Packager#isCycloneDxBom only recognized CycloneDX SBOMs beneath
META-INF/sbom/. In a war, the CycloneDX Maven plugin's output is
packaged beneath WEB-INF/classes/META-INF/sbom/, so repackaging did
not add the SBOM manifest attributes.
Also check beneath Layout#getClassesLocation(), which findMainMethod
already uses to locate application classes. Continue to support the
root location used by jars.
Signed-off-by: COBI-98 <tkdgus968@naver.com>
See gh-51551
Gradle 9.6 deprecates Project.getProperties, which will be removed
in Gradle 10.
Use ProviderFactory.gradleProperty to read the required properties
in AntoraAsciidocAttributes and the image system tests build script.
Preserve null handling for missing Antora properties and fall back
to the project version when springBootVersion is not configured.
Update the provider mocks and add tests for the GraalVM
plugin version attribute.
Signed-off-by: Hyunwoo Jung <hyunwoojung@kakao.com>
See gh-51635
Gradle 9.6 deprecated the implicit lookup of properties in parent
projects, which currently causes the build to emit deprecation
warnings and will become an error in Gradle 10.
The settings script for the gradle/plugins build sets properties
from the root gradle.properties file only on its root project. The
cycle-detection-plugin subproject then resolves javaFormatVersion
and checkstyleToolVersion by walking up to its parent, which
triggers the deprecation.
This commit uses GradleLifecycle#beforeProject rather than
Gradle#rootProject so that the properties are defined directly on
every project in the build. As an isolated action, it also avoids
carrying the settings script into each project's configuration,
which keeps the build friendlier to the configuration cache.
It also enables the NO_IMPLICIT_LOOKUP_IN_PARENT_PROJECTS feature
preview so that any reintroduction of the deprecated behavior fails
the build rather than only emitting a warning.
Signed-off-by: Hyunwoo Jung <hyunwoojung@kakao.com>
See gh-51625
The deprecation entry for
management.prometheus.metrics.export.pushgateway.base-url was declared
as "management.promethus", so the deprecation was never reported.
Signed-off-by: ohchanKyu <okc0202@naver.com>
See gh-51627
This commit improves TestImage so that an explicit image can trigger
the creation of the container, with optional additional setup. This
removes the need of creating additional container types for images that
have multiple flavors, and to please the static method that can only
create a container based on a single match.
Closes gh-51082
Prior to this commit, CloudFoundryReactiveActuatorAutoConfiguration
registered a BeanPostProcessor replaced the WebFilterChainProxy bean
with one that handled CF security and delegated to the existing
chain.
Constructing a new WebFilterChainProxy resulted in the loss of any
firewall customization on the existing chain as Spring Security does
not provide an API to retreive the firewall from the existing chain
and apply it to the new chain.
This commit changes the approach and aligns it with its Servlet
counterpart. Instead of post-processing the filter chain proxy, a new
SecurityWebFilterChain that handles cloudfoundryapplication/**
is defined. This chain becomes part of the existing
WebFilterChainProxy, preserving any firewall customization.
Signed-off-by: aashikantkumar <aashikantkumar2@gmail.com>
See gh-51549
Previously, the CloudFoundryAuthorizationExceptions thrown for a
missing application ID or cloud controller URL were not routed
through the error handling that turned them into a SecurityResponse
with a 503 status code. As a result, they were processed by the
general exception handling which resulted in a 500 response.
This commit updates the reactive SecurityInterceptor so that the
exceptions are processed through
SecurityInterceptor::getErrorResponse. This aligns the behavior of
the Cloud Foundry security intergration in a reactive application
more closely with that of a Servlet application.
Fixes gh-51613
Gradle 9.6 deprecates passing a Project instance as dependency notation,
which currently causes the build to emit deprecation warnings and will
become an error in Gradle 10.
This commit updates AggregatorPlugin to use
DependencyFactory#createProjectDependency instead.
Signed-off-by: Hyunwoo Jung <hyunwoojung@kakao.com>
See gh-51598
Andy Wilkinson
COBI-98
Hyunwoo Jung
Tran Ngoc Nhan
dependabot[bot]
Stéphane Nicoll
ohchanKyu
JaeHyunAn
aashikantkumar
Fabio Grassi