Agenda for v114

[tesshucom]

Overview

The theme of the next version is a major version update of Spring Boot. Behind this, there will be a servlet version bump. And it will be accompanied by a major version update of App Server (Tomcat, Jetty). Along with these changes, various libraries will also need to be updated accordingly. As a result, the core libraries will be extensively modernized.

Details

Spring-migration was carried out in advance. However, this causes some functional limitations in development branch.

• Bump spring-boot 2.7.18 to 3.2.1 #2531

If anything, its essence is an Upgrade of the Servlet version. That will inevitably determine the Tomcat and Jetty versions. And, some technologies will also need to follow the servlet version.

The pull request above is a very basic first step. Issues that should be handled individually are not included in the above pull requests. Currently in the development branch, the following new issues will occur:

• Not works, so should be rewritten
• Works, but should be rewritten
• Works, but rewriting is preferable

TODO

If anything, it is better to merge the major version of Spring into the master as soon as possible. Therefore, priority should be given to addressing areas that may compromise existing functionality.

Issues to be resolved by release of v114.0.0

It might be better to do an advance release to collect feedback. There are several reasons.

• There are no differences in data specifications between v113 and v114. So, if you're using Docker, switching between trial version and 113 is easy.
• Basically it is expected to work. However, since the scope is too large, there may be some oversights. For example, some kind of warning is now displayed even though you are using it in the same way. (This is common on Jetty)
• I want to merge it into master anyway. Applying hotfixes to master and development has always been done, so it's not a big issue. However, a large difference in pom.xml occurs during Spring Boot 3.2 migration. Hotfixes cannot be automatically applied to the develop branch.
• In v114, the CVE suppression file is completely empty. All published CVE issues are fully resolved. I want to move to this state as soon as possible. Because it's easy for me. CVE checks are performed on the Master branch. Therefore, we should continue to receive library update notifications ( ... It's for old product configurations) until we merge your migrations.

When dividing, do as follows. In other words, from essential and frequently used functions by users :

• ALPHA1 : Migrate UPnP service
  • UPnP migration verification #2534
  • Migrate cling to jupnp #2541
  • Error Page operation check
    • Whitelabel is not allowed... Hmm, it seems to be working properly.
• ALPHA2 : ReentrantLock instead of synchronized
  • Virtual Threads
  • Unlike legacy servers, all synchronized methods have been replaced with Object locks for block. Consider replacing with ReentrantLock as the next step. However, performance may decrease, so please consider the contention rate.
    • If it is clear from the system as a whole which locks conflict with each other and which locks do not, it may be okay to use them differently.
    • Or, It may be better to completely unify to ReentrantLock.
    • If it can be replaced by a simple atomic class, do so.
  • This is another advantage of upgrading to Spring Boot 3.2. Required for virtual threading.
• BETA1 : Migrate to fileupload2
  • All functions that use Upload are subject to re-verification. The progress monitoring interface needs to be reimplemented to match the new spec.
• BETA2 : Replacement of AuthenticationFilter
  • It will work as is, but the circular reference will not be resolved.

Tasks that can be postponed

Some issues may not become a major issue if they are addressed through feature releases or hotfixes rather than major releases.

• DWR related implementation
  • Remove DWR? #2583
• JWT related implementation
  • JWT related redesign #2582
• Spring Theme related
  • Delete Spring theme #2581
• Password related
  • Storing passwords in plain text is deprecated. (Although I think it's a somewhat distorted that stronger password strength improve security.)
  • Add option to change password precision #1826