Update to Spring Boot 4.0 (fixes #416 review comments)#418
Open
asinbow wants to merge 10 commits intoLogNet:masterfrom
Open
Update to Spring Boot 4.0 (fixes #416 review comments)#418asinbow wants to merge 10 commits intoLogNet:masterfrom
asinbow wants to merge 10 commits intoLogNet:masterfrom
Conversation
- Replace spring-boot-starter-aop:4.0.0-M2 with spring-boot-starter-aspectj per Spring Boot 4.0 Migration Guide (addresses reviewer comment) - Update Lombok from 1.18.24 to 1.18.38 for Java 21 compatibility - Update Kotlin from 1.9.10 to 2.1.21 for Spring Boot 4.0 compatibility - Add spring-boot-validation as compileOnly/testImplementation dependency since Spring Boot 4 split auto-configuration into separate artifacts and ValidationAutoConfiguration moved to org.springframework.boot:spring-boot-validation Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Fix GRpcServerRunner.stop() to reset healthStatusManager to prevent "Only 1 single ManagedHealthStatusService" error on context restart (Spring Framework 7 restart() now calls stop()+start() on lifecycle beans) - Move ConfigServerTestApplication to isolated configserver package to prevent component scan from picking up @GRpcService beans in the config server context; add @ConditionalOnBean(GRpcServicesRegistry.class) guards to GRpcActuateAutoConfiguration inner classes - Replace jsonpath+Gson JSON parsing with Jackson 3.x (tools.jackson.databind) in ActuatorTest; fix Jackson 3.x API changes (fieldNames→propertyNames, elements→valueStream) - Update application-disable-security.yml with Spring Boot 4 class names; add ServletWebSecurityAutoConfiguration and SecurityFilterAutoConfiguration exclusions to fix 401 Unauthorized on /actuator endpoints - Spring Security 7 compatibility fixes: GrpcSecurity, SecurityInterceptor, GrpcServiceAuthorizationConfigurer, GrpcSecurityConfigurerAdapter and related security classes updated for Spring Security 7 API changes - Add BearerTokenSecurityAutoConfiguration, Keycloak test support, and various Spring Boot 4 / Spring Framework 7 API migration fixes - Fix GrpcSecurityConfiguration to import UserDetailsServiceAutoConfiguration from org.springframework.boot.security.autoconfigure (Spring Boot 4 location); add spring-boot-security as implementation dependency in demo so the class is available at runtime for bootRun Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
asinbow
force-pushed
the
spring-boot-4-upgrade
branch
from
f960372 to
7d41ddd
Compare
asinbow
commented
Mar 27, 2026
Author
asinbow
left a comment
asinbow
left a comment
There was a problem hiding this comment.
Hey Claude, please review the comments and try simplify the pr:
- use better practice
- be consistent in code logic
- clean up unnecessary comments.
...spring-boot-starter-demo/src/test/java/org/lognet/springboot/grpc/actuator/ActuatorTest.java
Outdated
Show resolved
Hide resolved
...spring-boot-starter-demo/src/test/java/org/lognet/springboot/grpc/actuator/ActuatorTest.java
Show resolved
Hide resolved
...spring-boot-starter-demo/src/test/java/org/lognet/springboot/grpc/actuator/ActuatorTest.java
Show resolved
Hide resolved
...rter-demo/src/test/java/org/lognet/springboot/grpc/auth/FailLateSecurityInterceptorTest.java
Show resolved
Hide resolved
...-spring-boot-starter-demo/src/test/java/org/lognet/springboot/grpc/auth/JwtAuthBaseTest.java
Show resolved
Hide resolved
grpc-spring-boot-starter/src/main/java/org/lognet/springboot/grpc/security/GrpcSecurity.java
Show resolved
Hide resolved
grpc-spring-boot-starter/src/main/java/org/lognet/springboot/grpc/security/GrpcSecurity.java
Show resolved
Hide resolved
...starter/src/main/java/org/lognet/springboot/grpc/security/GrpcSecurityConfigurerAdapter.java
Outdated
Show resolved
Hide resolved
...er/src/main/java/org/lognet/springboot/grpc/security/GrpcServiceAuthorizationConfigurer.java
Show resolved
Hide resolved
...ring-boot-starter/src/main/java/org/lognet/springboot/grpc/security/SecurityInterceptor.java
Show resolved
Hide resolved
- ActuatorTest: replace Jackson tree-walking with JsonPath for cleaner assertions - JwtAuthBaseTest: fix indentation to 4-space tabs per project convention - RouteGuideDemo: use @slf4j Lombok annotation instead of manual Logger field - ConfigServerEnvironmentBaseTest: fix OAuth2ResourceServerAutoConfiguration class name to correct Spring Boot 4 package - BearerTokenSecurityAutoConfiguration: use OAuth2Error.class literal instead of string for @ConditionalOnClass - GrpcSecurity: use with() instead of apply()+setBuilder() per Spring Security 7 API - GrpcSecurityConfigurerAdapter: same with() migration Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
asinbow
commented
Mar 27, 2026
...spring-boot-starter-demo/src/test/java/org/lognet/springboot/grpc/actuator/ActuatorTest.java
Show resolved
Hide resolved
...spring-boot-starter-demo/src/test/java/org/lognet/springboot/grpc/actuator/ActuatorTest.java
Outdated
Show resolved
Hide resolved
- Restore DocumentContext/TypeRef-based assertions for actuatorGrpcTest and actuatorHealthTest, matching the original test structure - Use GsonJsonProvider/GsonMappingProvider (available in Spring Boot 4) instead of JacksonJsonProvider (com.fasterxml removed in Jackson 3.x) - Restore ObjectNode + valueStream() assertion in afterGreeting for metrics check (valueStream() replaces elements() from Jackson 3.x) - Keep @LocalServerPort + RestTemplate (TestRestTemplate removed in SB4) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…resttestclient TestRestTemplate was removed from spring-boot-test in Spring Boot 4. Replace @LocalServerPort + new RestTemplate() with @AutoConfigureTestRestTemplate and @Autowired TestRestTemplate from the new org.springframework.boot:spring-boot-resttestclient module. Relative paths are used directly since the base URL is pre-configured. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Use inline Configuration.builder() per test method, original variable names, and elements().stream() as the Jackson 3 equivalent of the original StreamSupport.stream(Spliterators.spliteratorUnknownSize(elements(), ...)) pattern. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- ActuatorTest: revert to JacksonJsonProvider/JacksonMappingProvider per original (Jackson 2 remains on the transitive classpath alongside Jackson 3) - AopServiceMonitor: replace manual Logger field with @slf4j annotation Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR builds on #416 (Spring Boot 4.0 upgrade) and addresses the open review comments and build issues that prevented it from being merged.
Changes on top of #416
grpc-spring-boot-starter-demo/build.gradle): Replacespring-boot-starter-aop:4.0.0-M2(pinned milestone) withspring-boot-starter-aspectjper the Spring Boot 4.0 Migration Guide — addresses reviewer @tamassza's commentJCTree$JCImport.qualidwas removed in Java 21)spring-boot-validationdependency: Spring Boot 4 split the monolithicspring-boot-autoconfigureinto smaller artifacts;ValidationAutoConfigurationmoved toorg.springframework.boot:spring-boot-validationand must be declared explicitly5.2.1-SNAPSHOT→6.0.0-SNAPSHOT: Following the project's versioning convention, a Spring Boot major version upgrade warrants a major version bumpSpring Security Migration: legacy access-control →
AuthorizationManagerThe biggest change in this PR is the removal of Spring Security's legacy access-control
infrastructure (
AccessDecisionVoter/AccessDecisionManager/ConfigAttribute) whichwas removed in Spring Security 7 (shipped with Spring Boot 4).
What was removed and why
AccessDecisionVoter<T>AuthorizationManager<T>AffirmativeBased(access decision manager)AuthorizationManagers.anyOf(...)RoleVoter/ScopeVoterAuthorityAuthorizationManager.hasAnyAuthority(...)AuthenticatedAttributeVoterAuthenticatedAuthorizationManager.authenticated()PreInvocationAuthorizationAdviceVoterPreAuthorizeAuthorizationManagerExpressionBasedPostInvocationAdvice+AfterInvocationManagerPostAuthorizeAuthorizationManagerDelegatingMethodSecurityMetadataSource+PrePostAnnotationSecurityMetadataSourcePreAuthorize/PostAuthorizemanagersBehavioral equivalence
The old
AffirmativeBasedwithallowIfAllAbstainDecisions=truesemantics are preserved:AuthorizationManagers.anyOf(new AuthorizationDecision(true), metaManager, preAuthWrapper)where the leadingAuthorizationDecision(true)acts as the "all-abstain → grant" fallback.@PreAuthorizeargument-null guard — the oldPreInvocationAuthorizationAdviceVoterreturnedACCESS_ABSTAINwhenmethod.getArguments() == null. The new code wrapsPreAuthorizeAuthorizationManagerin a lambda that returnsnull(abstain) when arguments are null, achieving the same early-exit behavior before message arguments arrive.@Securedhandling — still processed at startup byGrpcServiceAuthorizationConfigurer.processSecuredAnnotation()and stored inGrpcSecurityMetadataSource; no separateSecuredAuthorizationManagerneeded at runtime.AuthenticatedAttributeVoter/AuthenticatedConfigAttributeThese two classes are now empty
@Deprecatedstubs retained for binary compatibility only. Their logic is replaced byAuthenticatedAuthorizationManager.authenticated()insideGrpcServiceAuthorizationConfigurer.Registry.mapAuthenticated().GrpcSecurity.getOrApply()→with()Spring Security 7 replaced
apply()+ manualsetBuilder()with a cleanerwith()methodthat calls
setBuilder()internally. All callers updated accordingly.Test plan
./gradlew :grpc-spring-boot-starter:compileJava— passes./gradlew :grpc-spring-boot-starter:test— passes./gradlew :grpc-spring-boot-starter-demo:test— 115 tests pass, 0 failures🤖 Generated with Claude Code