We need to ensure that MockMvcAutoConfiguration has defined its
DispatcherServletPath bean before the condition that checks for it in
ServletWebSecurityAutoConfiguration is evaluated.
Ideally, ServletWebSecurityAutoConfiguration in spring-boot-security
would not know about test-specific code but there's no easy way to
establish the required ordering without this link. One alternative
option is an auto-configuration class in spring-boot-security-test
that's purely for ordering purposes. This was rejected as it would
introduce new public API (as we enforce that all auto-configurations
are public).
Fixes gh-49854
In Spring Boot 3.x, Jackson2ObjectMapperBuilder disabled
FAIL_ON_UNKNOWN_PROPERTIES. This commit aligns the behavior of
use-jackson2-defaults with this.
This commit also ensures that DEFAULT_VIEW_INCLUSION is disabled. It
was enabled by default in Jackson 2 and then disabled by
Jackson2ObjectMapperBuilder. At the time of writing, Jackson 3's
configureForJackson2() method does not enable DEFAULT_VIEW_INCLUSION.
Should that ever be corrected/changed in Jackson 3, this additional
change in this commit ensures that the Boot will continue to have the
desired default.
Fixes gh-49951
Previously, if Jackson was on the classpath but no JsonMapper bean
was present, the app would fail to start. This commit updates
the auto-configuration so that the parts that require a JsonMapper
bean back of when no such bean is present.
The sample problem also exists with Jackson 2 and an ObjectMapper
bean. This commit also corrects that.
Fixes gh-49749
Prior to this commit, `EndpointRequest` exposed factory methods for
creating security matchers in the context of Actuator endpoints. This is
using the popular pattern matching approach for security matchers.
Such matchers are not as focused as method-level security and will match
the endpoint path itself (`"actuator/endpoint"`) as well as everything
beneath it (`"actuator/endpoint/**"`).
This commit improves the Javadoc and reference documentation to make
this behavior more explicit.
Closes gh-49520
Update `RestClientAutoConfiguration` to ensure that it applies after
`HttpMessageConvertersAutoConfiguration`.
Prior to this commit, the `HttpMessageConvertersRestClientCustomizer`
bean might not get created due to the `@ConditionalOnBean` guard not
finding any `ClientHttpMessageConvertersCustomizer` beans.
Since the issue is surprising hard to replicate in a unit test, a new
smoke test has been added to ensure the problem doesn't return.
Fixes gh-49223
Andy Wilkinson
Stéphane Nicoll
Brian Clozel
Hyeongjun Cho
Moritz Halbritter
Yanming Zhou
Phillip Webb
Daeho Kwon
MJY