Update `JarFileUrlKey` so that only URLs that have a cheap `equals()`
method call are cached. This should prevent expensive DNS lookups from
being performed.
Fixes gh-46015
To address CVE-2025-48976 and CVE-2025-48988, Tomcat 10.1.42 has
introduced two new configuration settings – maxPartCount and
maxPartHeaderSize. The default values for these configuration
settings have proven hard to get right and some applications have
had to increase the default limits. To ease their configuration in
Spring Boot, this commit introduces configuration properties for
the new settings:
- server.tomcat.max-part-count (maxPartCount)
- server.tomcat.max-part-header-size (maxPartHeaderSize)
The defaults are aligned with those of Tomcat 10.1.42
(10 and 512 bytes respectively).
Closes gh-45869
Restore knownIndexedChildren logic in IndexedElementsBinder to that of
Spring Boot 3.4, effectively reverting commit 93113a415f15.
The performance improvements unfortunately caused the unwanted
side-effect of no longer checking the all indexed elements were fully
bound. Performance was also actually reduced for non iterable property
sources that used deeply nested structures.
In order to keep some performance improvements, the updated code
also makes the following changes:
* A `Set` is used rather than `LinkedMultiValueMap` for tracking. The
full list of unbound properties are now only calculated when the
exception is thrown.
* If possible, the source is filtered early and passed down for child
element binding. This should help reduce repeated full scans of
all configuration property names.
* The `FilteredIterableConfigurationPropertiesSource` has been optimized
for immutable `SpringIterableConfigurationPropertySource` use.
Fixes gh-45994
See gh-45970
See gh-44867
Update `ManagementContextAutoConfiguration` to use an immutable
`EnumerablePropertySource` to provide better property binding
performance.
See gh-45968
Signed-off-by: tanruian <tanruiantra@qq.com>
Update `ClientHttpConnectorAutoConfiguration` with a condition to ensure
that `ClientHttpConnectorBuilder.detect` will return a result. Prior
to this commit, when using a JDK without `java.net.http.HttpClient`
access the auto-configuration would fail.
Fixes gh-45955
Phillip Webb
David LJ
Andy Wilkinson
Stéphane Nicoll
Moritz Halbritter
Johnny Lim
tanruian
chanbinme
Sehwan Lim
wonyongg
csbiy
Andreas Ahlenstorf