This commit raises the SnakeYAML baseline version to 2.0.
While most Spring applications are not affected by CVE-2022-1471,
upgrading this version should prevent automated tools from raising this
as a security issue. Such tools usually do not understand that YAML
parsing in Spring is about reading configuration, not parsing untrusted
content.
Closes gh-30048
Bean post processors that use InjectionMetadata checks if a property
value for the element it is about to inject is set and skip it, so
that the property value is used. Previously, the AOT contribution for
the same behavior did not check if a matching property value is set
and therefore override the user-defined value.
This commit introduces an additional method that filters the injected
element list so that only the elements that should be processed are
defined.
Closes gh-30476
This commit reviews BeanInstanceSupplier to reuse more code from
ConstructorResolver. Previously, the autowired argument resolution was
partially duplicated and this commit introduces a new common path via
RegisteredBean#resolveAutowiredArgument.
Closes gh-30401
This commit adds a workaround for oracle/graal#6529
triggered by b374824319.
When the GraalVM fix will have reached a wide enough
audience, it should be removed via gh-30394.
Closes gh-30407
This commit handles AutowiredCandidateQualifier instances, rather than
relying on qualifiers being statically defined and meta-annotated with
`@Qualifier`.
Closes gh-30410
After b374824319 related
to gh-29246, `"queryAllDeclaredMethods": true` is now added
on all registered beans.
This legit change triggers oracle/graal#6510. This
commit workarounds this GraalVM bug, and should be
removed once the GraalVM fix has reached a wide enough
audience.
Closes gh-30383
This commit makes AOT class names for bean definitions shorter.
Previously, the "__BeanDefinitions" suffix was applied for all
classes, but it was unnecessary for inner classes as the container
class already has the qualifier.
Closes gh-29846
This commit adds a note to an exception in `ConstructorResolver`'s
`autowireConstructor` method hinting that attention should be paid to
cases that mix indexed arguments and named arguments. This is especially
when inheriting bean definitions in xml.
Closes gh-29976
Close gh-PR
Prior to this commit, DisposableBeanAdapter attempted to invoke a
configured default-destroy-method on every bean, including beans that
do not declare the named destroy method, resulting in a
NullPointerException being thrown and logged at WARN level.
This commit addresses this by effectively ignoring any nonexistent
destroy method.
Closes gh-30301
This commit refactors some AssertJ assertions into more idiomatic and
readable ones. Using the dedicated assertion instead of a generic one
will produce more meaningful error messages.
For instance, consider collection size:
```
// expected: 5 but was: 2
assertThat(collection.size()).equals(5);
// Expected size: 5 but was: 2 in: [1, 2]
assertThat(collection).hasSize(5);
```
Closes gh-30104
After this commit, DisposableBeanAdapter can find destruction related methods
even when hints are just specified at interface level, which is typically the
case when a bean is exposed via one of its interfaces.
Closes gh-29545
Prior to this commit, reflection hints registered for beans was
selectively applied to only consider the methods that we'll actually
need reflection on at runtime. This would rely on an undocumented
behavior of GraalVM Native where calling `getDeclaredMethods` on a type
would only return known metadata at runtime, ignoring the ones that were
not registered during native compilation.
As of oracle/graal#5171, this behavior is now fixed in GraalVM and
aligns with the JVM behavior: all methods will be returned. This means
that if during native compilation, introspection was not registered for
the type a new `MissingReflectionMetadataException` will be raised.
As a follow up of #29205, this commit contributes the "introspection on
declared method" reflection hint for all registered beans.
Closes gh-29246
This commit picks up where the two previous commits left off.
Specifically, this commit:
- Removes the "severity=warning" configuration to ensure that violations
actually fail the build.
- Fixes regular expressions for suppressions by matching forward
slashes using `[\\/]` instead of `\/`.
- Moves the configuration for newly introduced checks to locations in
checkstyle.xml that align with the existing organization of that file.
- Renames the IDs for RegexpSinglelineJava checks from
javaDocPackageNonNullApiAnnotation/javaDocPackageNonNullFieldsAnnotation
to packageLevelNonNullApiAnnotation/packageLevelNonNullFieldsAnnotation,
respectively, since these checks are not related to Javadoc.
- Simplifies the null-safety annotation checks to match against
imported annotation types, which enforces consistency across
package-info.java files for the annotation declarations.
- Simplifies the RegEx for JavadocPackage suppressions to only exclude
packages not under src/main/java (vs src/main) and those in the
framework-docs module.
- Consistently suppresses all checks for the `asm`, `cglib`, `objenesis`,
and `javapoet` packages in spring-core.
- Adds explicit suppressions for null-safety annotations for the `lang`
package in spring-core.
- Adds explicit suppressions for null-safety annotations for the
`org.aopalliance` package in spring-aop.
- Revises the RegEx for null-safety annotation suppressions to only
exclude package-info.java files not under src/main/java and
additionally to exclude package-info.java files in the framework-docs
module as well as those in the spring-context-indexer,
spring-instrument, and spring-jcl modules.
- Adds all missing package-info.java files.
- Adds null-safety annotations to package-info.java files where
appropriate.
Closes gh-30069
