Update default for `ReactorClientHttpRequestFactoryBuilder` and
`ReactorClientHttpConnectorBuilder` to align with Spring Framework.
Also provide method of opting out in case proxyWithSystemProperties is
not wanted.
Closes gh-49950
Fix the `GrpcDisableCsrfHttpConfigurer` logic so that the property
`spring.grpc.server.security.csrf.enabled` is used correctly.
Also add missing metadata.
Fixes gh-50145
This commit adapts the auto-configuration for API versioning to apply
the path segment last as this strategy is not meant to yield. It also
clarifies that configuration properties should not be used if ordering
of the strategies is important.
Closes gh-49800
Previously, LongTaskTimers were ignored when configuring a
distribution's min and max expected values and SLO boundaries. This
commit adds support, aligning them with the existing support for
Timers.
Fixes gh-49190
Add `InetAddressFilter` interface which can be provided by
`HttpSettings` to filter out addresses in order to harden
applications against SSRF attacks.
Closes gh-49687
This commit adds support for `@RedisListener` by providing the
infrastructure to register those endpoints using a default
`RedisMessageListenerContainer`.
Users wishing to configure additional containers can benefit from
`RedisMessageListenerContainerConfigurer`. The default container can
be tuned using new properties in the `spring.data.redis.listener`
namespace.
Closes gh-49858
This commit allows wrapping the auto-configured pooled DataSource in a
proxy that fetches connections as late as possible. JMX registration of
the underlying pool is preserved.
Closes gh-15480
We need to ensure that MockMvcAutoConfiguration has defined its
DispatcherServletPath bean before the condition that checks for it in
ServletWebSecurityAutoConfiguration is evaluated.
Ideally, ServletWebSecurityAutoConfiguration in spring-boot-security
would not know about test-specific code but there's no easy way to
establish the required ordering without this link. One alternative
option is an auto-configuration class in spring-boot-security-test
that's purely for ordering purposes. This was rejected as it would
introduce new public API (as we enforce that all auto-configurations
are public).
Fixes gh-49854
In Spring Boot 3.x, Jackson2ObjectMapperBuilder disabled
FAIL_ON_UNKNOWN_PROPERTIES. This commit aligns the behavior of
use-jackson2-defaults with this.
This commit also ensures that DEFAULT_VIEW_INCLUSION is disabled. It
was enabled by default in Jackson 2 and then disabled by
Jackson2ObjectMapperBuilder. At the time of writing, Jackson 3's
configureForJackson2() method does not enable DEFAULT_VIEW_INCLUSION.
Should that ever be corrected/changed in Jackson 3, this additional
change in this commit ensures that the Boot will continue to have the
desired default.
Fixes gh-49951
Andy Wilkinson
Phillip Webb
Moritz Halbritter
bbbbooo
itsmevichu
Stéphane Nicoll
Venkata Naga Sai Srikanth Gollapudi
Brian Clozel