• starting in Spring Framework 7.1, ForwardedHeaderFilter (Spring MVC) and ForwardedHeaderTransformer (WebFlux) each require a boolean argument whether to use the standard "Forwarded" header or the "X-Forwarded" alternative headers. A separate property enables use of "X-Forwarded-Prefix" if needed. The default constructor with the existing behaviour of checking both types of headers is still available but deprecated and marked for removal. The new constructor makes forwarded header processing more deterministic and aligned with what is expected from the proxy. Please, see the updated Security Considerations section, as well as related changes in Spring Boot https://github.com/spring-projects/spring-boot/issues/51030. #37072
• Default context config is not detected when superclass or enclosing class is not annotated with @ContextConfiguration #31456

• Add logging operators in DefaultExchangeFunction only when debug is enabled #37095
• Consistently enforce non-null instance in AbstractFactoryBean #37091
• Reinstate invalid resource location checks #37063
• Preserve original bean names as aliases with FullyQualifiedConfigurationBeanNameGenerator #37038
• Improve forwarded header parsing #36964
• Avoid "NullAway.Init" suppression in favor of explicit field handling #36961
• Refine and better specify error handling in MultipartParser #36947
• Use double division to calculate applied jitter in ExponentialBackOff #36943
• Throw ClassNotFoundException for missing class resource in ThrowawayClassLoader #36938
• Replace isAssignableFrom() with isInstance() where feasible #36899
• Simplify BUFFER_COUNT in ConcurrentLruCache to a constant #36872
• Apply auto-grow collection limit to direct field binding #36862
• Reject duplicate MIME type parameters #36841
• Add DataSize converters to DefaultConversionService #36830
• Only update ObservationThreadLocalAccessor when a test has an active ApplicationContext #36817
• Deprecate setDisallowedFields in DataBinder for removal #36816
• Optimize ClassNameReader.getClassName via direct ASM API #36814
• AbortedException from client logged at ERROR level with WebFlux functional endpoint #36811
• Add dedicated exception for HttpStatus.PRECONDITION_FAILED #36807
• Reset mocks only when a test has an active ApplicationContext #36782
• Improve MimeType parser for RFC compliance #36729
• Reject unsafe static resource locations in MVC and WebFlux #36695
• Use String#replace instead of String#replaceAll where appropriate #36678
• Beans created with BeanRegistrar on GenericApplicationContext do not honor allow-bean-definition-overriding setting #36648
• Use defensive Date copies for SimpleMailMessage sentDate #36626
• Align StandardMethodMetadata with ASM/ClassFile support for getReturnTypeName() #36619
• Use canonical names in error messages in annotation processing #36607
• Provide bean conditional registration capabilities in BeanRegistrarDsl #36601
• Align with JDK behavior by throwing TypeNotPresentException during annotation processing #36593
• Deprecate RestTemplate and related types #36574
• Remove deprecated methodIdentification() method in CacheAspectSupport #36560
• Reject unbalanced parentheses in profile expressions #36550
• Introduce ResolvableType.forParameter() factory method #36545
• Remove redundant Assert.notNull() checks in ResolvableType #36544
• Introduce support for custom parameter names in ParameterResolutionDelegate #36534
• Perform case-insensitive lookup in HttpMethod.valueOf() #36518
• Add "application/jsonl" support alongside "application/x-ndjson" for streaming #36485
• Replace HandlerMappingIntrospector with PreFlightRequestHandler bean in MVC config #36481
• GenericTypeResolver.resolveType should resolve TypeVariable with nested ParameterizedType #36480
• Introduce classpath*: support for ResourceLoader#getResource with fully specified resource path #36415
• Support for Map body types in FormHttpMessageConverter #36408
• Support compilation of SpEL expressions that use Optional with null-safe and Elvis operators #36330
• Skip Jaxb auto-detection in HttpMessageConverters for servers #36302
• Handle multi-JAR resources in ReloadableResourceBundleMessageSource #36292
• Support for JPA 4.0 @PersistenceAgent injection #36264
• Move multipart support out of FormHttpMessageConverter #36256
• Introduce MultipartHttpMessageConverter #36255
• Introduce HttpMessageConverter#canWriteRepeatedly #36252
• Override Servlet 6.1's doPatch() method in FrameworkServlet #36247
• Allow local @BootstrapWith annotation to override a meta-annotation within the same composed annotation #35938
• Support for JTA 2.1 read-only transaction management #35915
• Add typesafe method to get generic bean by name with type reference #35808
• Support reading multipart requests from RestTestClient in MockMvc #35569
• Use 500 for default exception handling when DisconnectedClientHelper#clientDisconnectedException returns true #34481
• Support reading multipart HTTP messages with a converter #33263
• Provide bean conditional registration capabilities in BeanRegistrar #21497
• Support @MockitoBean and @MockitoSpyBean on test constructor parameters #36096

• Ignore static get/is accessor methods in PropertyDescriptorUtils #37081
• AnnotationDescriptor.findAllLocalMergedAnnotations fails to find interface annotations #36975
• PartGenerator should close the OutputStream when it's done reading the part #36945
• PartGenerator should also clean up the current State in case of failure #36942
• Close class resource InputStream in ThrowawayClassLoader #36933
• GenericTypeResolver.resolveType picks a sibling interface's binding when two interfaces share a type-variable name (breaks @RequestBody deserialization) #36890
• Restore thread interrupt flag in DefaultMvcResult when catching InterruptedException #36876
• Character outside of permitted range in Content Disposition #36805
• Reinstate Root Servlet context as a valid location #36753

• Upgrade Kotlin Coroutines to 1.11 #37076
• Upgrade to Hibernate ORM 7.4 #36519
• Upgrade to Jackson 3.1 and 2.21 #36130
• Upgrade to JUnit 6.1.2 #36815
• Upgrade to Kotlin 2.3.20 #36484
• Upgrade to Kotlin 2.4 #37074
• Upgrade to Kotlin Serialization 1.11.0 #36657

Thank you to all the contributors who worked on this release:

@PaulNgo-BlueOC, @arnabnandy7, @bebeis, @codingkiddo, @cookie-meringue, @daguimu, @dominik-kovacs, @jhan0121, @junhyeong9812, @leestana01, @mkurz, @ngocnhan-tran1996, @quaff, @s-chan-o, @samueldlightfoot, @seregamorph, @shenjianeng, and @yeomin4242

• in Spring Framework 7.0.9, ForwardedHeaderFilter (Spring MVC) and ForwardedHeaderTransformer (WebFlux) each provide a boolean constructor argument whether to use the standard "Forwarded" header or the "X-Forwarded" alternative headers. A separate property turns on and off use of "X-Forwarded-Prefix". While the default constructor preserves the existing behavior, we recommend to use the new constructor to explicitly specify which forwarded headers to use to make the processing more deterministic and aligned with what is expected from the proxy. Please, see the updated Security Considerations section for details. In 7.1 with #37072 the default constructor is deprecated and marked for removal. #37090

• Ignore an empty port value in URI parsing #37117
• Avoid retaining class files in annotation metadata #37112
• Add @Nullable annotations when treating Map.remove() as returning @Nullable #37067
• Fix missing nullability in JdbcTemplate.batchUpdate #37012
• Timeout property in RetryPolicy does not have a default constant #36983
• Write native configuration files as UTF-8 #36972
• DefaultServerRequest.ServletParametersMap.entrySet() does not retain HttpServletRequest.getParameterMap() order #36966
• Perform nextKey within synchronization for SQLite as well #36959
• Add support for custom ObjectInputFilter on DefaultDeserializer #36958
• Revise resource bundle caching for common locales #36957
• Improve nullability for getSession(*) in MockHttpServletRequest #36926
• Improve fallback logic in ParameterContentNegotiationStrategy and ParameterContentTypeResolver #36925
• Improve ambiguous match check on preflight request #36903
• Improve Groovy markup template loading #36902
• Improve request path handling on a Reactor Netty server #36893
• Improve JettyWebSocketSession error handling #36891

• EclipseLinkJpaDialect singleton lock in EclipseLinkConnectionHandle.getConnection() serializes all JDBC connection acquisitions under load #37085
• MetadataReader fails to read byte[] array from annotation #37083
• Character outside of permitted range in Content Disposition #37062
• Release Jackson BufferRecycler to its pool in encoders #37059
• Reset TwoByteMatcher partial match on mismatching byte #37053
• Align domainToAscii with current WhatWG spec #37018
• Ensure consistent ButtonTag value attribute processing #37017
• SpEL's InlineList is cached as a mutable list in compiled mode #37001
• Write native configuration file when only lambda hints are present #36989
• SpEL Indexer reuses invalid cached PropertyAccessor #36986
• SpEL reuses invalid cached ConstructorExecutor #36985
• MimeTypeUtils raises StringIndexOutOfBoundsException for some invalid mime types #36971
• Ignore DOCTYPE inside a multi-line comment body #36948
• Avoid divide-by-zero in ExponentialBackOff jitter #36932
• Refactor use or close lock in ConcurrentWebSocketSessionDecorator #36909
• Host header initialization breaking change in StompRelayMessageBrokerHandler #36907
• Remote address checks for SockJS session #36681 breaks xhr-polling #36904
• LifeCyclePrintWriter does not delegate correctly #36885
• IllegalArgumentException when creating named native query via Shared EntityManager with Hibernate 8.0.0-SNAPSHOT / JPA 4.0.0-M4 #36878

• Document AOP proxy semantics for Bean Overrides in tests #37121
• Provide guidance for object model design in SpEL #37102
• Fix Javadoc error in ProtobufDecoder #37079
• Document security implications of evaluating untrusted SpEL expressions #36997
• Document relationships between expressions, evaluation contexts, and accessors in SpEL #36968
• Update Javadoc for @ActiveProfiles ordering #36950
• Document behavior for 0 delay combined with jitter in backoff policies #36946
• Clarify design goal of UrlFilenameViewController in Javadoc #36906

Thank you to all the contributors who worked on this release:

@ZaMan0806, @alexisgra, @alshain, @gianmarcoschifone, @junhyeong9812, @msridhar, @perovic, @quaff, and @samueldlightfoot

• Spring Boot's Gradle plugin no longer automatically configures gRPC when the Protobuf plugin is applied. This behavior caused problems for those using Protobuf without gRPC. To opt in to the configuration of gRPC, configure the protobuf extension with the grpc plugin using an empty block. The Spring Boot Gradle plugin will then automatically configure the use of protoc-gen-grpc-java as before. #50822

• Kafka consumer-specific security protocol is not taken into account #51369
• Structured logging: a failed JSON encode corrupts the next log event written on the same thread #51156
• Micrometer registries pin the application context #51135
• Temporary file is not deleted when ExportedImageTar construction fails #51132
• Metadata annotation processor ignores getter-level @NestedConfigurationProperty for records #51098
• spring-boot-h2-console pulls servlet-api as transitive dependency #51095
• PropertiesLauncher does not log nested archive paths #51089
• Methods that return the result of Map#remove are not declared with a @Nullable return type #51087
• NativeImageResourceProvider flattens Flyway migration paths in subdirectories #50964
• Fix ordering of Kotlinx Serialization CodecCustomizer #50961
• JarFile is not closed when finding main class from archive #50959
• Application-managed JUL bridge handler should only be removed if installed #50950
• CloudFoundry reactive auto-configuration should not require a WebClient.Builder bean to be defined #50944
• Context refresh fails on reactive Cloud Foundry when using Actuator without spring-boot-health #50942
• Resources are not cleaned up when resolving an image that is not yet present in the builder #50941
• GraphQlWebMvcAutoConfiguration should apply customizers in order #50914
• Auto-configured RedisMessageListenerContainer does not use virtual threads when spring.threads.virtual.enabled is true #50884
• Context refresh fails when using Actuator on Jersey without spring-boot-health #50872
• Context refresh fails on Cloud Foundry when using Actuator without spring-boot-health #50871
• IllegalStateException when binding properties to a @Validated class that contains a map whose value type is a wildcard #50856
• High number of connections due to Mongo health indicator #50852
• Inconsistent handling of empty string values of spring.security.oauth2.resourceserver.jwt issuer-uri and jwk-set-uri #50849
• Return type nullability of ApplicationContextAssert's getBean methods does not indicate that bean may be null #50845
• PropertiesWebClientHttpServiceGroupConfigurer has highest precedence, preventing other configurers from being ordered ahead of it #50843
• Exposing gRPC test server port should backoff if gRPC is not present #50825
• JpaBaseConfiguration#entityManagerConfiguration can cause a dependency loop on beans declaring AsyncTaskExecutor #50801
• spring.grpc.server.health.include-overall-health is not taken into account #50799
• Setting 'server.servlet.session.cookie.partitioned' to false still emits the 'Partitioned' cookie attribute #50790
• Managed version of Prometheus Client is not aligned with Micrometer's micrometer-registry-prometheus #50780
• Map properties bound from empty strings fail with ConverterNotFoundException #50773
• Protobuf Common Protos should not be a managed dependency #50772
• An application that depends on spring-boot-security-oauth2-resource-server may fail to start with a ClassNotFoundException when Reactor is on the classpath but WebFlux is not #50764
• W3CHeaderParser's decoding is not compliant with RFC 3986 #50650

• Description of spring.graphql.websocket.connection-init-timeout does not render correctly in the reference guide #51348
• spring.profiles.group should have a 'spring-profile-name' hint provider #51284
• Remove reference to removed InfluxDB auto-configuration #51176
• Use JacksonJsonSerde in Kafka Streams documentation #51161
• Document alternatives to HttpMessageConverters #51129
• Fix stale type reference for OTLP logging transport metadata #51119
• Metadata for spring.test.mockmvc.htmlunit.url declares the wrong type #51115
• Caching documentation refers to AutoConfigureCache by its pre-4.0 package #51113
• Fix examples in Metadata Format documentation chapter #51102
• Improve discoverability of the AOT Cache How-to guides #51000
• Table of auto-configured HealthIndicators lists the wrong key for MongoHealthIndicator #50940
• Update OpenTelemetryResourceAttributes documentation #50874
• Fix @Value placeholder syntax in external config docs #50873
• Polish gRPC documentation #50863
• Fix duplicate word typos in documentation #50850
• Fix forwarded headers property in cloud deployment docs #50848
• Refer to spring-boot-starter-webmvc, not deprecated spring-boot-starter-web #50847
• Fix documentation inconsistencies #50800
• Add Spring gRPC properties to Common Application Properties referrence #50789
• Document OTLP SSL service connections #50782
• Update docs for changes to optional property binding and JPA repositories bootstrap mode #50759

• Upgrade to ActiveMQ 6.2.9 #51329
• Upgrade to Byte Buddy 1.18.11 #51003
• Upgrade to CycloneDX Maven Plugin 2.9.3 #51185
• Upgrade to DB2 JDBC 12.1.5.0 #51005
• Upgrade to Elasticsearch Client 9.4.5 #51368
• Upgrade to Groovy 5.0.8 #51186
• Upgrade to Grpc Java 1.81.1 #51263
• Upgrade to Grpc Java 1.83.1 #51361
• Upgrade to Hibernate 7.4.5.Final #51007
• Upgrade to Hibernate Validator 9.1.3.Final #51187
• Upgrade to HttpClient5 5.6.4 #51330
• Upgrade to HttpCore5 5.4.3 #51010
• Upgrade to Jackson 2 Bom 2.21.5 #51011
• Upgrade to Jackson Bom 3.1.5 #51012
• Upgrade to Jetty 12.1.12 #51302
• Upgrade to jOOQ 3.21.7 #51303
• Upgrade to JSpecify 1.0.1 #51189
• Upgrade to Log4j2 2.25.5 #51015
• Upgrade to Logback 1.5.38 #51016
• Upgrade to MariaDB 3.5.10 #51190
• Upgrade to Maven Help Plugin 3.5.2 #51018
• Upgrade to Maven Jar Plugin 3.5.1 #51191
• Upgrade to MongoDB 5.8.1 #51360
• Upgrade to Native Build Tools Plugin 1.1.4 #50947
• Upgrade to Native Build Tools Plugin 1.1.8 #51304
• Upgrade to Netty 4.2.17.Final #51305
• Upgrade to Oracle Database 23.26.3.0.0 #51193
• Upgrade to Pooled JMS 3.2.3 #51196
• Upgrade to Postgresql 42.7.13 #51022
• Upgrade to Protobuf Java 4.35.1 #51264
• Upgrade to Protobuf Maven Plugin 5.1.8 #51331
• Upgrade to Pulsar 4.2.4 #51306
• Upgrade to R2DBC MariaDB 1.4.1 #51024
• Upgrade to R2DBC MSSQL 1.0.5.RELEASE #51025
• Upgrade to R2DBC MySQL 1.4.3 #51194
• Upgrade to R2DBC Postgresql 1.1.2.RELEASE #51026
• Upgrade to SQLite JDBC 3.53.2.1 #51195
• Upgrade to Tomcat 11.0.24 #51027
• Upgrade to UnboundID LDAPSDK 7.0.5 #51028
• Upgrade to WebJars Locator Lite 1.1.4 #51029
• Upgrade to Yasson 3.0.5 #51307

Thank you to all the contributors who worked on this release:

@DragonFSKY, @LordKay-sudo, @MacAlsandair, @SJvaca30, @SebTardif, @SimonVerhoeven, @codingkiddo, @dhruv-15-03, @dlwldnjs1009, @dmitrysulman, @doehyunbaek, @filiphr, @msridhar, @ngocnhan-tran1996, @nosan, @ns3154, @quaff, @scordio, @seonwooj0810, @skdas20, @vipi-n, @vvzvvv, @wantaekchoi, @xfocus3, and @yamamoto-ehhMH

Full Changelog: https://github.com/Activiti/Activiti/compare/7.21.0-rc.531...7.21.0-rc.532

Full Changelog: https://github.com/Activiti/Activiti/compare/7.21.0-rc.530...7.21.0-rc.531

Full Changelog: https://github.com/Activiti/Activiti/compare/7.21.0-rc.529...7.21.0-rc.530

Full Changelog: https://github.com/Activiti/Activiti/compare/7.21.0-rc.528...7.21.0-rc.529

Full Changelog: https://github.com/Activiti/Activiti/compare/7.21.0-rc.527...7.21.0-rc.528

Full Changelog: https://github.com/Activiti/Activiti/compare/7.21.0-rc.526...7.21.0-rc.527

Full Changelog: https://github.com/Activiti/Activiti/compare/7.21.0-rc.525...7.21.0-rc.526