Prior to this commit, `EndpointRequest` exposed factory methods for
creating security matchers in the context of Actuator endpoints. This is
using the popular pattern matching approach for security matchers.
Such matchers are not as focused as method-level security and will match
the endpoint path itself (`"actuator/endpoint"`) as well as everything
beneath it (`"actuator/endpoint/**"`).
This commit improves the Javadoc and reference documentation to make
this behavior more explicit.
Closes gh-49520
This commit highlights that while "forwarded headers" support is enabled
automatically for cloud platforms, we generally assume that apps are
behind trusted HTTP proxies.
If this is not the case, app developers should disable this feature if
they choose to expose the application to direct Internet traffic.
Closes gh-49507
This commit improves the auto-configuration of the JSonMapper.Builder
to accept a custom JsonFactory if a bean of this type is present.
Closes gh-48594
This commit updates the reference documentation to better reflect
changes applied in gh-48310. As of Spring Boot 4.0.1,
`HttpMessageConverter` beans are all considered as "custom" converters
and will be set ahead of the converters list in the auto-configuration
support.
For more specific changes, developers should contribute
`ClientHttpMessageConvertersCustomizer` or
`ServerHttpMessageConvertersCustomizer` beans to better reflect their
intent: should the converter be configured for client, server or both?
How should this converter be used?
Previously, Spring Boot was relying on heuristics but they would cause
issues for server-only converters, or for specific configuration that
were not meant to replace the default converter for a given media type.
Closes gh-48574
Starting from Spring Boot 4, the RestTemplateBuilder and
RestTemplateCustomizer classes have been moved from the
org.springframework.boot.web.client package to the
org.springframework.boot.restclient package. This commit updates
the javadoc links in the reference documentation to match
Signed-off-by: Antoine Rey <antoine.rey@free.fr>
See gh-48295
Previously, spring-boot-restclient was a required dependency of
spring-boot-resttestclient. This had the unwanted side-effect of
increasing the risk of the test classpath enabling auto-configuration
for RestClient.Builder when it was main code that needed such a bean.
This could lead to integration tests passing but the application
itself failing to start when its run through its main method.
This commit makes spring-boot-restclient an optional dependency of
spring-boot-resttestclient. As a result, a dependency on
spring-boot-resttestclient is no longer sufficient to auto-configure
a RestClient.Builder bean, although it is still sufficient to
auto-configure a RestTestClient bean.
Those that wish to use TestRestTemplate rather than migrating to
RestTestClient will now have to add a dependency on
spring-boot-restclient. This makes it presence more obvious. It now
has to be declared directly rather than being somewhat hidden due to
being pulled in transitively. The hope is that this will reduce the
chances of the dependency being accidentially on the test classpath
when main code requires it to be on the runtime classpath.
Fixes gh-48253
Change `spring-boot-tomcat-runtime` and `spring-boot-jetty-runtime`
into starter POMs and reduce the number of dependencies needed for
`spring-boot-tomcat` and `spring-boot-jetty`.
The runtime starters provide only the jars required to run the
embedded server along with the module jar itself (excluding transitive
dependencies) and `spring-boot-webserver` (excluding transitive
dependencies).
The build setup required for an executable jar is slightly different
between Maven and Gradle. For Maven, the regular module is put in the
`provided` scope. For Gradle, the regular module remains in main
configuration and the runtime jar is put in the `providedRuntime`
configuration. The reference documentation has been updated to
show how to configure things if starters are being used.
Manual testing has been performed to ensure that wars build with Maven
and Gradle work with both Tomcat and Jetty in both deployed and
`java -jar` modes.
Closes gh-48175
Stéphane Nicoll
Moritz Halbritter
Brian Clozel
giyeon95
Phillip Webb
Shaun
Andy Wilkinson
Tran Ngoc Nhan
Philip Bolting
jwalter
Hirotaka Kawata
Antoine Rey
Igor
Vedran Pavic