IM 7.2.0 → 7.3.0 — Library Upgrade Details (Java, Spring Cloud, Jackson, etc.)

Library Upgrade Details — Java, Spring Cloud, Jackson, BouncyCastle, HttpClient, Commons, Version Matrix

Parent doc: upgrade-migration-guide-to-im-7-3-0.md
Confluence mirror: IM 7.2 → 7.3.0 — Library Upgrade Details — Java, Spring Cloud, Jackson, BouncyCastle, HttpClient, Commons, Version Matrix

1. Version Change Summary

2. Removed Dependencies

4. Java 17 → 21

Impact: HIGH | Type: Runtime, Build

Breaking Changes & New Behavior

• Virtual threads (Project Loom): Available but not automatically used. Libraries may opt-in, affecting thread-local behavior (e.g., ThreadLocal cleanup patterns differ with virtual threads).

• Sequenced collections: LinkedHashMap, LinkedHashSet, TreeMap now implement SequencedCollection/SequencedMap interfaces. New methods getFirst(), getLast(), reversed(), putFirst(), putLast(). This is additive but may cause ambiguity if user code defines these method names.

• Strong encapsulation: JDK internal APIs are more strictly encapsulated. Some --add-opens flags may be needed for libraries that reflectively access JDK internals (Lombok, etc.).

• Pattern matching for switch and record patterns: Available for use. Not breaking.

• Deprecation removals: Thread.stop(), Runtime.exec(String) overloads with single-string command, Finalization marked for removal.

• -XX:+UseCompactObjectHeaders: New experimental JVM option for reduced memory footprint.

• UTF-8 by default: System.out and System.err default to UTF-8 encoding on all platforms (since Java 18). Previously platform-dependent.

IM Impact (Applied in Branch)

• pom.xml property <java.version>21</java.version> updated across all modules and archetypes.

• Dockerfile (the only one shipped is integration-apps/integration-runner-app/src/main/docker/Dockerfile) changed from amazoncorretto:17-al2-jdk to cregistry.pricefx.eu/im/images/toolchains/corretto-mvn:25-202604150757 — the Pricefx-internal Corretto+Maven toolchain image (:25-… is a build-tag identifier on the toolchain image, not a Java major version — the JVM inside is Java 21).

• Maven compiler plugin adds --add-opens for Lombok annotation processing on JDK 21:

  XML

  <arg>--add-opens=jdk.compiler/com.sun.tools.javac.code=ALL-UNNAMED</arg>
  <arg>--add-opens=jdk.compiler/com.sun.tools.javac.comp=ALL-UNNAMED</arg>
  <arg>--add-opens=jdk.compiler/com.sun.tools.javac.file=ALL-UNNAMED</arg>
  <arg>--add-opens=jdk.compiler/com.sun.tools.javac.main=ALL-UNNAMED</arg>
  <arg>--add-opens=jdk.compiler/com.sun.tools.javac.processing=ALL-UNNAMED</arg>
  

• gmavenplus-plugin configured with <targetBytecode>21</targetBytecode>.

• CDS (Class Data Sharing) archive generation added to Dockerfile for faster startup.

Migration Action Required

• CI/CD pipelines must use Java 21.

• Custom Docker images must use Java 21 base images.

• Any code relying on javax.security.cert package (removed in Java 21) must migrate.

5. Spring Cloud 2022.0.4 → 2025.0.1

Impact: HIGH | Type: Configuration, Bootstrap

5.1 Bootstrap Context Removed

This is the most significant user-facing change.

• spring-cloud-starter-bootstrap is no longer needed and has been removed.

• All bootstrap.yml / bootstrap.yaml / bootstrap.properties files must be deleted.

• Spring Cloud Config Server connection now uses spring.config.import=optional:configserver: mechanism.

• Config server properties (URI, label, profile) move to application.properties.

5.2 Spring Cloud Stream Changes

• Reactive Supplier pattern replaced with StreamBridge: The Supplier<Flux<Message>> pattern for event publishing is no longer the recommended approach.

• spring.cloud.function.definition property removed from defaults — Spring Cloud Stream 4.x auto-detects functions.

• spring.cloud.stream.function.autodetect property introduced to control this.

• Auto-configuration exclusion list expanded: BindingServiceConfiguration added alongside FunctionConfiguration when MQ is disabled.

5.3 Spring Cloud Config Client

• Configured via spring.config.import=optional:configserver: in application properties.

• No longer relies on bootstrap context for early config server connection.

IM Impact (Applied in Branch)

• 7 bootstrap.yml files deleted across modules/archetypes:

  • integration-apps/integration-app/src/main/resources/bootstrap.yml

  • integration-apps/pricefx-integration-app/src/main/resources/bootstrap.yml

  • integration-archetype-custom-image/src/main/resources/src/bootstrap.yml

  • integration-archetype-custom-image/src/test/resources/projects/reference/src/bootstrap.yml

  • integration-archetype/src/main/resources/archetype-resources/src/main/resources/bootstrap.yml

  • (and archetype-provisioned equivalent)

• spring-cloud-starter-bootstrap dependency removed, replaced with spring-cloud-starter-config.

• RabbitMQOutputAutoConfiguration completely rewritten:

  • Old: Supplier<Flux<Message<String>>> bean pattern with ImInternalEventsChannel callback + Reactor Flux.

  • New: StreamBridge.send(OUTPUT_BINDING, message) — simpler, imperative approach.

  • Removed Flux, reactor.core.publisher, @AllArgsConstructor from this class.

• PfxInitListener enhanced with improved event-driven configuration logic:

  • New configureEventDriven() method.

  • Added BindingServiceConfiguration to auto-config exclusions.

  • Added spring.cloud.stream.function.autodetect=false when MQ is disabled.

  • Logs property sources at startup for debugging.

• spring.cloud.function.definition=imInternalEventsSupplier removed from default-application.properties.

• Test application.properties includes spring.config.import=optional:configserver:.

• .gitlab-ci.yml release script no longer updates bootstrap.yml labels.

7. Jackson 2.15.x → 2.19.4

Impact: HIGH | Type: Behavior, Serialization

7.1 StreamReadConstraints (2.15+, defaults tightened in 2.16+)

This is a critical change — identical to the issue documented in MR !1507.

Jackson 2.15+ introduced StreamReadConstraints with default limits:

These defaults can cause StreamConstraintsException when processing large JSON payloads (e.g., large Pricefx API responses). The error message format also changed between versions.

IM Impact: Test assertions for StreamConstraints error messages updated for the new format.

7.2 Coercion Configuration Changes (2.16+)

Jackson 2.16+ tightened default coercion rules:

• String-to-Integer coercion: If JSON contains "123" (string) where an Integer is expected, Jackson may reject by default.

• Empty string coercion: Handling of "" for numeric types changed.

IM Impact: Explicit String-to-Integer coercion enabled for PriceFx API compatibility (the Pricefx API returns some integer fields as strings).

7.3 JavaTimeModule Auto-Registration (2.17+)

Jackson 2.17+ auto-discovers JavaTimeModule via ServiceLoader when on classpath. Explicit registration is no longer needed.

IM Impact: import com.fasterxml.jackson.datatype.jsr310.JavaTimeModule removed from UserEventUtils.java.

7.4 Version Alignment via BOM

All Jackson modules now managed via jackson-bom:

<dependency>
    <groupId>com.fasterxml.jackson</groupId>
    <artifactId>jackson-bom</artifactId>
    <version>${jackson.version}</version>
    <type>pom</type>
    <scope>import</scope>
</dependency>

Previously individual modules had inconsistent versions (e.g., jackson-datatype-jsr310 at 2.12.4, jackson-databind at 2.15.2). All now aligned to 2.19.4.

7.5 RecyclerPool Default Changed (2.17)

Default RecyclerPool changed from threadLocalPool to newLockFreePool. May affect multi-threaded performance characteristics (generally better for virtual threads).

7.6 POJO Property Introspection Rewritten (2.18)

Jackson 2.18 completely rewrote POJO property introspection. May change behavior for:

• Cyclic references

• NamingStrategy with creators

• Record field annotations

7.7 Other Jackson Changes (2.16 → 2.19)

• @JsonProperty(required=true) now enforced during deserialization by default.

• StreamReadFeature.INCLUDE_SOURCE_IN_LOCATION defaults to false (2.16) — error messages no longer include source content.

• Leading-zero strings ("07") no longer coercible as numbers for enum indexes (2.17).

• ObjectMapper.canDeserialize() and canSerialize() deprecated (2.18).

• jackson-datatype-threetenbp updated to 2.18.2 in pricefx-client (JSR-310 ThreeTenBP backport).

8. Jasypt Spring Boot 3.0.5 → 4.0.4 / BouncyCastle

Impact: LOW (resolved) | Type: Encryption, Security

BouncyCastle CBC-Mode IV Behavior (timeline)

BouncyCastle changed how CBC-mode PBE handles initialization vectors across the recent 1.7x/1.8x series:

• BC 1.78–1.80: Strict IV-length check enforced on CBC-mode PBE algorithms (e.g. PBEWithSHA256And256BitAES-CBC-BC). Jasypt's default NoIvGenerator no longer works → EncryptionOperationNotPossibleException on decrypt.

• BC 1.81+: Backward compatibility restored. NoIvGenerator works again on CBC-mode PBE — see bc-java#1985.

IM Impact (Applied in Branch — PFIMCORE-2971)

The IM 7.3.0 upgrade transitively pulled in BC 1.80 via spring-cloud-starter, which would have broken decryption of all existing IM 7.2 connection passwords on IaaS workers. This was caught and fixed before release.

Final fix: pin bcprov-jdk18on to 1.83 in pricefx-integration/pom.xml:

<dependency>
    <groupId>org.bouncycastle</groupId>
    <artifactId>bcprov-jdk18on</artifactId>
    <version>1.83</version>
</dependency>

A brief intermediate workaround that added encryptor.setIvGenerator(new RandomIvGenerator()) to ConnectionLookup.inlinedConnectionEncryptor was reverted in the same fix, because it would have required re-encrypting every customer password and broken orchestrator↔worker compatibility.

Net result for customers: no action required. Existing encrypted passwords keep working unchanged on IM 7.3.0.

10. Apache HttpClient 4.x → 5.x

Impact: HIGH (for custom code) | Type: API, Package relocation

Package Changes

IM Impact

• Managed transitively by Spring Boot. Explicit httpclient5:5.1.4 dependency and exclusion from spring-cloud-config-client removed.

• Customer code using HttpClient directly needs package migration.

11. Commons Libraries

Commons IO 2.14.0 → 2.21.0

Impact: LOW — Bug fixes. org.apache.velocity.shaded.commons.io.FilenameUtils replaced with org.apache.commons.io.FilenameUtils (direct dependency).

Commons Lang3 3.18.0 → 3.20.0

Impact: LOW — Bug fixes and new methods.

Commons CSV 1.8 → 1.14.1

Impact: LOW-MEDIUM — Parser behavior changes for edge cases. Version now managed by parent POM.

Commons Compress → 1.28.0 (new explicit)

Impact: LOW — Aligned with Camel parent.

Commons Collections 3.2.2 → Collections4 4.4

Impact: MEDIUM — Package change: org.apache.commons.collections → org.apache.commons.collections4.

IM Impact (current state on feature/PFIMCORE-2956) — migration is partial:

• Direct commons-collections v3 dependency declarations removed from POMs (commons-collections4 is the declared dep).

• v3 jar (3.2.2) is still on the runtime classpath transitively via commons-beanutils:1.11.0.

• ~18 source files in pricefx-integration/src/main/java still import org.apache.commons.collections.* (v3 package). These compile and run because the v3 jar is still resolved transitively. Examples:

  • MapUtils (v3): MetadataProcessor, CustomerService, QuoteService, PricingParameterUtils, ProducerUtils, PriceOptimizationUtils, ReloadRoutesUtils, TemplatesUtils, HttpAuditTypeCommand, SalesforceAuthenticationOAuth, PriceOptimizerDataModelService, PricingParameterProcessorUtils

  • CollectionUtils.isNotEmpty (v3): DeploymentContext, PfxEventComponent

  • map.UnmodifiableMap (v3): ConnectionPool

  • Class literal in Groovy sandbox whitelist: GroovySecurityDefaultSettings.java:325 (org.apache.commons.collections.MapUtils.class)

• Full migration of these to collections4 is tracked as a GAP (see Section 15).

Target state — fully migrated imports look like:

// Before
import static org.apache.commons.collections.MapUtils.getMap;
import static org.apache.commons.collections.CollectionUtils.isNotEmpty;
import org.apache.commons.collections.map.UnmodifiableMap;

// After
import static org.apache.commons.collections4.MapUtils.getMap;
import static org.apache.commons.collections4.CollectionUtils.isNotEmpty;
import org.apache.commons.collections4.map.UnmodifiableMap;

Commons Codec — Removed

org.apache.commons.codec.binary.Base64 replaced with java.util.Base64.

Commons BeanUtils — Removed

Removed from pricefx-client dependencies.

12. Full Library Version Matrix

Runtime / Toolchain

Managed by Camel Parent BOM (camel.version=4.18.1)

Project-Specific Versions

Transitively Managed (notable, no explicit *.version property)

These come in via Spring Boot, Camel, or CXF BOMs and are not pinned in IM POMs. Versions follow the BOM and may shift on minor BOM bumps. Versions below were captured from mvn dependency:tree on pricefx-integration at v7.3.0.