forked from proofpoint/platform
-
Notifications
You must be signed in to change notification settings - Fork 0
/
CHANGES
4605 lines (3057 loc) · 147 KB
/
CHANGES
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
Platform 2.47
* Maven
We now specify a version for the JaCoCo agent in the dependencyManagment section.
* Maven plugin upgrades
- build-helper-maven-plugin to 3.2.0 (was 3.1.0)
- maven-resources-plugin to 3.2.0 (was 3.1.0)
- maven-assembly-plugin to 3.3.0 (was 3.2.0)
- duplicate-finder-maven-plugin to 1.5.0 (was 1.4.0)
- spotbugs-maven-plugin to 4.2.2 (was 4.0.0)
- maven-site-plugin to 3.9.1 (was 3.9.0)
- docker-maven-plugin to 0.35.0 (was 0.33.0)
Platform 2.46
* Library Upgrades
- Jetty to 9.4.39 (was 9.4.38) (CVE-2021-28163, CVE-2021-28164, CVE-2021-28165)
- Base Docker image to c15-java11:2.24 (was 2.22)
Platform 2.44
* Library Upgrades
- slf4j to 1.7.30 (was 1.7.26)
- Joda-Time to 2.10.10 (was 2.10.1)
- Jackson to 2.12.2 (was 2.11.0)
- hibernate-validator to 6.0.21.Final (was 6.0.18.Final)
- assertj-core to 3.19.0 (was 3.12.2)
- assertj-guava to 3.4.0 (was 3.2.1)
- assertj-db to 2.0.2 (was 1.2.0)
- Objenesis to 3.1 (was 3.0.1)
- Mockito to 3.8.0 (was 2.28.2)
- Hamcrest to 2.2 (was 1.3)
- byte-buddy to 1.10.22 (was 1.9.13)
Platform 2.43
* Library Upgrades
- auto-value to 1.7.4 (was 1.6.5)
- Guava to 30.1 (was 30.0)
- Guice to 5.0.1 (was 4.2.3)
- Jetty to 9.4.38 (was 9.4.35)
- Base Docker image to c15-java11:2.22 (was 2.21)
Platform 2.42
* Deprecation removals
We have removed the empty OpenApiModule. Its functionality has long since
been incorporated into JaxrsModule and references to it should be deleted.
We removed the following deprecated APIs:
- Logging.logToFile(String, int, DataSize, DataSize)
- Logging.addShutdownHookToWaitFor(Thread)
- Logging.removeShutdownHookToWaitFor(Thread)
- RollingFileHander(String, int, DataSize, DataSize) constructor
- ShutdownWaitingLogManager.addWaitForShutdownHook(Thread)
- ShutdownWaitingLogManager.removeWaitForShutdownHook(Thread)
- log.max-size-in-bytes configuration option
* Library Upgrades
- Base Docker image to c15-java11:2.21 (was 2.17)
Platform 2.41
* HttpServer
We changed the format of the JSON request log to take less space and omit
less-used fields. The previous format may be selected by setting the
"http-server.log.format" config option to "JSON_VERBOSE".
Platform 2.40
* We fixed an issue in the JMX module when running on a version of Java with
a four-segment version number.
* We no longer replace a previous set of discovered instances when the
discovery service returns an empty set of instances.
* Library Upgrades
- Base Docker image to c15-java11:2.17 (was 2.13)
Platform 2.39
* Library Upgrades
- Jetty to 9.4.35 (was 9.4.33)
- Guava to 30.0 (was 29.0)
- Base Docker image to repocache.nonprod.ppops.net/dev-docker-local/c15-java11:2.13
Base image needs to have the "service" user and /service/var directory.
* Packaging
We now exclude test-scope jar files from distribution tar files and
Docker images.
Platform 2.38
* Library Upgrades
- Jetty to 9.4.33 (was 9.4.32) (fixes CVE-2020-27216)
- Base Docker image to proofpoint/platform-zulu-11:1.11
based on 11.0.9. Pull image through repocache docker-remote.
Platform 2.37
* HTTP Server
We now delay creating the listen sockets until the @AcceptRequests phase.
We reduced the default accept queue size to 10 from 128 in order to shed
load during connection storms.
* Library Upgrades
- Jetty to 9.4.32 (was 9.4.24)
- Base Docker image to proofpoint/platform-zulu-11:1.10
update libx11-6 and libx11-data to 2:1.6.7-1+deb10u1 for CVE-2020-14363
Platform 2.36
* Library Upgrades
- Base Docker image to proofpoint/platform-zulu-11:1.9
based on 11.0.8
Platform 2.35
* Library Upgrades
- Base Docker image to proofpoint/platform-zulu-11:1.8
update libsystemd0 to 241-7~deb10u4 for CVE-2020-1712
Platform 2.34
* Build
We now use the SONAR_HOST_URL instead of a .build-sonar file to enable
SonarQube reporting.
Platform 2.33
* Build
We now set the Sonar projectKey when Sonar is enabled.
Platform 2.32
* Library Upgrades
- Base Docker image to proofpoint/platform-zulu-11:1.7
updates libgnutls30 to 3.6.7-4+deb10u4 for CVE-2020-13777
Platform 2.30
* Library Upgrades
- Guava to 29.0-jre (was 28.2-jre)
- Jackson to 2.11.0 (was 2.10.0) (fixes deserialization vulnerabilities
when using @JsonTypeInfo or "default typing")
Platform 2.29
* Build
We now enable JaCoCo code coverage of (Maven) integration tests.
If the project has a .build-sonar file we now report code coverage to
SonarQube.
* Launcher
We moved the StartLimitIntervalSecs setting back from [Unit] to [Service] and
changed its name to StartLimitInterval.
Platform 2.28
* Library Upgrades
- Base Docker image to proofpoint/platform-zulu-11:1.6
based on azul/zulu-openjdk-debian:11.0.7-11.39.15
(was proofpoint/platform-zulu-11:1.5)
Platform 2.27
* Library Upgrades
- Guice to 4.2.3 (was 4.2.2)
* Maven plugin upgrades
- jacoco-maven-plugin to 0.8.5 (was 0.8.4)
- sonar-maven-plugin 3.7.0.1746 (previously unspecified)
- build-helper-maven-plugin to 3.1.0 (was 3.0.0)
- maven-assembly-plugin to 3.2.0 (was 3.1.1)
- maven-javadoc-plugin to 3.2.0 (was 3.1.0)
- maven-jar-plugin to 3.2.0 (was 3.1.0)
- maven-source-plugin to 3.2.1 (was 3.1.0)
- dependency-scope-maven-plugin to 0.10 (was 0.8)
- spotbugs-maven-plugin to 4.0.0 (was 3.1.12)
- maven-site-plugin to 3.9.0 (was 3.7.1)
- plexus-compiler-javac-errorprone to 2.8.6 (was 2.8.5)
- error_prone_core to 2.3.4 (was 2.3.3)
- maven-dependency-plugin to 3.1.2 (was 3.1.1)
- maven-invoker-plugin to 3.2.1 (was 3.2.0)
- maven-shade-plugin to 3.2.2 (was 3.2.1)
Platform 2.26
* Configuration
We added support for JSON-format configuration.
If the file "etc/config/config.json" exists, then it will be read instead
of the default "etc/config.properties" and "etc/secrets.properties".
Additionally, files matching the glob "etc/*/config.json" will be read.
In the read JSON, arrays and objects will be (recursively) flattened. Null
values will be ignored. For example, the JSON:
{
"array": [ "value", null, 6 ],
"object": { "a": "b", "c": false }
}
will be interpreted as:
array.1=value
array.3=6
object.a=b
object.c=false
* Logging
We added support for JSON-format configuration of log levels. If the file
"etc/config/log.json" exists, then it will be read instead of the default
"etc/log.properties".
* Launcher
We added support for JSON-format configuration of jvm arguments. If the file
"etc/config/jvm.json" exists, then it will be read instead of the default
"etc/jvm.properties" or "etc/jvm.config".
Platform 2.25
* HttpServer
We added 100.64.0.0/10 to the default set of networks trusted for following
the X-Forwarded-For: header.
* Docker
We removed support for Sealights under Docker.
* JAX-RS
We added a "testing.jaxrs.override-method-filter" config option (default "true")
which can be set to "false" to disable the OverrideMethodFilter (allows overriding
POST requests with PUT or DELETE via header or query param)
Platform 2.24
* Library Upgrades
- Base Docker image to proofpoint/platform-zulu-11:1.5
based on 11.0.6 (was proofpoint/platform-zulu-11:1.4)
* Maven plugin upgrades
- docker-maven-plugin to 0.33.0 (was 0.30.0)
Platform 2.23
* Launcher
We moved the StartLimitIntervalSecs setting from [Unit] to [Service] in
order to fix an error on newer versions of systemd.
Platform 2.22
* HttpServer
We fixed a regression in 2.19 when a Java keystore had multiple cert/key
pairs.
* Library Upgrades
- Guava to 28.2-jre (was 28.1-jre)
- hibernate-validator to 6.0.18.Final (was 6.0.16.Final)
* Maven plugin upgrades
- duplicate-finder-maven-plugin to 1.4.0 (was 1.3.0)
Platform 2.20
* HttpClient
We fixed a bug
bindDiscoveredHttpClient(String, Class<? extends Annotation>) that was
introduced in 2.19.
Platform 2.19
* HttpClient
We have deprecated @com.proofpoint.discovery.client.ServiceType in favor of
@com.proofpoint.http.client.ServiceType.
We created convenience HttpClientBinder methods
bindBalancingHttpClient(String, String, String...) and
bindKubernetesServiceHttpClient(String, String)
* Deprecation removals
We removed the following deprecated APIs:
- AnnotatedBindingBuilder constructor
- PrefixBindingBuilder constructor
- ConfigBindingBuilder constructor
- ConfigurationProvider
- HttpClientModule
- http.client.Request constructors
- RuntimeIOException
- JettyHttpClient.getIoPoolStats()
- JettyIoPoolConfig
- ClientInfoUtils.clientAddressFor()
- HttpServer constructors
- HttpServerProvider, TestingHttpServer, and TestingAdminHttpServer
constructors without a ClientAddressExtractor parameter
- RequestStats.record(String, int, long, long, Duration, Duration)
- TestingNodeModule constructors taking Guava Optional
- http-client.max-threads configuration option
- http-client.min-threads configuration option
- http-client.timeout-concurrency configuration option
- http-client.timeout-threads configuration option
* Library Upgrades
- Jetty to 9.4.24 (was 9.4.21)
Platform 2.18
* Library Upgrades
- Base Docker image to proofpoint/platform-zulu-11:1.4
based on 11.0.5 (was proofpoint/platform-zulu-11:1.3)
Platform 2.17
* Audit Logging
- The default value for "audit.log.path" has changed to "var/log/audit.log".
This config option is no longer overridden by the launcher. To disable
audit logging, for example when running in-IDE, use the new config option
"audit.log.enable".
Platform 2.16
* Library Upgrades
- Jackson to 2.10.0 (was 2.9.10) (fixes deserialization vulnerabilities
when using @JsonTypeInfo or "default typing")
Platform 2.14
* Reporting
We added a "reporting.pulse.include-host-tag" config option (default "true")
which can be set to "false" in order to omit the "host" tag from metrics
reported to Pulse.
* Library Upgrades
- Jetty to 9.4.21 (was 9.4.20) (various HTTP/2 denial-of-service fixes)
Platform 2.13
* Library Upgrades
- Jackson to 2.9.10 (was 2.9.9) (fixes deserialization vulnerabilities
when using @JsonTypeInfo or "default typing")
Platform 2.12
* HttpClient and HttpServer
We disabled TLS 1.1 and the ciphers TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_256_CBC_SHA, and
TLS_RSA_WITH_AES_128_CBC_SHA.
* JMX
- We fixed a bug preventing JMX from starting on Java 11.
- We log a hint about necessary JVM config when JMX fails to start on Java 11
- We skip starting the JMX agent on Java 11 if it is already configured.
* Library Upgrades
- Guava to 28.1-jre (was 28.0-jre)
Platform 2.11
* Logging
We added a "log.queue-size" configuration option. If nonzero, the main
launcher.log will use asynchronous logging with an in-memory queue
of the configured maximum size. The default is "0".
* Library Upgrades
- Jetty to 9.4.20 (was 9.4.18)
Platform 2.10
* Library Upgrades
- jackson-databind to 2.9.9.3 (was 2.9.9.2) (fix regression in Platform 2.09)
Platform 2.09
* Launcher
Arguments in jvm.properties that start with "-XX:+Unlock" now get moved
earlier than other arguments in jvm.properties.
* Library Upgrades
- jackson-databind to 2.9.9.2 (was 2.9.9.1) (CVE-2019-14379 CVE-2019-14439)
Platform 2.08
* Library Upgrades
- jackson-databind to 2.9.9.1 (was 2.9.9) (CVE-2019-12384 CVE-2019-12814)
- Base Docker image to proofpoint/platform-zulu-11:1.3
based on 11.0.4 (was proofpoint/platform-zulu-8:1.2)
Platform 2.07
* Docker
Docker images built now specify their user numerically instead of by name.
* OpenApi
We moved the OpenApi support into the jaxrs module. The openapi module no
longer does anything and is deprecated
* Maven plugin upgrades
- maven-compiler-plugin to 3.8.1 (was 3.8.0)
- maven-assembly-plugin to 3.1.1 (was 3.1.0)
- maven-surefire-plugin to 2.22.2 (was 2.22.1)
- maven-javadoc-plugin to 3.1.0 (was 3.0.1)
- maven-source-plugin to 3.1.0 (was 3.0.1)
- duplicate-finder-maven-plugin to 1.3.0 (was 1.2.1)
- spotbugs-maven-plugin to 3.1.12 (was 3.1.8)
- jacoco-maven-plugin to 0.8.4 (was 0.8.2)
- modernizer-maven-plugin to 1.8.0 (was 1.7.1)
- docker-maven-plugin to 0.30.0 (was 0.27.2)
- plexus-compiler-javac-errorprone to 2.8.5 (was 2.8.2)
- error_prone_core to 2.3.3 (was 2.0.21)
- maven-invoker-plugin to 3.2.0 (was 3.1.0)
- maven-shade-plugin to 3.2.1 (was 3.1.1)
Platform 2.06
* Bean Validation
We replaced Apache BVal with Hibernate Validator.
Unit tests which assertFailsValidation with a message of "may not be null"
will need to be changed to assert a message of "must not be null".
Any use of org.apache.bval.jsr.ApacheValidationProvider will need to be
replaced with org.hibernate.validator.HibernateValidator.
Any Maven dependency of:
<dependency>
<groupId>org.apache.bval</groupId>
<artifactId>bval-jsr</artifactId>
</dependency>
will need to be replaced with:
<dependency>
<groupId>org.hibernate.validator</groupId>
<artifactId>hibernate-validator</artifactId>
</dependency>
<dependency>
<groupId>org.glassfish</groupId>
<artifactId>jakarta.el</artifactId>
</dependency>
* Library Upgrades
- Guava to 28.0-jre (was 27.1-jre)
- AutoValue to 1.6.5 (was 1.6.2)
- Mockito to 2.28.2 (was 2.23.0)
- byte-buddy to 1.9.13 (was 1.9.4)
- assertj-core to 3.12.2 (was 3.11.1) (Iterable assertions require .toIterable() to access)
- assertj-guava to 3.2.1 (was 3.2.0)
Platform 2.05
* JAX-RS
We added the JaxrsModule.withOptionsEnabled() method to enable the default
support of the OPTIONS method.
* Library Upgrades
- Jetty 9.4.18 (was 9.4.17) fixes server becomes unresponsive after sitting
idle from a load spike.
- Jackson to 2.9.9 (was 2.9.8) (CVE-2019-12086)
Platform 2.04
* Library Upgrades
- Jetty to 9.4.17 (was 9.4.15) (CVE-2019-10241, -10246, -10247)
- Base Docker image to proofpoint/platform-zulu-8:1.2
based on 8u212 (was proofpoint/platform-zulu-8:1.1)
Platform 2.03
* TLS 1.3
We now support TLS 1.3 with TLS_AES_256_GCM_SHA384 and
TLS_AES_128_GCM_SHA256 ciphers when running on Java 11.0.3 or later.
* [Bug] Requests weren't logged when they threw exceptions before reading the
body.
Platform 2.02
* Library Upgrades
- Guava to 27.1-jre (was 27.0.1-jre)
- Base Docker image to proofpoint/platform-zulu-8:1.1
based on 8u202 (was proofpoint/platform-zulu-8:1.0)
Platform 2.01
* [Bug] Fixed deadlock during graceful shutdown.
* Library upgrades
- Base Docker image to proofpoint/platform-zulu-8:1.0
(was azul/zulu-openjdk-debian:8u192)
Uses "dumb-init" to better handle pid 1 responsibilites
Platform 2.00
* Launcher
[Bug] When running in a Docker container, pass termination signals to the
child server process.
* Library Upgrades
- Jetty to 9.4.15 (was 9.4.14)
- slf4j to 1.7.26 (was 1.7.25)
Platform 1.99
* JMX
We now configure the "java.rmi.server.hostname" property to "127.0.0.1"
when JMX is enabled. This permits enabling JMX inside containers.
* Docker
The Sealights integration now copies the necessary files relative to the
value of the "project.basedir" maven property, which defaults to ".". Maven
subprojects that need Sealights integration in their generated Docker image
will need to override that property in the subproject's pom.xml.
Platform 1.97
* JAX-RS
We added a filter to attach the Strict-Transport-Security header
to responses from all resources. We added configuration options
"jaxrs.hsts.max-age", "jaxrs.hsts.include-sub-domains", and
"jaxrs.hsts.preload" for configuring the contents of the header. The
filter is enabled by configuring a value for the max age.
Platform 1.96
* Deprecation removals
We removed the following deprecated APIs:
- ConfigRecord.createConfigRecord()
- ConfigurationValidator(ConfigurationFactory, WarningsMonitor) constructor
- HttpServiceBalancerFactory.createHttpServiceBalancer(String,
ServiceSelectorConfig, NodeInfo)
- JsonEventSerializer.serialize(Object, String, JsonGenerator)
- HttpServiceBalancerImpl(String, HttpServiceBalancerStats)
- JsonMapperParsingException constructor
* We configured duplicate-finder-maven-plugin to ignore module-info classes
that are in subdirectories.
* Library upgrades
- Jackson to 2.9.8 (was 2.9.7) (fixes deserialization vulnerabilities
CVE-2018-19360, -19361, and -19362 when using @JsonTypeInfo or
"default typing". Fixes performance issue with malicious BigDecimal input
CVE-2018-1000873.)
Platform 1.95
* HttpClient
We renamed the HttpClient.IoPool.CONFIGPREFIX.FreeThreadCount metric to
HttpClient.QUALIFIER.IoPool.FreeThreadCount. This was done in order to fix
startup failures introduced in Platform 1.93 caused by a duplicate metric
name when using a library that had two HttpClients bound with the same config
prefix but different qualifiers (and filters).
We also fixed a bug where non-balanced HttpClients did not report request
metrics.
* Maven plugin upgrades
- modernizer-maven-plugin to 1.7.1 (was 1.7.0)
Platform 1.94
* HttpServer
We disabled support for SSL 2.0 compatible hello packets.
We now log the TLS protocol version and cipher suite in the JSON
http-request log. We also added a HttpServer.TlsRequest.Count metric broken
down by protocolVersion and cipherSuite.
* JSON
The @JsonProperty annotation is no longer necessary on parameters to
@JsonCreator constructors and methods. If absent the parameter name will
be used instead.
[Bug] We fixed serialization to omit null map values. This had regressed in
Platform 1.73.
* Maven
We enabled the RequireUpperBoundDeps rule in maven-enforcer-plugin.
* Library upgrades
- Guava to 27.0.1-jre (was 26.0-jre)
- validation-api to 2.0.1 (was 1.1.0)
- bval-jsr to 2.0.0 (was 1.1.2)
- byte-buddy to 1.9.4 (was 1.8.15)
Platform 1.93
* HttpClient
We removed support for the shared IO pool. Now each HttpClient has a private
IO pool. The .withPrivateIOThreadPool() method of the HttpClient binding DSL
is deprecated and no longer necessary. The configuration properties for the
shared IO pool are likewise deprecated and no longer used.
We added a Request.Builder.addHeaders() method for adding multiple request
headers.
We added a Request.Builder.setPreserveAuthorizationOnRedirect() method for
preserving the Authorization header when following redirects. By default
it is not preserved.
We now preserve the User-Agent header when following redirects.
We deprecated the Request constructors. Instead use a Request.Builder.
* HttpServer
We added the "http-server.log.queue-size" configuration property to allow
configuring the size of the in-memory buffer for http-request.log. It
now defaults to 10,000 records.
We added the "http-server.https.ssl-session-cache-size" and
"http-server.https.ssl-session-timeout" configuration properties to allow
configuring the TLS session cache.
We added "protocolVersion", "timeToDispatch", "timeToRequestEnd",
"timeResponseContent", "responseContentChunk", and "timeToLastByte"
metrics to the JSON-format http-request.log. The "responseContentChunk"
field is a map with two members: "count" and "max".
* Maven
We enabled compiled metadata for reflection on method parameters.
We configured maven-enforcer-plugin to prohibit duplicate dependencies
in POMs.
* Discovery
We decreased the timeout for the initial discovery service query from 30
seconds to 1 second.
* Library upgrades
- Jetty to 9.4.14 (was 9.4.12)
- Guice to 4.2.2 (was 4.2.1)
- Joda-time to 2.10.1 (was 2.9.9)
- objenesis to 3.0.1 (was 2.6)
- cglib to 3.2.8 (was 3.1)
- javax.annotation-api to 1.3.1 (was 1.2)
- spotbugs-annotations to 3.1.8 (was 3.1.6)
* Maven plugin upgrades
- modernizer-maven-plugin to 1.7.0 (was 1.6.0)
- maven-surefire-plugin to 2.22.1 (was 2.22.0)
- spotbugs-maven-plugin to 3.1.8 (was 3.1.7)
- docker-maven-plugin to 0.27.2 (was 0.26.1)
Platform 1.92
* Library upgrades
- Base Docker image changed to azul/zulu-openjdk-debian:8u192
(was azul/zulu-openjdk-debian:8u181)
Platform 1.91
* [Bug] Report collections didn't implement equals()/hashCode()/toString()
Platform 1.90
* Reporting
We added a "ReportCollector.LogErrors.Count" metric counting the number
of log lines at error level.
* HttpClient
The HTTP client also supports HTTP/2 under TLS when running on Java 11.
If HTTP/2 is enabled, however, the client will always use the HTTP/2
protocol and thus can only communicate with HTTP/2 servers. Attempting to
connect to an older server will result in "refused_stream_error".
Thus, HTTP/2 is disabled by default.
* Library upgrades
- Base Docker image changed to azul/zulu-openjdk-debian:8u181
(was openjdk:8u181-jdk)
- Guice to 4.2.1 (was 4.2.0)
- Jackson to 2.9.7 (was 2.9.6) (fixes deserialization vulnerabilities
CVE-2018-14718 and -14721 when using @JsonTypeInfo or "default typing")
- auto-value to 1.6.2 (was 1.5)
All Maven dependency sections that used to refer to
<artifactId>auto-value</artifactId> must now be replaced with:
<dependency>
<groupId>com.google.auto.value</groupId>
<artifactId>auto-value-annotations</artifactId>
<optional>true</optional>
</dependency>
- AssertJ-core to 3.11.1 (was 3.5.2)
- AssertJ-Guava to 3.2.0 (was 3.1.0)
- AssertJ-Joda-time to 2.2.0 (was 2.0.0)
- AssertJ-DB to 1.2.0 (was 1.1.1)
- Mockito to 2.23.0 (was 2.21.0)
Platform 1.89
* Reporting
ReportingPrometheusModule() no longer reports metrics using the Prometheus
"counter" or "summary" types. All metrics are now reported as the Prometheus
"gauge" type using names and values as close as possible to the way they
are reported to KairosDB. This means that counts are reported as one-minute
buckets, not total since startup.
We added the ReportCollector_ServerStart metric to those reported by
ReportingPrometheusModule().
* HTTP/2
We now enable HTTP/2 under TLS in the server when running under Java 11.
* Trace tokens
Trace token properties with keys starting with "_" are now no longer
serialized to or deserialized from JSON. This permits setting properties
which will be included in logs but not propagated to dependent services.
* Launcher
Unless overridden in jvm.config or jvm.properties, the launcher will now set
the -XX:+ExitOnOutOfMemoryError option instead of
-XX:OnOutOfMemoryError="kill -9 %p"
This means the minimum supported Java version has increased to 8u92.
Platform 1.88
* We now support Java 11.
* HttpClient
The HTTP client also supports HTTP/2 cleartext. However, there is
no upgrade mechanism, so if HTTP/2 is enabled, the client will always
use the HTTP/2 protocol and thus can only communicate with HTTP/2
servers. Attempting to connect to an older server will result in
"refused_stream_error". Thus, HTTP/2 is disabled by default.
* Library upgrades
- Jetty to 9.4.12 (was 9.3.24)
- jaxb-api to 2.3.0 (was 2.2.6)
* Maven plugin upgrades
- spotbugs-maven-plugin to 3.1.7 (was 3.1.6)
Platform 1.87
* Maven
We replaced FindBugs with SpotBugs. SpotBugs may be disabled through the
platform.check.skip-spotbugs Maven property. Failing the build on SpotBugs
errors may be enabled with the platform.check.fail-spotbugs property.
This required an incompatible change. Previously the dependency
com.google.code.findbugs:jsr305 was banned, with projects requiring the JSR
305 annotations depending on com.google.code.findbugs:findbugs-annotations.
Now the findbugs-annotations dependency is banned and projects requiring the
JSR 305 annotations must have the dependency:
<dependency>
<groupId>com.google.code.findbugs</groupId>
<artifactId>jsr305</artifactId>
<optional>true</optional>
</dependency>
Projects requiring the FindBugs annotations must have the dependency:
<dependency>
<groupId>com.github.spotbugs</groupId>
<artifactId>spotbugs-annotations</artifactId>
<optional>true</optional>
</dependency>
* In-IDE testing
We created a new configuration option for simplifying discovery when running
servers in-IDE. If the configuration option "testing.discovery.static" is
se to "true", then service discovery will be performed statically through
configuration rather than querying the discovery service.
Like the StaticDiscoveryModule(), this mode will use a comma-separated list
of URIs from the "service-balancer.SERVICETYPE.uri" config option. This mode
will also swallow Discovery announcements.
This mode is not appropriate for production use. Instead use
StaticDiscoveryModule() if a production service needs to run without a
discovery service.
* HttpClient
We removed support for setting the configuration property
"http-client.max-requests-queued-per-destination" to "0".
* [Bug] JSON-format http-request.log time field would omit microseconds when
they were ".000".
Platform 1.86
* Configuration
We created ConfigBinder.bindConfig() with a slightly different interface
than ConfigurationModule.bindConfig(). It looks like:
bindConfig(binder).bind(FooConfig.class)
.annotatedWith(Qualifer.class)
.prefixedWith("prefix");
We deprecated ConfigurationModule.bindConfig(). To migrate, use IDEA
"Find/Replace Structurally..." with the following patterns:
com.proofpoint.configuration.ConfigurationModule.bindConfig($b$).to($c$)
com.proofpoint.configuration.ConfigBinder.bindConfig($b$).bind($c$)
com.proofpoint.configuration.ConfigurationModule.bindConfig($b$).annotatedWith($a$).to($c$)
com.proofpoint.configuration.ConfigBinder.bindConfig($b$).bind($c$).annotatedWith($a$)
com.proofpoint.configuration.ConfigurationModule.bindConfig($b$).prefixedWith($p$).to($c$)
com.proofpoint.configuration.ConfigBinder.bindConfig($b$).bind($c$).prefixedWith($p$)
com.proofpoint.configuration.ConfigurationModule.bindConfig($b$).annotatedWith($a$).prefixedWith($p$).to($c$)
com.proofpoint.configuration.ConfigBinder.bindConfig($b$).bind($c$).annotatedWith($a$).prefixedWith($p$)
Then in each modified file optimize imports, statically import bindConfig(),
and optimize imports again.
We also deprecated the constructors in the ConfigurationModule.bindConfig()
EDSL as they should not have been public.
* HttpClient and Discovery
The HttpServiceBalancer used by the BalancingHttpClient now accepts multiple
copies of the same destination URI, weighting it appropriately when
balancing requests.
We increased the defaults for http-client.max-connections-per-server
and http-client.max-requests-queued-per-destination from 20 to 100.
The Discovery client now interprets a "weight" property in an service
descriptor as the number of copies of the destination URI to add to
the HttpServiceBalancer.
* We now log the admin URI to the bootstrap log.
* We added a dependencyManagement section for guava-testlib to the library pom.
* [Bug] Specify permissions for SL_TOKEN_FILE
* Library Upgrades
- Guava to 26.0-jre (was 25.0-jre)
Removed several deprecated Futures methods which implicitly used
directExecutor(). Code must explicitly pass directExecutor().
- Jersey to 2.27 (was 2.25.1)
Injected context objects, returned from a supplier bound with
JaxrsBinder.bindInjectionProvider(), will no longer have @PostConstruct
methods called.
* Maven plugin upgrades
- build-helper-maven-plugin to 3.0.0 (was 1.10)
- docker-maven-plugin to 0.26.1 (was 0.24.0)
- duplicate-finder-maven-plugin to 1.3.0 (was 1.2.1)
- jacoco-maven-plugin to 0.8.2 (was 0.8.1)
- maven-assembly-plugin to 3.1.0 (was 2.6)
- maven-clean-plugin to 3.1.0 (was 3.0.0)
- maven-dependency-plugin to 3.1.1 (was 2.10)
- maven-invoker-plugin to 3.1.0 (was 2.0.0)
- maven-resources-plugin to 3.1.0 (was 2.7)
- maven-shade-plugin to 3.1.1 (was 2.4.3)
- maven-site-plugin to 3.7.1 (was 3.5.1)
- maven-source-plugin to 3.0.1 (was 3.0.0)
- modernizer-maven-plugin to 1.6.0 (was 1.5.0)
- rpm-maven-plugin to 2.2.0 (was 2.1.5)
Platform 1.85
* We added support for Sealights under Docker
If the project has a .build-docker file and the SL_TOKEN_FILE environment
variable is set, then sl-test-listener.jar, buildSessionId.txt, and the
token file that is the value of that environment variable are placed in
the created Docker container.
* We added the "errorprone-compiler" Maven profile for compiling with the
"Error Prone" compiler.
* We added dependency-scope-maven-plugin as a basic check. It may be disabled
by setting the platform.check.skip-dependency-scope Maven property to true.
Build failures may be turned into warnings by setting the
platform.check.fail-dependency-scope Maven property to false.
* We configured the Maven duplicate finder to ignore Java 9 module-info.class
files.
* We refactored the tests for the sample and skeleton servers to use AssertJ.
* We deprecated several methods in FileUtils.
* We deprecated HttpClientModule. This is an internal class.
* Library Upgrades
- javax.ws.rs-api to 2.1 (was 2.0.1)
- slf4j to 1.7.25 (was 1.7.16)
* Maven plugin upgrades
- maven-enforcer-plugin to 3.0.0-M1 (was 1.4.1)
- maven-javadoc-plugin to 3.0.1 (was 2.9)
- maven-surefire-plugin to 2.22.0 (was 2.19.1)
Platform 1.84
* The "/admin/stop-announcing" resource on the admin port now accepts the
"server.admin" role in the SecurityContext for authorization.
* JSON