-
Notifications
You must be signed in to change notification settings - Fork 74
/
CHANGES
5123 lines (3361 loc) · 158 KB
/
CHANGES
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
Platform 3.27
* Library Upgrades
- Jetty to 11.0.24 (was 11.0.20)
Platform 3.24
* Library Upgrades
- Base Docker image to c15-java17:3.52 (was 3.47)
Platform 3.23
* Library Upgrades
- Base Docker image to c15-java17:3.47 (was 3.46)
Platform 3.22
* RPM packaging
We removed the legacy init script from RPM packages. Systemd is now required.
Platform 3.21
* Library Upgrades
- Base Docker image to c15-java17:3.46 (was 3.45)
Platform 3.20
* Jaxrs
- When HSTS headers are enabled (by configuring "jaxrs.hsts.max-age"), we now attach the
Strict-Transport-Security header to responses from admin endpoints as well.
Platform 3.17
* Library Upgrades
- Jetty to 11.0.20 (was 11.0.17) (CVE-2024-22201)
Platform 3.16
* Library Upgrades
- error_prone_annotations to 2.25.0 (was 2.18.0)
Platform 3.14
* Library Upgrades
- jackson to 2.16.1 (was 2.15.2)
- logback to 1.5.0 (was 1.4.12)
Platform 3.13
* Library Upgrades
- Base Docker image to c15-java17:3.45 (was 3.44) (CVE-2023-6246 CVE-2023-6779 CVE-2023-6780 CVE-2024-20918 CVE-2024-20919 CVE-2024-20921 CVE-2024-20926 CVE-2024-20932 CVE-2024-20945 CVE-2024-20952)
Platform 3.12
* Library Upgrades
- Base Docker image to c15-java17:3.44 (was 3.42)
Platform 3.09
* HttpServer
- We added a configuration to allow ambiguous URI path components
Platform 3.08
* Library Upgrades
- logback to 1.4.12 (was 1.4.11)
Platform 3.07
* Library Upgrades
- Base Docker image to c15-java17:3.42 (was 3.23)
Platform 3.06
* HttpClient
We fixed a bug where statically configured HttpClientBalancers that were supposed to be shared
across multiple BalancingHttpClients weren't bound in singleton scope.
Platform 3.04
* Library Upgrades
- Base Docker image to c15-java17:3.23 (was 3.12)
Platform 3.03
* Library Upgrades
- Jetty to 11.0.17 (was 11.0.16) (CVE-2023-44487 CVE-2023-36478)
Platform 3.02
* Library Upgrades
- Base Docker image to c15-java17:3.12 (was c15-java11:3.10)
Platform 3.01
* Library Upgrades
- AutoValue to 1.10.4 (was 1.7.4)
- Guava to 32.1.2-jre (was 32.0.0-jre)
- Jackson to 2.15.2 (was 2.15.0)
- logback to 1.4.11 (was 1.2.11)
- slf4j to 2.0.9 (was 2.0.5)
Platform 3.00
* HttpClient
We now share a HttpClientBalancer across all BalancingHttpClients that share the same
statically configured service.
Platform 2.99
* Library Upgrades
- Jetty to 11.0.16 (was 11.0.15) (GHSA-58qw-p7qm-5rvh)
Platform 2.98
* Library Upgrades
- Base Docker image to c15-java11:3.10 (was 3.2)
Platform 2.97
* HttpClient
We fixed the metrics reporting for a HttpClientBinder method that was added in Platform 2.96
Platform 2.96
* Reporting
ReportingClientModule no longer uses the Discovery service to find the reporting service.
The URI of the reporting service must now be specified through the "service-client.reporting.uri"
configuration property.
Platform 2.95
* Discovery
We now include the service type and pool in the log message when a discovery
query returns no instances.
* Maven plugin upgrades
- modernizer to 2.5.0 (was 2.2.0)
Platform 2.94
* Library Upgrades
- Base Docker image to c15-java11:3.2 (was 2.81)
Now supports both `arm64` and `amd64` architectures.
- Guava to 32.0.0 (was 31.1) (CVE-2022-8901, CVE-2023-2976)
* Maven plugin upgrades
- docker-maven-plugin to 0.43.0 (was 0.40.2)
Platform 2.93
* Library upgrades
- Airline to 2.9.0 (was 0.4)
Platform 2.90
* Library Upgrades
- Base Docker image to c15-java11:2.81 (was 2.74)
Platform 2.89
* Major version upgrade from JEE 8 to JEE 9. This will require migrating usage of javax.* packages
and namespaces to the new jakarta.* equivilents. JEE 8 artifacts (servlets, injection, etc), are
not compatible with JEE 9 and will need to be upgraded.
General Migration Guide: https://ralph.blog.imixs.com/2020/12/13/migrating-to-jakarta-ee-9/
javax -> jakarta namespace mappings: https://github.com/jakartaee/jakartaee-platform/blob/main/namespace/mappings.adoc
* Library Upgrades
- Jetty to 11.0.15 (was 10.0.15)
- Jersey to 3.0.10 (was 2.27)
- Guice to 7.0.0 (was 5.0.1)
- jakarta-validation-api to 3.0.2 (was 3.0.0)
- javax.inject -> jakarta.inject 2.0.1
- javax.servlet-api -> jakarta.servlet-api 5.0.0
- javax.ws.rs-api -> jakarta.ws.rs-api 3.0.0
- javax.activation -> jakarta.activation 2.0.1
- javax.annotation-api -> jakarta.annotation-api 2.1.0
- javax.xml.bind -> jakarta.xml.bind-api 3.0.0
* Migration Notes
- JEE 8 dependencies added to banned dependencies (build will fail if artifacts are dependencies)
- Import Replacements
- javax.inject.* -> jakarta.inject.*
- javax.annotation.* -> jakarta.annotation.*, Except:
- javax.annotation.concurrent.ThreadSafe (not yet added to ErrorProne)
- javax.annotation.concurrent.GuardedBy -> com.google.errorprone.annotations.concurrent.GuardedBy
- javax.servlet.* -> jakarta.servlet.*
- javax.ws.rs.* -> jakarta.ws.rs.*
Platform 2.88
* Bug Fix: Do not require SNI or Host Checks, as this conflicts with Kubernetes Health Probes
Platform 2.87
* Library Upgrades
- Jackson to 2.15.0 (was 2.13.4)
- joda-time to 2.12.5 (was 2.10.10)
Platform 2.86
* Major version upgrade from Jetty 9 to Jetty 10, which supports the Servlet 4.0
specification. This will be the last major version supporting the javax.* packages.
* Library Upgrades
- Jetty to 10.0.15 (was 9.4.48)
- slf4j to 2.0.5 (was 1.7.36)
- javax.servlet-api to 4.0.1 (was 3.1.0)
Platform 2.85
* Library Upgrades
- Base Docker image to c15-java11:2.74 (was 2.72)
- swagger-jaxrs2 to 2.2.9 (was 2.0.0) CVE-2022-1471
Platform 2.84
* Library Upgrades
- Base Docker image to c15-java11:2.72 (was 2.67)
Platform 2.83
* Docker images now include any values of the GIT_COMMIT, BUILD_URL, or GIT_URL
environment variable in corresponding labels.
* Maven plugin upgrades
- nexus-staging-maven-plugin to 1.6.13 (was 1.6.8)
Platform 2.78
* HTTPClient
We added HttpClientBinder.withoutCertificateVerification() to disable certificate
verification for a HttpClient.
* Library Upgrades
- testng to 7.7.1 (was 7.6.1) CVE-2022-4065
Platform 2.77
* Base images
The base image for containers is now expected to have ["java", "-jar"] in its ENTRYPOINT.
The default base image has been changed accordingly. Projects that are overriding the
default value of project.docker.from will need to change their base image's ENTRYPOINT.
* Library Upgrades
- Base Docker image to c15-java11:2.67 (was 2.65)
Platform 2.76
* HttpServer
We added HttpServerModule.withSessionHandler() to bind a Jetty SessionHandler into
the constructed HttpServer.
* Library Upgrades
- snakeyaml to 1.33 (was 1.31)
- testng to 7.6.1 (was 7.6.0)
Platform 2.75
* Library Upgrades
- Jackson-databind to 2.13.4.2 (was 2.13.4)
Platform 2.74
* Library Upgrades
- Jackson to 2.13.4 (was 2.13.3)
Platform 2.73
* Library Upgrades
- Base Docker image to c15-java11:2.65 (was 2.59)
Platform 2.72
* Docker images are now built with JIB. The jar files are now located
under "/maven/lib/" instead of "/service/lib/".
* Maven plugin upgrades
- docker-maven-plugin to 0.40.2 (was 0.35.0)
Platform 2.70
* Reporting
We added ReportingSplunkObservabilityModule() to the reporting-client module, adding
support for sending metrics to Splunk Observability.
* Library Upgrades
- Jetty to 9.4.48 (was 9.4.42)
- SnakeYAML to 1.31 (was 1.18) (CVE-2017-18640)
- Base Docker image to c15-java11:2.59 (was 2.53)
Platform 2.69
* We fixed a bug in TestingDiscoveryModule that caused it to leak threads.
Platform 2.68
* Maven plugin upgrades
- spotbugs-maven-plugin to 4.7.0.0 (was 4.2.2)
* Library Upgrades
- spotbugs-annotations to 4.7.0 (was 3.1.8)
- JMH to 1.35 (was 1.13)
- TestNG to 7.6.0 (was 6.14.3)
- AssertJ-core to 3.22.0 (was 3.19.0)
- Objenesis to 3.2 (was 3.1)
- byte-buddy to 1.12.9 (was 1.10.22)
- Mockito to 4.5.1 (was 3.8.0)
- javassist to 3.29.0-GA (was 3.24.0-GA)
- Jackson to 2.13.3 (was 2.13.2)
Platform 2.67
* Discovery
We now log a warning when the initial Discovery query for a service returns
no instances.
* Library Upgrades
- Base Docker image to c15-java11:2.53 (was 2.50)
Platform 2.66
* Library Upgrades
- Jackson to 2.13.2 (was 2.12.2)
jackson-databind to 2.13.2.1 (CVE-2020-36518)
- Guava to 31.1 (was 31.0)
- slf4j to 1.7.36 (was 1.7.30)
- logback to 1.2.11 (was 1.2.9)
- Base Docker image to c15-java11:2.50 (was 2.45)
Platform 2.65
* We removed an unnecessary dependency on the removed openapi JAR file.
* We removed the archetype builders.
* Library Upgrades
- logback to 1.2.9 (was 1.2.3)
Platform 2.61
* Library Upgrades
- Base Docker image to c15-java11:2.45 (was 2.38)
Platform 2.60
* Java 17
We added compatibility with Java 17.
* Library Upgrades
- Guice to 31.0-jre (was 30.1-jre)
- slice to 0.40 (was 0.10)
Platform 2.59
* Library Upgrades
- jakarta.el to 4.0.2 (was 4.0.0)
Platform 2.58
* Bean validation
We upgraded Hibernate Validator to 7.0.1.Final, switching to the Jakarta
validation API. We also upgraded the jakarta.el Expression Language to
4.0.0.
All Maven dependencies of the form:
<dependency>
<groupId>javax.validation</groupId>
<artifactId>validation-api</artifactId>
</dependency>
must be changed to:
<dependency>
<groupId>jakarta.validation</groupId>
<artifactId>jakarta.validation-api</artifactId>
</dependency>
and all imports of symbols under "javax.validation" must be changed to
instead be under "jakarta.validation".
Platform 2.57
* Library Upgrades
- Base Docker image to c15-java11:2.38 (was 2.32)
Platform 2.56
* Modernizer
We suppress Modernizer errors related to ImmutableSet, as the suggested
replacements don't preserve order.
Platform 2.55
* Modernizer
We suppress Modernizer errors related to ImmutableMap, as the suggested
replacements don't preserve key order.
We now provide a version for the org.gaul:modernizer-maven-annotations dependency.
Platform 2.54
* Java 8
We increased the minimum Java version to 11.0.3.
* HTTPServer and HTTPClient
We disabled the TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 and
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 ciphers.
* Library Upgrades
- Base Docker image to c15-java11:2.32 (was 2.30)
Platform 2.53
* Library Upgrades
- Jetty to 9.4.42 (was 9.4.40)
- Base Docker image to c15-java11:2.30 (was 2.29)
Platform 2.51
* Discovery and Balancing HTTPClient
DiscoveryModule now permits statically configuring the set of URIs for a
service by setting the "service-balancer.SERVICENAME.uri" configuration
option to a comma-separated list of URIs.
StaticDiscoveryModule now requires the "service-balancer.SERVICENAME.uri"
configuration option for each discovered service to have at least one URI.
HttpClientBinder now includes additional bindBalancingHttpClient() methods
which use URIs provided in configuration.
Platform 2.49
* Library Upgrades
- Base Docker image to c15-java11:2.29 (was 2.24)
* Maven plugin upgrades
- modernizer-maven-plugin to 2.2.0 (was 1.8.0)
Platform 2.48
* Library Upgrades
- Jetty to 9.4.40 (was 9.4.38) (CVE-2021-28163, CVE-2021-28164, CVE-2021-28165)
* Maven
We fixed the specification for the JaCoCo agent in the dependencyManagment section.
Platform 2.47
* Jetty
- We reverted Jetty to 9.4.38 due to a bug that causes TLS connection failures.
* Maven
We now specify a version for the JaCoCo agent in the dependencyManagment section.
* Maven plugin upgrades
- build-helper-maven-plugin to 3.2.0 (was 3.1.0)
- maven-resources-plugin to 3.2.0 (was 3.1.0)
- maven-assembly-plugin to 3.3.0 (was 3.2.0)
- duplicate-finder-maven-plugin to 1.5.0 (was 1.4.0)
- spotbugs-maven-plugin to 4.2.2 (was 4.0.0)
- maven-site-plugin to 3.9.1 (was 3.9.0)
- docker-maven-plugin to 0.35.0 (was 0.33.0)
* Library Changes
- guice-multibindings has been removed as it is no longer a standalone library.
Platform 2.46
* Library Upgrades
- Jetty to 9.4.39 (was 9.4.38) (CVE-2021-28163, CVE-2021-28164, CVE-2021-28165)
- Base Docker image to c15-java11:2.24 (was 2.22)
Platform 2.44
* Library Upgrades
- slf4j to 1.7.30 (was 1.7.26)
- Joda-Time to 2.10.10 (was 2.10.1)
- Jackson to 2.12.2 (was 2.11.0)
- hibernate-validator to 6.0.21.Final (was 6.0.18.Final)
- assertj-core to 3.19.0 (was 3.12.2)
- assertj-guava to 3.4.0 (was 3.2.1)
- assertj-db to 2.0.2 (was 1.2.0)
- Objenesis to 3.1 (was 3.0.1)
- Mockito to 3.8.0 (was 2.28.2)
- Hamcrest to 2.2 (was 1.3)
- byte-buddy to 1.10.22 (was 1.9.13)
Platform 2.43
* Library Upgrades
- auto-value to 1.7.4 (was 1.6.5)
- Guava to 30.1 (was 30.0)
- Guice to 5.0.1 (was 4.2.3)
- Jetty to 9.4.38 (was 9.4.35)
- Base Docker image to c15-java11:2.22 (was 2.21)
Platform 2.42
* Deprecation removals
We have removed the empty OpenApiModule. Its functionality has long since
been incorporated into JaxrsModule and references to it should be deleted.
We removed the following deprecated APIs:
- Logging.logToFile(String, int, DataSize, DataSize)
- Logging.addShutdownHookToWaitFor(Thread)
- Logging.removeShutdownHookToWaitFor(Thread)
- RollingFileHander(String, int, DataSize, DataSize) constructor
- ShutdownWaitingLogManager.addWaitForShutdownHook(Thread)
- ShutdownWaitingLogManager.removeWaitForShutdownHook(Thread)
- log.max-size-in-bytes configuration option
* Library Upgrades
- Base Docker image to c15-java11:2.21 (was 2.17)
Platform 2.41
* HttpServer
We changed the format of the JSON request log to take less space and omit
less-used fields. The previous format may be selected by setting the
"http-server.log.format" config option to "JSON_VERBOSE".
Platform 2.40
* We fixed an issue in the JMX module when running on a version of Java with
a four-segment version number.
* We no longer replace a previous set of discovered instances when the
discovery service returns an empty set of instances.
* Library Upgrades
- Base Docker image to c15-java11:2.17 (was 2.13)
Platform 2.39
* Library Upgrades
- Jetty to 9.4.35 (was 9.4.33)
- Guava to 30.0 (was 29.0)
- Base Docker image to repocache.nonprod.ppops.net/dev-docker-local/c15-java11:2.13
Base image needs to have the "service" user and /service/var directory.
* Packaging
We now exclude test-scope jar files from distribution tar files and
Docker images.
Platform 2.38
* Library Upgrades
- Jetty to 9.4.33 (was 9.4.32) (fixes CVE-2020-27216)
- Base Docker image to proofpoint/platform-zulu-11:1.11
based on 11.0.9. Pull image through repocache docker-remote.
Platform 2.37
* HTTP Server
We now delay creating the listen sockets until the @AcceptRequests phase.
We reduced the default accept queue size to 10 from 128 in order to shed
load during connection storms.
* Library Upgrades
- Jetty to 9.4.32 (was 9.4.24)
- Base Docker image to proofpoint/platform-zulu-11:1.10
update libx11-6 and libx11-data to 2:1.6.7-1+deb10u1 for CVE-2020-14363
Platform 2.36
* Library Upgrades
- Base Docker image to proofpoint/platform-zulu-11:1.9
based on 11.0.8
Platform 2.35
* Library Upgrades
- Base Docker image to proofpoint/platform-zulu-11:1.8
update libsystemd0 to 241-7~deb10u4 for CVE-2020-1712
Platform 2.34
* Build
We now use the SONAR_HOST_URL instead of a .build-sonar file to enable
SonarQube reporting.
Platform 2.33
* Build
We now set the Sonar projectKey when Sonar is enabled.
Platform 2.32
* Library Upgrades
- Base Docker image to proofpoint/platform-zulu-11:1.7
updates libgnutls30 to 3.6.7-4+deb10u4 for CVE-2020-13777
Platform 2.30
* Library Upgrades
- Guava to 29.0-jre (was 28.2-jre)
- Jackson to 2.11.0 (was 2.10.0) (fixes deserialization vulnerabilities
when using @JsonTypeInfo or "default typing")
Platform 2.29
* Build
We now enable JaCoCo code coverage of (Maven) integration tests.
If the project has a .build-sonar file we now report code coverage to
SonarQube.
* Launcher
We moved the StartLimitIntervalSecs setting back from [Unit] to [Service] and
changed its name to StartLimitInterval.
Platform 2.28
* Library Upgrades
- Base Docker image to proofpoint/platform-zulu-11:1.6
based on azul/zulu-openjdk-debian:11.0.7-11.39.15
(was proofpoint/platform-zulu-11:1.5)
Platform 2.27
* Library Upgrades
- Guice to 4.2.3 (was 4.2.2)
* Maven plugin upgrades
- jacoco-maven-plugin to 0.8.5 (was 0.8.4)
- sonar-maven-plugin 3.7.0.1746 (previously unspecified)
- build-helper-maven-plugin to 3.1.0 (was 3.0.0)
- maven-assembly-plugin to 3.2.0 (was 3.1.1)
- maven-javadoc-plugin to 3.2.0 (was 3.1.0)
- maven-jar-plugin to 3.2.0 (was 3.1.0)
- maven-source-plugin to 3.2.1 (was 3.1.0)
- dependency-scope-maven-plugin to 0.10 (was 0.8)
- spotbugs-maven-plugin to 4.0.0 (was 3.1.12)
- maven-site-plugin to 3.9.0 (was 3.7.1)
- plexus-compiler-javac-errorprone to 2.8.6 (was 2.8.5)
- error_prone_core to 2.3.4 (was 2.3.3)
- maven-dependency-plugin to 3.1.2 (was 3.1.1)
- maven-invoker-plugin to 3.2.1 (was 3.2.0)
- maven-shade-plugin to 3.2.2 (was 3.2.1)
Platform 2.26
* Configuration
We added support for JSON-format configuration.
If the file "etc/config/config.json" exists, then it will be read instead
of the default "etc/config.properties" and "etc/secrets.properties".
Additionally, files matching the glob "etc/*/config.json" will be read.
In the read JSON, arrays and objects will be (recursively) flattened. Null
values will be ignored. For example, the JSON:
{
"array": [ "value", null, 6 ],
"object": { "a": "b", "c": false }
}
will be interpreted as:
array.1=value
array.3=6
object.a=b
object.c=false
* Logging
We added support for JSON-format configuration of log levels. If the file
"etc/config/log.json" exists, then it will be read instead of the default
"etc/log.properties".
* Launcher
We added support for JSON-format configuration of jvm arguments. If the file
"etc/config/jvm.json" exists, then it will be read instead of the default
"etc/jvm.properties" or "etc/jvm.config".
Platform 2.25
* HttpServer
We added 100.64.0.0/10 to the default set of networks trusted for following
the X-Forwarded-For: header.
* Docker
We removed support for Sealights under Docker.
* JAX-RS
We added a "testing.jaxrs.override-method-filter" config option (default "true")
which can be set to "false" to disable the OverrideMethodFilter (allows overriding
POST requests with PUT or DELETE via header or query param)
Platform 2.24
* Library Upgrades
- Base Docker image to proofpoint/platform-zulu-11:1.5
based on 11.0.6 (was proofpoint/platform-zulu-11:1.4)
* Maven plugin upgrades
- docker-maven-plugin to 0.33.0 (was 0.30.0)
Platform 2.23
* Launcher
We moved the StartLimitIntervalSecs setting from [Unit] to [Service] in
order to fix an error on newer versions of systemd.
Platform 2.22
* HttpServer
We fixed a regression in 2.19 when a Java keystore had multiple cert/key
pairs.
* Library Upgrades
- Guava to 28.2-jre (was 28.1-jre)
- hibernate-validator to 6.0.18.Final (was 6.0.16.Final)
* Maven plugin upgrades
- duplicate-finder-maven-plugin to 1.4.0 (was 1.3.0)
Platform 2.20
* HttpClient
We fixed a bug
bindDiscoveredHttpClient(String, Class<? extends Annotation>) that was
introduced in 2.19.
Platform 2.19
* HttpClient
We have deprecated @com.proofpoint.discovery.client.ServiceType in favor of
@com.proofpoint.http.client.ServiceType.
We created convenience HttpClientBinder methods
bindBalancingHttpClient(String, String, String...) and
bindKubernetesServiceHttpClient(String, String)
* Deprecation removals
We removed the following deprecated APIs:
- AnnotatedBindingBuilder constructor
- PrefixBindingBuilder constructor
- ConfigBindingBuilder constructor
- ConfigurationProvider
- HttpClientModule
- http.client.Request constructors
- RuntimeIOException
- JettyHttpClient.getIoPoolStats()
- JettyIoPoolConfig
- ClientInfoUtils.clientAddressFor()
- HttpServer constructors
- HttpServerProvider, TestingHttpServer, and TestingAdminHttpServer
constructors without a ClientAddressExtractor parameter
- RequestStats.record(String, int, long, long, Duration, Duration)
- TestingNodeModule constructors taking Guava Optional
- http-client.max-threads configuration option
- http-client.min-threads configuration option
- http-client.timeout-concurrency configuration option
- http-client.timeout-threads configuration option
* Library Upgrades
- Jetty to 9.4.24 (was 9.4.21)
Platform 2.18
* Library Upgrades
- Base Docker image to proofpoint/platform-zulu-11:1.4
based on 11.0.5 (was proofpoint/platform-zulu-11:1.3)
Platform 2.17
* Audit Logging
- The default value for "audit.log.path" has changed to "var/log/audit.log".
This config option is no longer overridden by the launcher. To disable
audit logging, for example when running in-IDE, use the new config option
"audit.log.enable".
Platform 2.16
* Library Upgrades
- Jackson to 2.10.0 (was 2.9.10) (fixes deserialization vulnerabilities
when using @JsonTypeInfo or "default typing")
Platform 2.14
* Reporting
We added a "reporting.pulse.include-host-tag" config option (default "true")
which can be set to "false" in order to omit the "host" tag from metrics
reported to Pulse.
* Library Upgrades
- Jetty to 9.4.21 (was 9.4.20) (various HTTP/2 denial-of-service fixes)
Platform 2.13
* Library Upgrades
- Jackson to 2.9.10 (was 2.9.9) (fixes deserialization vulnerabilities
when using @JsonTypeInfo or "default typing")
Platform 2.12
* HttpClient and HttpServer
We disabled TLS 1.1 and the ciphers TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_256_CBC_SHA, and
TLS_RSA_WITH_AES_128_CBC_SHA.
* JMX
- We fixed a bug preventing JMX from starting on Java 11.
- We log a hint about necessary JVM config when JMX fails to start on Java 11
- We skip starting the JMX agent on Java 11 if it is already configured.
* Library Upgrades
- Guava to 28.1-jre (was 28.0-jre)
Platform 2.11
* Logging
We added a "log.queue-size" configuration option. If nonzero, the main
launcher.log will use asynchronous logging with an in-memory queue
of the configured maximum size. The default is "0".
* Library Upgrades
- Jetty to 9.4.20 (was 9.4.18)
Platform 2.10
* Library Upgrades
- jackson-databind to 2.9.9.3 (was 2.9.9.2) (fix regression in Platform 2.09)
Platform 2.09
* Launcher
Arguments in jvm.properties that start with "-XX:+Unlock" now get moved
earlier than other arguments in jvm.properties.
* Library Upgrades
- jackson-databind to 2.9.9.2 (was 2.9.9.1) (CVE-2019-14379 CVE-2019-14439)
Platform 2.08
* Library Upgrades
- jackson-databind to 2.9.9.1 (was 2.9.9) (CVE-2019-12384 CVE-2019-12814)
- Base Docker image to proofpoint/platform-zulu-11:1.3
based on 11.0.4 (was proofpoint/platform-zulu-8:1.2)
Platform 2.07
* Docker
Docker images built now specify their user numerically instead of by name.
* OpenApi
We moved the OpenApi support into the jaxrs module. The openapi module no
longer does anything and is deprecated
* Maven plugin upgrades
- maven-compiler-plugin to 3.8.1 (was 3.8.0)
- maven-assembly-plugin to 3.1.1 (was 3.1.0)
- maven-surefire-plugin to 2.22.2 (was 2.22.1)
- maven-javadoc-plugin to 3.1.0 (was 3.0.1)
- maven-source-plugin to 3.1.0 (was 3.0.1)
- duplicate-finder-maven-plugin to 1.3.0 (was 1.2.1)
- spotbugs-maven-plugin to 3.1.12 (was 3.1.8)
- jacoco-maven-plugin to 0.8.4 (was 0.8.2)
- modernizer-maven-plugin to 1.8.0 (was 1.7.1)
- docker-maven-plugin to 0.30.0 (was 0.27.2)
- plexus-compiler-javac-errorprone to 2.8.5 (was 2.8.2)
- error_prone_core to 2.3.3 (was 2.0.21)
- maven-invoker-plugin to 3.2.0 (was 3.1.0)
- maven-shade-plugin to 3.2.1 (was 3.1.1)
Platform 2.06
* Bean Validation
We replaced Apache BVal with Hibernate Validator.
Unit tests which assertFailsValidation with a message of "may not be null"
will need to be changed to assert a message of "must not be null".
Any use of org.apache.bval.jsr.ApacheValidationProvider will need to be
replaced with org.hibernate.validator.HibernateValidator.
Any Maven dependency of:
<dependency>
<groupId>org.apache.bval</groupId>