What's Changed Bug Fixes π Register the physical signature of Kotlin suspend functions in the Graal reflection config by @dstepanov in #13133 Answer 400 when a Publisher part has no file name by @graemerocher in #13124 Improvements β Resolve the built-in body handlers' types once by @graemerocher in #13139 Reduce cold startup work: no zip file system scans, lazy MediaType quality, no Loom probe byβ¦
What's Changed Security π¨ Update to Netty 4.1.138.Final via #13098 Full Changelog: v3.10.11...v3.10.12
What's Changed Security π¨ Update Netty to 4.2.18.Final via #13097 A number of security fixes have added additional validation and impose new resource usage limits, which may cause existing workloads to fail or be rejected. We recommend that you test your systems thoroughly as part of your Netty upgrade. Full Changelog: v5.1.14...v5.1.15
Security π¨ GHSA-9c73-4fch-jrwv Unbounded memory growth from fragmented WebSocket messages (DoS) GHSA-gxcm-8fhf-v7x9 Default error response always includes raw exception message with no suppression option GHSA-2j79-mgc9-v76r HTTP request decompression-bomb DoS via unbounded gzip/deflate decoding Full Changelog: v3.10.10...v3.10.11
What's Changed Security π¨ GHSA-9c73-4fch-jrwv Unbounded memory growth from fragmented WebSocket messages (DoS) GHSA-gxcm-8fhf-v7x9 Default error response always includes raw exception message with no suppression option GHSA-2j79-mgc9-v76r HTTP request decompression-bomb DoS via unbounded gzip/deflate decoding Bug Fixes π Backport fix for NPE when SSE events are received with no data field by @keviβ¦
Security π¨ GHSA-9c73-4fch-jrwv Unbounded memory growth from fragmented WebSocket messages (DoS) GHSA-gxcm-8fhf-v7x9 Default error response always includes raw exception message with no suppression option GHSA-2j79-mgc9-v76r HTTP request decompression-bomb DoS via unbounded gzip/deflate decoding Full Changelog: v5.1.13...v5.1.14
What's Changed Bug Fixes π Iterate the introspections in a stable order again by @dstepanov in #13096 Keep a property's annotations to the type it is read through by @dstepanov in #13099 Find beans compiled before their annotation was self-indexed by @dstepanov in #13111 Other Changes π‘ Fix the two critical Sonar issues failing the 5.2.x quality gate by @dstepanov in #13095 Only look up introspectβ¦
Update managed-netty version to 4.2.18.Final (#13097) Full Changelog: v4.10.27...v4.10.28
What's Changed New Features π Add RFC 10008 support (QUERY Method) by @desiderantes in #12780 Derive configuration metadata documentation from Kotlin KDoc by @MariusVolkhart in #12831 feat: add experimental Python support with GraalPy by @graemerocher in #12843 Add Netty activation controls by @n0tl3ss in #12842 feat: add incremental Python and Java compilation by @graemerocher in #12850 Support Pβ¦
What's Changed Dependency updates π Update reactor to 3.8.7 by @sdelamo in #12924 Full Changelog: v5.1.12...v5.1.13
What's Changed Dependency updates π Update groovy from 5.0.6 to 5.0.8. by @sdelamo in #12885 Other Changes π‘ Document piped stream limitations for streamed responses by @yawkat in #12514 Add Sec-Fetch-* HTTP Headers by @sdelamo in #12899 Full Changelog: v5.1.11...v5.1.12
What's Changed Update netty monorepo to v4.2.17.Final (#12876) Bug Fixes π fix(cors): replace reference equality with value equality in isAny and isAnyMethod by @fatekingsama in #12627 fix(multipart): case-insensitive Content-Type/Content-Length header matching in FormDemuxer by @florian-3ap in #12836 [5.1.x] Update netty-tcnative to 2.0.81.Final by @yawkat in #12890 Fix FormDemuxer event loop racβ¦
What's Changed Bug Fixes π fix(cors): replace reference equality with value equality in isAny and isAnyMethod by @fatekingsama in #12627 Update Jackson dependencies to patch security vulnerabilities (#12834) Full Changelog: v5.0.6...v5.0.7
What's Changed Dependency updates π Update Jackson dependencies to patch security vulnerabilities by @radovanradic in #12834 Full Changelog: v5.1.9...v5.1.10
What's Changed Bug Fixes π Fix processing replaced executable methods by @dstepanov in #12827 Full Changelog: v5.1.8...v5.1.9
What's Changed Dependency updates π Bump managed-ksp version to 2.3.10 by @sdelamo in #12822 Other Changes π‘ Fix method injection on AOP introduction proxies by @dstepanov in #12825 Full Changelog: v5.1.7...v5.1.8
What's Changed Bug Fixes π Fix : introspection for private JsonProperty fields by @samikshathorat21 in #12810 Improvements β Use exclusive service loader strategy and fix GraalVM warnings by @graemerocher in #12808 Other Changes π‘ Fix factory beans in superclasses by @dstepanov in #12821 Full Changelog: v5.1.6...v5.1.7
What's Changed Regressions π§ Fix regression @Replaces matching for proxied default implementations by @sdelamo in #12796 Full Changelog: v5.0.5...v5.0.6
What's Changed Bug Fixes π fix(ksp): resolve generic type arguments for suspend functions returning non-generic typealiases (#12686) by @idsoke in #12690 Handle null instances in QueryValueArgumentBinder by @MaheshAravindV in #12759 Fix repeatable containers discovery by @dstepanov in #12797 Improvements β Use configuration properties for logger levels by @graemerocher in #12752 Enable SSL by defaβ¦
What's Changed Dependency updates π dep: netty 4.1.136.Final by @sdelamo in #12789 Full Changelog: v3.10.9...v3.10.10
What's Changed Other Changes π‘ Fix validation by @dstepanov in #12790 Full Changelog: v5.1.4...v5.1.5
What's Changed Improvements β sonar: Suppress false stream warning in StreamPair by @sdelamo in #12767 Ensure ByteBuf release during writes by @sdelamo in #12769 Track JRT file system for cleanup by @sdelamo in #12768 Dependency updates π Update dependency ch.qos.logback:logback-classic to v1.5.37 by @renovate[bot] in #12770 Netty 4.2.16.Final by @sdelamo in #12777 Other Changes π‘ Suppress Sonar wβ¦
What's Changed Dependency Upgrades Jackson databind 2.21.5 Update logback to 1.5.37 Netty 4.2.16.Final Full Changelog: v4.10.25...v4.10.26
What's Changed Improvements β sonar: Suppress false stream warning in StreamPair by @sdelamo in #12767 Ensure ByteBuf release during writes by @sdelamo in #12769 Track JRT file system for cleanup by @sdelamo in #12768 Dependency updates π Netty 4.2.16.Final by @sdelamo in #12777 Other Changes π‘ Suppress Sonar warning for EventLoopFlow checks by @sdelamo in #12766 Full Changelog: v5.0.4...v5.0.5
What's Changed Bug Fixes π Fix RequestBean binding without query values by @yawkat in #12740 Handle invalid locale conversion by @yawkat in #12739 Dependency updates π Update ksp monorepo to v2.3.9 by @renovate[bot] in #12744 Update dependency com.aayushatharva.brotli4j:brotli4j to v1.23.0 by @renovate[bot] in #12294 Update actions/cache digest to 55cc834 by @renovate[bot] in #12760 Other Changesβ¦
What's Changed Other Changes π‘ out-of-bounds index issue by @asmaaknidar33 in #12665 Fix jackson CVE by @radovanradic in #12750 Full Changelog: v5.0.3...v5.0.4
What's Changed Other Changes π‘ Fix jackson-databind cves by @karimaazergui in #12756 New Contributors @karimaazergui made their first contribution in #12756 Full Changelog: v3.10.8...v3.10.9
What's Changed Dependency updates π Update actions/setup-java digest to ad2b381 by @renovate[bot] in #12733 Other Changes π‘ Correct handling of @JsonProperty(access = JsonProperty.Access.WRITE_ONLY) by @dstepanov in #12735 Full Changelog: v5.1.1...v5.1.2
What's Changed Other Changes π‘ Fix builder issue by @dstepanov in #12726 Fix Groovy JsonProperty introspection access by @dstepanov in #12729 Fix raw generic argument qualifier fallback by @dstepanov in #12728 Full Changelog: v5.1.0...v5.1.1
What's Changed New Features π Introduce Introspected.Property annotation to support explicit bean properties by @dstepanov in #12636 Add sequenced collection support for bean injection by @yawkat in #12541 Bug Fixes π Fix repeatable bean property requires on factory methods by @yawkat in #12483 Remove deprecated RouteVersionFilter constructor by @yawkat in #12713 Improvements β Instantiate introspβ¦