
ReactiveSecurityAutoConfiguration, which they are ordered before, to
do that instead.
Closes gh-38713
The stream auto-configuration is tested in RabbitStreamConfigurationTests,
and excluding it prevents the creation of the "rabbitStreamEnvironment"
Environment bean, which delays the application context close by 1 second
because it has to wait for some Netty resources to gracefully shut down.
Closes gh-38750
If @AutoConfigureObservability is applied to a sliced test, it
auto-configures:
- An in-memory MeterRegistry
- A no-op Tracer
- An ObservationRegistry
Closes gh-38568
This auto-configuration ensures, if Micrometer Tracing is on the
classpath, that there is always a tracer. It backs off if there is
already a tracer, for example contributed by the Brave or the Otel
auto-configurations, which are run before.
See gh-38568
Following the changes in gh-37504, the reactive resource server
auto-configuration could enable WebFlux security in situations where
it was otherwise in active. This could then result in an application
failing to start as no authentication manager is available.
This commit updates the configurations that enable WebFlux security
so that they fully back off unless their related configurations are
active. Previously, only the configuration of the
SecurityWebFilterChain would back off. This has been expanded to
cover `@EnableWebFluxSecurity` as well. This has required splitting
the configuration classes up so that the condition evaluation order
can be controlled more precisely. We need to ensure that the JWT
decoder bean or the opaque token introspector bean has been defined
before evaluation of the conditions for `@EnableWebFluxSecurity`.
Without this control, the import through `@EnableWebFluxSecurity` in
one location where the conditions do not matchcan prevent a
successful import in another where they do.
Fixes gh-38713
1. remove unused imports
2. remove redundant semicolon
3. remove empty class body
4. remove redundant 'constructor' keyword
5. remove redundant 'Unit' return type
6. use non-null type if possible
See gh-38708
In gh-38154, we started handling ClosedByInterruptException. The
FileChannel was repaired by recreating it and then the exception was
rethrown. This allowed other threads to use the channel that had been
read by an interrupted thread while allowing that interruption to
continue.
This approach has proven to be insufficient as there are scenarios
where the read needs to succeed on the interrupted thread. This
commit updates the handling of ClosedByInterruptException so that
this is the case. The FileChannel is recreated as before but the
thread's interrupted flag is now cleared before retrying the read.
The flag is then reinstated so that any subsequent actions that
should fail due to the interruption will do so.
We could clear and reinstate the interrupted flag before the first
read, rather than catching ClosedByInterruptException. This approach
was rejected as it will have an impact on the performance of the
happy path where the thread hasn't been interrupted.
Fixes gh-38611
Andy Wilkinson
Phillip Webb
Sandra Ahlgrimm
meiyese
Yanming Zhou
Iliès BELDJILALI
Brian Clozel
Chris Bono
Moritz Halbritter
Donghun Shin
Georg Pirklbauer