Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update spring boot to v3 (major) #199

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Update spring boot to v3 (major) #199

wants to merge 1 commit into from
+1 −1

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Mar 27, 2023 •
edited
Loading

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
org.springframework.boot:spring-boot-dependencies (source) 2.3.4.RELEASE -> 3.3.4 age adoption passing confidence
org.springframework.boot:spring-boot-maven-plugin (source) 2.3.4.RELEASE -> 3.3.4 age adoption passing confidence

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

spring-projects/spring-boot (org.springframework.boot:spring-boot-dependencies)

v3.3.4

Compare Source

🐞 Bug Fixes

  • management.health.db.ignore-routing-datasources=true has no effect when an AbstractRoutingDataSource has been wrapped #​42322
  • Missing details in OAuth2ClientProperties validation error message #​42279
  • FileNotFoundException from unused mis-configured SSL bundles #​42169
  • ZipkinHttpClientSender fails with "Failed to introspect Class" when spring-web is not on the classpath #​42161
  • @RestartScope can cause 'Recursive update' exceptions when used with container beans #​42107
  • JarLauncher fails to load large jar files #​42079
  • PropertiesMigrationListener wrongly reports property as deprecated when has group #​42071
  • Using an empty string MongoDB 'replica-set-name' property will result in ClusterType=REPLICA_SET #​42059
  • Default Logback config uses deprecated "converterClass" attribute #​42006

📔 Documentation

  • Document that spring.jmx.enabled is not intended for third-party libraries #​42285
  • Update link to Log4j2 system properties #​42263
  • Links to GraphQL in the reference guide redirect to the root instead of specific sections #​42208
  • Syntax error in "Receive a message reactively section" of the reference guide #​42200
  • Deprecation reason for the autotime enabled, percentiles, and percentiles-historgram properties is confusing #​42193
  • Replace RFC 7807 by RFC 9457 in property documentation #​42190
  • Document that configuration property binding to a Kotlin value class with a default is not supported #​42176
  • Update documentation to reflect new no handler found exception behavior #​42167
  • Polish configuration property reference #​42165
  • Remove link to “Converting a Spring Boot JAR Application to a WAR” as the guide is no longer available #​42111
  • Fix StatsD link typo on Metrics documentation page #​42109
  • Improve docker without buildpacks documentation #​42106
  • Improve documentation in "Command-line Completion" #​42103
  • Kotlin code examples are missing from the Testing section #​42094
  • Fix incorrect command in Docker configuration for Colima #​42078
  • Gradle Plugin AOT documentation has sample error #​42046

🔨 Dependency Upgrades

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​Alchemik, @​arefbehboudi, @​einarpehrson, @​izeye, @​martinfrancois, @​mushroom528, @​nosan, and @​quaff

v3.3.3

Compare Source

⭐ New Features

  • Add TWENTY_THREE to JavaVersion enum #​41716

🐞 Bug Fixes

  • Extending DefaultErrorAttributes and overriding getErrorAttributes() gets called twice #​41995
  • When using WebFlux, server.error.include-binding-errors=ALWAYS no longer has an effect when the BindingResult exception is the cause of a ResponseStatusException #​41987
  • PropertiesLauncher does not respect classpath.idx when adding jars in BOOT-INF/lib to the classpath #​41970
  • Web extension for SBOM endpoint isn't available under /cloudfoundryapplication #​41890
  • Launcher's ClassLoader is no longer parallel capable #​41873
  • spring-boot-testcontainers causes unwanted container initialization during AOT processing #​41859
  • ReactiveElasticsearchRepositoriesAutoConfiguration should back off when Reactor is not on the classpath #​41678
  • mvn spring-boot:build-image fails when 'classifier' is set to non-default value #​41661
  • Spring Boot Maven plugin AOT cannot handle Maven modules with module-info.java #​41647
  • Docker publishRegistry in Maven plugin configuration is validated when publish option is false #​41641
  • Using Gradle's new file permission API is implemented in a way that prevents removal of the old API #​41607
  • Some @ControllerEndpoint and @RestControllerEndpoint infrastructure remains undeprecated #​41596
  • Constructor binding of EnumMap fails due to missing key type #​41563

📔 Documentation

  • Improve documented logging property descriptions and default values #​41989
  • Explain that enabling virtual threads disables traditional thread pools #​41976
  • Harmonize code sample for MyUserHandler in reference documentation #​41949
  • Document when environment variable property mapping applies #​41945
  • Javadoc of slice test annotations should describe more accurately which components are considered #​41935
  • Fix duplicate words #​41920
  • Document the need to explicitly reset mock servers when using mock server customizers directly #​41849
  • Correct grammar in 'Running your Application with Maven' #​41840
  • Document more clearly that username and password are not used when spring.data.redis.url is set #​41748
  • Pulsar configuration does not have default value for several entries in the metadata #​41683
  • management.otlp.metrics.export.aggregation-temporality does not have a default value in the metadata #​41676
  • management.newrelic.metrics.export.client-provider-type does not have a default value in the metadata #​41670
  • server.error.include-path does not have a default value in the metadata #​41667
  • The effect upon Actuator of defining your own SecurityFilterChain is documented inconsistently #​41638
  • "Use Spring Data repositories" How-to incorrectly refers to Repository annotations #​41628
  • "Use Spring Data repositories" How-to incorrectly refers to Repository annotations #​41627
  • Update link to documentation for log4j-spring-boot #​41622
  • Fix link to Flyway reference documentation #​41593
  • Document configuration property binding's support for using @Name to customize a property name #​41585
  • Add hint for new dependencies required for Flyway #​41574
  • Document that spring-boot:repackage should not be run from the command-line #​22317

🔨 Dependency Upgrades

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​PiyalAhmed, @​Rajin9601, @​cms04, @​dreis2211, @​eddumelendez, @​hyunmin0317, @​ivamly, @​jmewes, @​jxblum, @​lamtrinhdev, @​ngocnhan-tran1996, @​quaff, and @​ritzykey

v3.3.2

Compare Source

🐞 Bug Fixes

  • No configuration property for defaultTimeout setting that was introduced in Spring Integration 6.2 #​41521
  • NPE during auto-configuration in OnClassCondition.resolveOutcomesThreaded because firstHalf is null #​41504
  • Spring Authorization Server now defaults multipleIssuersAllowed to false and it cannot be easily re-enabled #​41355
  • ServiceConnection does not work with @DataLdapTest #​41325
  • PropertiesMigrationListener wrongly reports property as deprecated #​41252
  • @NestedConfigurationProperty doesn't work on records #​41251
  • TestcontainersLifecycleBeanPostProcessor does not work correctly with scoped beans #​41238
  • Error message can be misleading if spring.config.import fails to resolve #​41236
  • build-image failures after docker desktop update with 'Illegal char <:> at index 5: npipe:////' #​41234
  • When using Jetty, filters, listeners, and servlets are not initialized with the same thread context classloader #​41225
  • DirtiesContext used with Webflux, a random port and multiple contexts causes multiple contexts to misbehave #​41221
  • NoSuchMethodException on org.apache.activemq.ActiveMQConnectionFactory.<init> when using spring-boot-starter-activemq in a native image #​41214

📔 Documentation

  • Fix documentation links in the README #​41531
  • Document the types to which each spring.mvc.format and spring.webflux.format property applies #​41518
  • Document that logging.file.name and logging.file.path cannot be used together #​41516
  • Refine CDS how-to guide #​41464
  • Fix typos in javadoc of BootstrapContext #​41448
  • CDS link in "Efficient Deployments" documentation is broken #​41321
  • Update Kotlin DSL examples that configure the environment of bootBuildImage to be additive #​41270
  • Document tracing support for RestClient #​41192
  • Documentation wrongly states that zipkin-sender-urlconnection is needed #​41181

🔨 Dependency Upgrades

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​acouvreur, @​anbusampath, @​eddumelendez, @​izeye, @​jxblum, @​mateusscheper, @​opcooc, and @​sdeleuze

v3.3.1

Compare Source

🐞 Bug Fixes

  • SQL Server JDBC URL is malformed after adding org.springframework.boot.jdbc.parameters label #​41169
  • Git instant properties cannot be coerced following git-commit-id Maven plugin upgrade #​41152
  • Excluding status code from DefaultErrorAttributes throws NPE #​41141
  • Spring Boot remote restart with devtools causes 'factory already defined' Tomcat error when running with 'java -jar' #​41107
  • MongoHealthIndicator not compliant with Mongo stable API with strict setting #​41104
  • Service connection for bitnami mongodb fails to connect #​41097
  • Image building requires builder to specify a stack #​41091
  • DataSourceProperties fail to bind if java.sql module isn't included #​41084
  • AOT causes Logback configuration error when using include #​41081
  • Image building hangs when builder and buildpack are configured #​41049
  • IllegalArgumentException when trying to use Tomcat's HttpNio2Protocol with Spring Boot-configured SSL #​41010
  • Uber jar fails to start when it contains a dependency with Multi-Release: true in its manifest and unexpected file entries in META-INF/versions #​41006
  • JSP-related resources may not be found in an executable war file when using Jetty #​40996
  • The value of the tomcat.threads.config.max metric is always -1, irrespective of the configured maximum number of threads #​40957
  • The auto-configured reactiveNeo4jTransactionManager may cause a failure due to multiple TransactionManager beans #​40953
  • Application fails to start when server.tomcat.threads.max < 10 #​40945
  • SBOM actuator endpoint doesn't work in a native image #​40939
  • Starter parent applies its configuration of the CycloneDX Maven plugin too broadly #​40927
  • buildInfo does not work with Gradle 8.7 or later when the configuration cache is enabled #​40924
  • Prometheus Exemplars are missing from _count #​40904
  • Extract fails due to a duplicate entry when BOOT-INF/classes contains a directory that's also present in the root of the jar #​40903
  • sbom is not available to the actuator endpoint when using bootRun or bootWar #​40890
  • A newline character is missing from the start of the default banner #​40889

📔 Documentation

  • Fix links to Spring AMQP's javadoc #​41144
  • Document more precisely how a Container's Docker image name is used to find the matching service connection #​41123
  • Cross-link to the CDS how-to guide #​41118
  • Fix typos in javadoc of MockServerRestClientCustomizer and MockServerRestTemplateCustomizer #​41065
  • Improve readability when listing three pillars of observability #​41064
  • Add CDS training run configuration documentation #​41045
  • Document the need to switch to io.micrometer:micrometer-registry-prometheus-simpleclient to use the Prometheus push gateway #​40993
  • Improve consistency of documentation guidelines for packaging and running applications #​40977
  • Fix typos in method names and javadoc #​40976
  • Replace hard-coded links to Micrometer in documentation #​40967
  • Add Kotlin example for @Testcontainers #​40943
  • Fix various minor inconsistencies of the documentation #​40942
  • Warn in the documentation that spring.profiles.group can only be used in non-profile-specific documents #​40941
  • Broken Micrometer links in documentation #​40916
  • Document Buildpacks CDS and Spring AOT support #​40762

🔨 Dependency Upgrades

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​Eng-Fouad, @​PiyalAhmed, @​Seungpang, @​asashour, @​cmabdullah, @​dependabot[bot], @​donghoony, @​erie0210, @​izeye, @​mateusscheper, @​onobc, @​quaff, @​sdeleuze, and @​vsanna

v3.3.0

Compare Source

⭐ New Features

  • Add support for descriptions of record components in configuration metadata generation #​29403

🐞 Bug Fixes

  • gradlew bootBuildImage fails with Podman on macOS Sonoma #​40871
  • Pulsar auth parameters don't properly encode JSON values #​40869
  • When using JPA and ImportTestcontainers, test context may fail to refresh due to "Mapped port can only be obtained after the container is started" #​40863
  • Default MIME mappings are not loaded unless additional mappings are configured #​40860
  • Starting from 3.2.x, @SpyBean is not able to initialise MongoRepository bean of the generic type #​40855
  • Auto-configuration ordering change breaks DocumentReference (in non-reactive MongoTemplate) when depending on mongodb-driver-reactivestreams #​40851
  • Neo4jReactiveDataAutoConfiguration creates incorrectly named bean #​40836
  • Image building fails during cleanup when bind mount has read-only content #​40799
  • Failure Analysis for InvalidConfigurationPropertyValueException is skipped when the property is not set #​40691
  • IllegalArgumentException can be thrown when running an uber jar on a shared drive #​40643
  • setReadTimeout can't be set via Reflective factory on JettyClientHttpRequestFactory #​40638
  • URISyntaxException is raised if the spring boot application is started in a location that contains invalid URI characters #​40616
  • resolveMainClassName fails when building with Gradle using Java 22 #​40613
  • AnsiOutput.detectIfAnsiCapable broken on JDK22 #​40609
  • Help information for spring init's build option has the wrong default #​40606
  • JarUrlConnection.getPermission() can throw NullPointerException if jarFileConnection is null #​40599
  • Whitespace is not correctly trimmed when generating configuration properties metadata from records #​40593
  • In some situations, the failure when the AOT-generated initializer cannot be loaded is less helpful than before #​40584
  • Properties binding eagerly creates superfluous maps #​40561
  • Configuring SSL bundle reload for non-file resource types causes errors that are difficult to diagnose #​40560
  • spring-boot-dependencies cannot be used with repositories that ban com.oracle.database.jdbc:ojdbc-bom #​40535
  • Buildpacks do not support Docker with containerd image store #​40526
  • SpringBootMockMvcBuilderCustomizer can crash cryptically while collecting data that it would have discarded anyway #​40517
  • Containers not shut down between tests when using .withReuse(true) but env. does not support reuse (e.g. CI builds) #​40509
  • CookieSameSiteSupplier influences session cookie #​40501
  • <springProperty> and <springProfile> do not work in <include> after Logback upgrade #​40491
  • Runtime hint registration for property binding should not fail when parameter information is unavailable #​40486
  • ServiceLevelObjectiveBoundary properties cannot be bound in a native image application #​40483
  • server.error.include-binding-errors does not recognize MethodValidationResult exceptions #​40474
  • spring.data.redis.cluster.nodes and spring.data.redis.sentinel.nodes do not handle IPv6 addresses correctly #​40467
  • Using relative paths to describe the classpath in the error message from ResolveMainClassName hinders problem diagnosis #​40465
  • Jartools extract command doesn't extract all files from META-INF #​40456
  • Native image doesn't start and doesn't log anything if an environment post processor throws an exception #​40451
  • Unlike DataSourceAutoConfiguration, DevToolsDataSourceAutoConfiguration assumes that javax.sql.DataSource will always be available #​40441

📔 Documentation

  • Improve graceful shutdown documentation to remove ambiguity #​40846
  • Document ways to opt out from immutable @ConfigurationProperties binding with single constructor #​40844
  • Document that a custom HttpMessageConverters bean can be used to reorder json message converters when needed #​40839
  • Address ambiguity now that Testcontainers has two classes named KafkaContainer #​40756
  • Publish API documentation for Spring Boot's Kotlin APIs #​40692
  • Fix typo in features doc #​40631
  • Code inclusion in Jersey documentation is broken #​40629
  • Add How-To for ManagedClassNameFilter #​40617
  • Clarify devtools restart class loader #​40608
  • Document default value of management.zipkin.tracing.encoding #​40588
  • Note that spring-boot-docker-compose is excluded by default from packaged jars #​40565
  • Clarify docs around spring.jpa.generate-ddl #​40523
  • Clarify the directory that's used by default to find Docker Compose compose.yaml #​40515
  • Suggest testAndDevelopmentOnly configuration when using Docker Compose support in tests #​40481
  • Clarify that all named properties must match for @ConditionalOnProperty to match #​40471
  • Links to Spring Batch javadoc for EnableBatchProcessing and DefaultBatchConfiguration are broken #​40141
  • Add grpc starter and httpexchange starter to the community starters document #​39437

🔨 Dependency Upgrades

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​An1s9n, @​DanielLiu1123, @​PiyalAhmed, @​chaewss, @​coursar, @​dependabot[bot], @​dsyer, @​dukbong, @​facewise, @​izeye, @​nahidshahin, @​onobc, @​quaff, @​snicoll, @​tobi-laa, and @​yokotaso

v3.2.10

Compare Source

🐞 Bug Fixes

  • management.health.db.ignore-routing-datasources=true has no effect when an AbstractRoutingDataSource has been wrapped #​42313
  • Missing details in OAuth2ClientProperties validation error message #​42278
  • FileNotFoundException from unused mis-configured SSL bundles #​42119
  • PropertiesMigrationListener wrongly reports property as deprecated when has group #​42068
  • Using an empty string MongoDB 'replica-set-name' property will result in ClusterType=REPLICA_SET #​42055
  • JarLauncher fails to load large jar files #​42012
  • @RestartScope can cause 'Recursive update' exceptions when used with container beans #​41571

📔 Documentation

  • Document that spring.jmx.enabled is not intended for third-party libraries #​42272
  • Update link to Log4j2 system properties #​42262
  • Links to GraphQL in the reference guide redirect to the root instead of specific sections [#​42207](https://redirect.gi

Configuration

📅 Schedule: Branch creation - "after 10pm every weekday,before 5am every weekday,every weekend" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@changelogg
Copy link

changelogg bot commented Mar 27, 2023

Hey! Changelogs info seems to be missing or might be in incorrect format.
Please use the below template in PR description to ensure Changelogg can detect your changes:
- (tag) changelog_text
or
- tag: changelog_text
OR
You can add tag in PR header or while doing a commit too
(tag) PR header
or
tag: PR header
Valid tags: added / feat, changed, deprecated, fixed / fix, removed, security, build, ci, chore, docs, perf, refactor, revert, style, test
Thanks!
For more info, check out changelogg docs

@viezly
Copy link

viezly bot commented Mar 27, 2023

Pull request by bot. No need to analyze

@renovate renovate bot force-pushed the renovate/major-spring-boot branch from 2e947ea to 1b4acdc Compare May 28, 2023 09:15
@renovate renovate bot force-pushed the renovate/major-spring-boot branch from 1b4acdc to 89692ba Compare June 22, 2023 16:30
@renovate renovate bot force-pushed the renovate/major-spring-boot branch from 89692ba to b15daad Compare July 20, 2023 12:21
@renovate renovate bot force-pushed the renovate/major-spring-boot branch from b15daad to 5f16546 Compare August 24, 2023 14:51
@renovate renovate bot force-pushed the renovate/major-spring-boot branch from 5f16546 to 1c14b64 Compare September 21, 2023 14:20
@renovate renovate bot force-pushed the renovate/major-spring-boot branch from 1c14b64 to ab3ec80 Compare October 19, 2023 14:44
@renovate renovate bot force-pushed the renovate/major-spring-boot branch 2 times, most recently from b2646e9 to 6487d08 Compare November 23, 2023 15:41
@renovate renovate bot force-pushed the renovate/major-spring-boot branch from 6487d08 to 78bc157 Compare December 21, 2023 13:25
@renovate renovate bot force-pushed the renovate/major-spring-boot branch from 78bc157 to a81b8fe Compare January 19, 2024 21:59
@renovate renovate bot force-pushed the renovate/major-spring-boot branch from a81b8fe to 801a9f8 Compare February 22, 2024 22:37
@renovate renovate bot force-pushed the renovate/major-spring-boot branch from 801a9f8 to 52f9f70 Compare March 21, 2024 14:51
@renovate renovate bot force-pushed the renovate/major-spring-boot branch from 52f9f70 to 2b76507 Compare April 18, 2024 21:04
@renovate renovate bot force-pushed the renovate/major-spring-boot branch 2 times, most recently from 3257d1e to c8c1821 Compare May 23, 2024 17:33
@renovate renovate bot force-pushed the renovate/major-spring-boot branch from c8c1821 to 1f24164 Compare June 20, 2024 13:36
@renovate renovate bot force-pushed the renovate/major-spring-boot branch from 1f24164 to 0dfd771 Compare July 18, 2024 18:37
@renovate renovate bot force-pushed the renovate/major-spring-boot branch from 0dfd771 to 934f510 Compare August 22, 2024 19:08
@socket-security Socket Security
Copy link

socket-security bot commented Aug 22, 2024 •
edited
Loading

New and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package New capabilities Transitives Size Publisher

🚮 Removed packages: maven/org.springframework.boot/[email protected]

View full report↗︎

@socket-security Socket Security
Copy link

socket-security bot commented Aug 22, 2024 •
edited
Loading

🚨 Potential security issues detected. Learn more about Socket for GitHub ↗︎

To accept the risk, merge this PR and you will not be notified again.

Alert Package NoteSourceCI
Critical CVE maven/org.springframework.boot/[email protected] ⚠︎
Possible typosquat attack maven/org.webjars.npm/[email protected] ⚠︎
Critical CVE maven/org.apache.derby/[email protected] ⚠︎
Critical CVE maven/org.apache.derby/[email protected] ⚠︎
Critical CVE maven/org.jboss.netty/[email protected] ⚠︎
Critical CVE maven/net.sourceforge.htmlunit/[email protected] ⚠︎
Critical CVE maven/org.springframework/[email protected] ⚠︎
Critical CVE maven/org.slf4j/[email protected] ⚠︎
Critical CVE maven/com.thoughtworks.xstream/[email protected] ⚠︎
Critical CVE maven/com.thoughtworks.xstream/[email protected] ⚠︎
Critical CVE maven/org.apache.ivy/[email protected] ⚠︎
Critical CVE maven/org.quartz-scheduler/[email protected] ⚠︎
Critical CVE maven/org.apache.zookeeper/[email protected] ⚠︎
Critical CVE maven/commons-fileupload/[email protected] ⚠︎
Critical CVE maven/org.springframework.boot/[email protected] ⚠︎
Critical CVE maven/org.springframework.boot/[email protected] ⚠︎
Critical CVE maven/org.springframework/[email protected] ⚠︎
Critical CVE maven/org.springframework/[email protected] ⚠︎

View full report↗︎

Next steps

What is a critical CVE?

Contains a Critical Common Vulnerability and Exposure (CVE).

Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

What is a typosquat?

Package name is similar to other popular packages and may not be the package you want.

Use care when consuming similarly named packages and ensure that you did not intend to consume a different package. Malicious packages often publish using similar names as existing popular packages.

Take a deeper look at the dependency

Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.

Remove the package

If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of ecosystem/package-name@version specifiers. e.g. @SocketSecurity ignore npm/[email protected] or ignore all packages with @SocketSecurity ignore-all

@renovate renovate bot force-pushed the renovate/major-spring-boot branch from 934f510 to ea2f35a Compare September 19, 2024 15:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
java dependencies
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
0 participants