Previously each endpoint was secured for path, path/, and path.*.
This meant that a request to path/foo was not secured. This commit
secures path/** to ensure that requests to a nested endpoint path are
also secured.
Fixes gh-2476
Spring Integration's FileWritingMessageHandler uses a .writing file
while it's in the process of writing a message to disk and then
performs a rename (depending on the OS and filesystem this may or may
not be atommic) to create the .msg file. Prior to this commit the
test was finding the temporary .writing files and examining them. This
could lead to a FileNotFoundException being thrown as the temporary
file was deleted while the test was trying to read its contents.
This commit updates the test to only look for files with a .msg suffix
Fixes gh-2428
By default, when building a project's jar its runtime dependencies
are not taken into account as they are not needed to successfully
compile the code that will be packaged in the jar. A side-effect of
this was that, if a project that was being repackaged had a runtime
dependency on another project, then the repackaged jar would not
include the jar of the project on which it has the runtime dependency
as the jar had not been built.
This commit updates Boot's repackage task to have a dependency on the
jar task of any project dependencies in the runtime configuration
thereby ensuring that those dependencies' jars will have been built
before the repackaging occurs.
Fixes gh-2344
Running the invoker plugin with multiple threads against an empty
Maven cache results in strange build failures where Maven claims that
it cannot find a jar or pom file for an artifact that it should be
able to find. It would appear that Maven is unable to cope with
concurrent writes to its cache.
This commit removes the usage of multiple threads that was introduced
in 4e907f1.
Fixes gh-2389
If user runs an executable archive then it and its lib directory will be
on the classpath. Entries from loader.path take precedence in a way that
should make sense to users (earlier wins like in CLASSPATH env var).
Also added new integration tests to verify the behaviour (big improvement
on the old ones, which probably aought to be beefed up to the same
standard).
Fixes gh-2314
Previously, SampleIntegrationParentApplicationTests assumed that when
an output file existed on disk its contents would have been written
in their entirety. This assumption does not hold true and causes the
test to fail intermittently as it incorrectly determines that the test
has produced no output.
This commit updates the test to wait for up to 30 seconds for the
output files to appear on disk and for the expected content to be
found in one of those files. If the files exist but do not
contain the expected content the test will keep trying until it does
or until too much time as elapsed.
Fixes gh-2380
The ErrorPageFilter exposes a wrapped response to the downstream
chain and unless more care is taken the chain will be able to
set the response status, but not inspect it.
Fixes gh-2367
Previously, JarCommand removed all @GrabResolver annotations in an
AST transformation. This was being performed as custom resolver
configuration is not necessary in a jar as all of the dependencies are
available from the jar. Furthermore, leaving the annotations in place
caused a failure when the jar was run due to a missing Ivy dependency
that's required by Groovy's default GrapeEngine, GrapeIvy.
The removal of @GrabResolver annotations was being done before they
could be used by Groovy's GrabAnnotationTransformation to configure
the GrapeEngine's resolvers. This resulted in the annotations having
no effect such that a dependency that was only available from a
repository made available by @GrabResolver would fail to resolve if
it was not cached locally.
This commit updates the AST transformation to leave the @GrabResolver
annotations in place but to set their initClass attribute to false.
This allows the annotation to be used while the jar's being compiled,
but supresses the generation of the static initializer that adds the
custom resolver to the GrapeEngine when the compiled code's run via
java -jar.
Fixes gh-2330
Previously, when LogbackLoggingSystem or Log4JLoggingSystem were
initialized during application start up, they would install SLF4J’s Java
logging bridge handler, however no corresponding uninstall was performed
during application shutdown. When deployed to a servlet container, where
the application’s lifecycle doesn’t match the JVM’s lifecycle, this lead
to a memory leak.
This commit updates LoggingSystem to introduce a new cleanUp method. An
empty implementation is provided to preserve backwards compatibility
with existing LoggingSystem subclasses. Both LogbackLoggingSystem and
Log4JLoggingSystem have been updated to implement cleanUp and uninstall
the SLF4J bridge handler. LoggingApplicationListener has been updated
to call LoggingSystem.cleanUp in response to a ContextClosedEvent.
Closes gh-2324
Previously, some classes that were annotatated with
@ConditionalOnWebApplication assumed that, if the application was a
web application, Spring MVC (spring-webmvc) would be on the classpath.
If it was not, the application would fail to start, typically with an
error relating to WebMvcConfigurerAdapter being unavailable.
This commit updates the affected configuration classes and annotates
them with @ConditionalOnClass(WebMvcConfigurerAdapter.class) to
ensure that their auto-configuration only takes effect if its a web
application and Spring MVC is on the classpath.
Fixes gh-2345
Sadly, Gradle handle's exclusions differently to Maven even when it's
processing a Maven pom.
In this case groovy-all is pulled in via org.crashub:crash.shell where
we've excluded it. This is enough to prevent Maven from pulling in
groovy-all when you depend on the remote shell starter.
org.crashub:crash.shell is also pulled in as a transitive dependency
of a number of other dependencies and Gradle requires each of these
to also exclude groovy-all for it to actually be excluded.
This commit adds the additional exclusions that are required to make
Gradle's behaviour sane.
Fixes gh-2257
Update InMemoryAuditEventRepository to consider the date when searching
for events. Also switch to a circular buffer implementation and update
the capacity to limit the total number of items rather than limiting
per principal.
Fixes gh-2291
The "Customizing ConfigurableEmbeddedServletContainer directly"
section should use `HttpStatus.NOT_FOUND` and not `HttpStatus.404` in
the sample code.
Fixes gh-2258
Update spring-boot-dependencies to include all Jetty modules. The helps
to prevent issues when modules are pulled in transitively (for example
via solr).
Fixes gh-2180
Fix ParentAwareNamingStrategy to set ObjectName properties for the
'identity' and 'context' attributes. Also update JmxAutoConfiguration
to ensure that the ParentAwareNamingStrategy is created in each context
and that the `mbeanExporter` bean is created. Prior to this commit the
nested @EnableMBeanExport class always meant that the mbeanExporter
condition never matched.
Fixes gh-2243
Update WebMvcAutoConfiguration to ensure than the viewResolver bean
is not created if a user defined ContentNegotiatingViewResolver bean
is defined.
Fixes gh-2269
Update WebMvcAutoConfiguration so that the RequestMappingHandlerMapping
bean is @Primary. Prior to this commit a NoUniqueBeanDefinitionException
would be thrown then using the MvcUriComponentsBuilder.
Fixes gh-2237
