Java Buildpack v4.49
I'm pleased to announce the release of the java-buildpack, version 4.49. This is primarily a house-cleaning release.
- In preparation for cflinuxfs4, the buildpack has been made compliant with Ruby 3.0 & it is now being tested every release against Ruby 3.0
- The ProtectApp framework was removed. This is because the upstream vendor's download site has gone offline and we no longer have the means to distribute it. For the same reason, the download location for Luna has changed from the vendor to the default repository.
- Resolve #935 by permitting raw type values in Elastic APM config (#946)
- Add deprecation warnings around SAR/SCC. See more about this below.
- Facilitate migrations to
java-cfenvby disabling SAR/SCC automatically ifjava-cfenvis included with the application.
For a more detailed look at the changes in 4.49, please take a look at the commit log. The packaged version of the buildpack, suitable for use with create-buildpack and update-buildpack, can be found attached to this release.
Deprecation of Spring Cloud Connectors & Spring Auto Reconfiguration
The buildpack will now inspect your applications and WARN if you are using Spring Cloud Connectors (deprecated since 2019, set to be archived after Dec 2022) and Spring Auto Reconfiguration (now deprecated with this release). In addition, the buildpack will automatically disable SAR/SCC when you have java-cfenv present in your application. This make migration easier as the two should not be used together, and it also prevents spurious warnings since the presence of this library means you are in the process of or have already moved to java-cfenv.
From now on, everyone should use java-cfenv for parsing service bindings and auto-configuring services. The CloudFoundry documentation has been updated with usage instructions as well as a migration guide.
Please be extra cautious when migrating as java-cfenv does not enable the cloud profile automatically. When you add this dependency, the buildpack will disable SAR/SCC which also disables the profile. As is documented in the migration guide, you need to manually enable this profile if it's required by your application.
The buildpack will continue to WARN users through the end of Aug 2022. After that time, the default behavior will change and the buildpack will not include Spring Auto Reconfiguration unless it's specifically requested. The buildpack will remove all support for Spring Auto Reconfiguration after Dec 2022.
You may post feedback/comments to this issue.
Packaged Dependencies
| Dependency | Version | CVEs | Release Notes |
|---|---|---|---|
| AppDynamics Agent | 22.5.0_33845 |
Release Notes | |
| Azure Application Insights Agent | 2.6.2 |
Release Notes | |
| CA Introscope APM Framework | 22.3.0_26 |
||
| Client Certificate Mapper | 1.11.0_RELEASE |
Included inline above | Included inline above |
| Container Security Provider | 1.19.0_RELEASE |
Included inline above | Included inline above |
| Contrast Security Agent | 3.15.0_27227 |
Release Notes | |
| Datadog APM Javaagent | 0.101.0 |
Release Notes | |
| Elastic APM Agent | 1.31.0 |
Release Notes | |
| Gemalto Luna Security Provider | 7.4.0 |
Release Notes | |
| Geode Tomcat Session Store | 1.12.5 |
||
| Google Stackdriver Debugger | 2.29.0 |
Release Notes | |
| Google Stackdriver Profiler | 0.1.0 |
Release Notes | |
| Groovy | 2.5.16 |
Release Notes | |
| JaCoCo Agent | 0.8.8 |
Release Notes | |
| Java Memory Assistant Agent | 0.5.0 |
||
| Java Memory Assistant Clean Up | 0.1.0 |
||
| JProfiler Profiler | 12.0.4 |
ChangeLog | |
| JRebel Agent | 2022.2.1 |
ChangeLog | |
| jvmkill Agent | 1.16.0_RELEASE |
Included inline above | Included inline above |
| MariaDB JDBC Driver | 2.7.2 |
Release Notes | |
| Memory Calculator | 3.13.0_RELEASE |
Included inline above | Included inline above |
| Metric Writer | 3.5.0_RELEASE |
Included inline above | Included inline above |
| New Relic Agent | 7.7.0 |
Release Notes | |
| OpenJDK JRE | 1.8.0_332 |
Risk Matrix | Release Notes |
| OpenJDK JRE 11 | 11.0.15_10 |
Risk Matrix | Release Notes |
| OpenJDK JRE 17 | 17.0.3_7 |
Risk Matrix | Release Notes |
| PostgreSQL JDBC Driver | 42.3.6 |
ChangeLog | |
| Redis Session Store | 1.3.6_RELEASE |
Included inline above | Included inline above |
| Riverbed Appinternals Agent | 11.8.5_BL527 |
||
| SeaLights Agent | 3.1.2093 |
||
| SkyWalking | 8.9.0 |
ChangeLog | |
| Spring Auto-reconfiguration | 2.12.0_RELEASE |
Included inline above | Included inline above |
| Spring Boot CLI | 2.7.0 |
||
| Spring Boot Container Customizer | 2.6.0_RELEASE |
Included inline above | Included inline above |
| Tomcat | 9.0.63 |
Security | ChangeLog |
| Tomcat Access Logging Support | 3.3.0_RELEASE |
Included inline above | Included inline above |
| Tomcat Lifecycle Support | 3.3.0_RELEASE |
Included inline above | Included inline above |
| Tomcat Logging Support | 3.3.0_RELEASE |
Included inline above | Included inline above |
| YourKit Profiler | 2022.3.100 |
Release Notes |
Dependency Notes
- ProtectApp has been removed. See the note above.
- Takipi Agent is not included with this release because, at the time of release, the download site was unavailable. We are working with the vendor to remedy this & will enable support once the site is back up.