Update `RestClientAutoConfiguration` to ensure that it applies after
`HttpMessageConvertersAutoConfiguration`.
Prior to this commit, the `HttpMessageConvertersRestClientCustomizer`
bean might not get created due to the `@ConditionalOnBean` guard not
finding any `ClientHttpMessageConvertersCustomizer` beans.
Since the issue is surprising hard to replicate in a unit test, a new
smoke test has been added to ensure the problem doesn't return.
Fixes gh-49223
Tomcat 9.0.115, 10.1.52, and 11.0.18 include a breaking change [1] to
how ciphers are configured when using HTTPS. Previously, a single
setting was used but this has now been split in two; the existing
ciphers setting for TLSv1.2 ciphers and a new ciperSuites setting for
TLSv1.3. As part of this split, the behavior of the ciphers setting
has been changed such that any TLSv1.3 ciphers are ignored and a
warning is logged.
This change in Tomcat is problematic without also making some changes
in Boot. If we had done nothing, a user that had configured only
TLSv1.3 cipers would have them all ignored, leaving their SSL
connection unexpectedly using all of the default ciphers which may be
less secure.
This commit adapts to the breaking change in Tomcat by taking the
user's list of ciphers and splitting into into TLSv1.2 and TLSv1.3
ciphers before passing them into Tomcat's two settings (ciphers and
cipherSuites respectively). This is done defensively for backwards
compatibility. If the methods to identify and configure the TLSv1.3
ciphers are not present, we assume that we're running with an earlier
version of Tomcat and fall back to passing them all into the ciphers
setting as we did previously.
Closes gh-49108
[1] 9abf6bddb2
Prior to this commit, the `XmlMapper` auto-configuration for Jackson2
would refer to Jackson3's `XmlMapper` instead of Jackson2. This would
not only make the condition invalid, but it could also lead to
`NoClassDefFoundError` at runtime if the application mixed Jackson 2 and
3 on the classpath.
Fixes gh-49015
In addition to the upgrade, this commit also fixes some contract
violations in non-public APIs that are now detected as the new
version of the plugin enables contract checking by default.
Closes gh-49000
The condition is unnecessary as the sniifer is now included in the
same jar as the REST client itself.
See gh-48900
Signed-off-by: Johnny Lim <izeye@naver.com>
spring-kafka has an api dependency on spring-tx, placing
the latter on the compile classpath of the former's consumers.
Additionally, when spring.kafka.producer.transaction-id-prefix is
set, the Kafka auto-configuration will define a Kafka-based
transaction manager. However, the transaction manager won't be used
without some configuration from the user as there's no dependency on
spring-boot-transaction and, therefore, no auto-configuration of
@EnableTransactionManagement.
This commit adds a spring-boot-transaction dependency to
spring-boot-kafka, aligning it with the spring-tx dependency that
spring-kafka already has.
Fixes gh-48880
Remove the `always()` call from the same site mapping and replace `as`
with a direct call. This update means that mapping only occurs when
`getSameSite` is not `null`, but mapping can still be applied if
`sameSite.getAttributeValue()` returns `null`.
Closes gh-48830
Following modularization, a presence check for ValidatorAdapter was
needed in the MVC and WebFlux auto-configuratiomn when creating
their Validators. Runtime hints to allow this check to work in a
native image were not added at the same time, resulting in the
class appearing to be absent. This caused message interpolation
for constraint violations to fail as newly created Validator was
being used which lacked the necessary MessageInterpolator
configuration.
This commit adds reflection hints for ValidatorAdapter, allowing
re-use of the context's main validator as the MVC and WebFlux
validators.
Fixes gh-48828
Spring Projects that have the `spring.graphql.schema.locations` property
set to `"classpath*:graphql/**/"` as suggested in the documentation have
failing GraphQL tests after upgrading to Spring Boot 4.
The `Query` type definition in the books-domain schema clashes with the
schema of the application. Presumably the books-domain schema was never
meant to exist in the exported JAR file. This commit moves it into the
test module to stop it from being exported and causing problems.
Signed-off-by: mspiess <30656914+mspiess@users.noreply.github.com>
See gh-48829
Previously, CloudFoundryActuatorAutoConfiguration required
RestTemplateBuilder, using it to create the RestTemplate that's used
the security interceptor. Following the modularization,
RestTemplateBuilder is only present when spring-boot-restclient is on
the classpath. In its absence, CloudFoundryActuatorAutoConfiguration
would fail.
This commit address this problem by using RestClient.Builder (and
RestClient) instead of RestTemplateBuilder (and RestTemplate). This
allows CloudFoundryActuatorAutoConfiguration to work without
spring-boot-restclient as RestClient.Builder and RestClient are
provided by spring-web that will always be there in an MVC webapp.
Fixes gh-48826
Update `HttpServiceClientProperties` to use direct binding rather than
using `@ConfigurationProperties`. The prevents metadata and IDE issues
and also allows the class API to be simplified.
Closes gh-48616
This commit fixes a regression where RANDOM_PORT was no longer honored
if a defined management port is set. Due to the modularization efforts,
the code has moved from an EnvironmentPostProcessor to an
ApplicationListener. Unfortunately, the listener is registered too
late to handle the event it is listening to. While the event type could
have been changed, the listener was added on the ApplicationContext
which are not honored before the ApplicationContext is in a state to be
used.
The contract of ContextCustomizerFactory is already giving us everything
we need. While the environment is post-processed later than we would
like, it is still post-processed before the refresh state so that the
additional property is honored.
This commit also adds an integration test to cover this scenario.
Closes gh-48653
Prior to this commit, gh-48310 separated client and server message
converter configurations by switching from message converter instances
as beans in the application context, to server/client customizers that
are applied to the `HttpMessageConverters` instances while being built.
This change did not order the new ClientHttpMessageConvertersCustomizer
or ServerHttpMessageConvertersCustomizer, letting those being at the
"lowest precedence" default. As customizers, this means they are applied
last and custom instances cannot take over.
This commit ensures that such customizers provided by Spring Boot are
now ordered at "0" to let applications ones take over.
Fixes gh-48635
This commit improves the auto-configuration of the JSonMapper.Builder
to accept a custom JsonFactory if a bean of this type is present.
Closes gh-48594
JdbcSessionAutoConfiguration is conditional on the DataSource bean
which won't exist until after DataSourceAutoConfiguration; therefore,
JdbcSessionAutoConfiguration must auto-configure after
DataSourceAutoConfiguration.
Signed-off-by: Craig Andrews <candrews@integralblue.com>
See gh-48552
Previously, the connection details would only back off if another
PropertiesOtlpLoggingConnectionDetails was defined. This commit
corrects this so that they will back of if any
OtlpLoggingConnectionDetails implementation is defined as a bean.
Closes gh-48536
Introduce a strategy to `WebApplicationType` to allow modules to
implement deduction logic.
Prior to this commit, modules played no part in deducing the
`WebApplicationType`. This meant that a user with `spring-webflux`
for client purposes would deduce `REACTIVE` despite no
`spring-boot-webflux` module being present.
The following deduction logic order is now implemented:
1) If the `spring-boot-webmvc` module is being used and Spring MVC
classes are found then `SERVLET` is used.
2) If the `spring-boot-webflux` module is being used and Spring WebFlux
classes are found then `REACTIVE` is used.
3) If `spring-web` is found and servlet classes are available then
`SERVLET` is used.
4) If none of the above are satisfied, `NONE` is used.
This commit also updates `SpringBootTestContextBootstrapper` to use
the same deduction logic.
Fixes gh-48517
This commit moves the `ConditionalOnEnabledLoggingExport` condition from
the "spring-boot-actuator-autoconfigure" to the
"spring-boot-opentelemetry" one, because without that the logging export
feature requires the actuator module to be on the classpath.
Fixes gh-48488
Andy Wilkinson
Phillip Webb
Moritz Halbritter
Brian Clozel
Yanming Zhou
Johnny Lim
mspiess
Stéphane Nicoll
Craig Andrews
Kai Zander
Tran Ngoc Nhan