Skip to content

chore(deps): bump the all-maven group in /backend-spring with 17 updates - #8

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/maven/backend-spring/all-maven-884459f2cc
Closed

chore(deps): bump the all-maven group in /backend-spring with 17 updates#8
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/maven/backend-spring/all-maven-884459f2cc

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Apr 18, 2026

Copy link
Copy Markdown
Contributor

Bumps the all-maven group in /backend-spring with 17 updates:

Package From To
org.springframework.boot:spring-boot-starter-parent 3.5.12 4.0.5
org.testcontainers:testcontainers-bom 1.21.3 2.0.4
com.baomidou:mybatis-plus-spring-boot3-starter 3.5.5 3.5.16
org.redisson:redisson-spring-boot-starter 3.27.0 4.3.1
io.jsonwebtoken:jjwt-api 0.12.5 0.13.0
io.jsonwebtoken:jjwt-impl 0.12.5 0.13.0
io.jsonwebtoken:jjwt-jackson 0.12.5 0.13.0
org.springdoc:springdoc-openapi-starter-webmvc-ui 2.3.0 3.0.3
org.projectlombok:lombok 1.18.30 1.18.44
cn.hutool:hutool-all 5.8.26 5.8.44
org.mapstruct:mapstruct 1.5.5.Final 1.6.3
org.mapstruct:mapstruct-processor 1.5.5.Final 1.6.3
org.owasp.encoder:encoder 1.3.1 1.4.0
com.meilisearch.sdk:meilisearch-java 0.11.0 0.20.0
com.squareup.okhttp3:okhttp 4.12.0 5.3.2
org.apache.dubbo:dubbo-spring-boot-starter 3.2.14 3.3.6
org.apache.dubbo:dubbo-registry-nacos 3.2.14 3.3.6

Updates org.springframework.boot:spring-boot-starter-parent from 3.5.12 to 4.0.5

Release notes

Sourced from org.springframework.boot:spring-boot-starter-parent's releases.

v4.0.5

🐞 Bug Fixes

  • Test starter for Spring Integration does not include Spring Integration test module #49784
  • Some sliced tests that import TransactionAutoConfiguration do not import TransactionManagerCustomizationAutoConfiguration #49782
  • WebSocket messaging's task executors are only auto-configured and stompWebSocketHandlerMapping is only forced to be eager when using Jackson #49753
  • WebSocket app fails to start when Jackson is on the classpath but there's no JsonMapper bean #49749
  • Metadata annotation processor ignores method-level @NestedConfigurationProperty when using constructor binding #49738
  • Override of property in external 'application.properties' or 'application.yaml' is ignored #49731
  • NativeImageResourceProvider does not find Flyway migration scripts in subdirectories #49706
  • Add @ConditionalOnWebApplication to NettyReactiveWebServerAutoConfiguration #49695
  • @GraphQlTest does not include @ControllerAdvice #49672

📔 Documentation

  • Fix incorrect indefinite articles in Javadoc #49727
  • Add some more Kotlin examples and trivial style fixes #49714
  • Overhaul Spring Session documentation following modularization #49704

🔨 Dependency Upgrades

  • Upgrade to Brave 6.3.1 #49763
  • Upgrade to Jackson 2 Bom 2.21.2 #49764
  • Upgrade to jOOQ 3.19.31 #49765
  • Upgrade to Netty 4.2.12.Final #49794
  • Upgrade to Tomcat 11.0.20 #49767
  • Upgrade to Zipkin Reporter 3.5.3 #49762

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​Joowon-Seo, @​deejay1, @​dlwldnjs1009, @​kwondh5217, @​ljrmorgan, and @​quaff

v4.0.4

⚠️ Attention Required

  • OpenTelemetry's ZipkinSpanExporter has been deprecated and its support will be removed in Spring Boot 4.2. #49453
  • Jackson 2 has been upgraded to 2.21.1 in response to the Jackson team ending support for Jackson 2.20.x. #49389
  • Jackson has been upgraded to 3.1.0 in response to the Jackson team ending support for Jackson 3.0.x. #49383
  • The default value for server.tomcat.max-part-count has been increased from 10 to 50. This aligns it with Tomcat's own default and the default in Spring Boot 3.x. #49311

🐞 Bug Fixes

  • EndpointRequest request matcher for health groups is too complex #49649
  • "/cloudfoundryapplication" web path is not limited to Actuator #49646
  • Fix EndpointRequest.toLinks() when base-path is '/' #49617
  • Docker fails when a 'tcp://' address ends with a slash (for example 'tcp://docker:2375/') #49596
  • RSocket exposes duplicate endpoint for websocket setups #49593
  • Failure analysis for a missing mail sender is misleading #49582

... (truncated)

Commits
  • fe74b31 Release v4.0.5
  • e1d6e5a Merge branch '3.5.x' into 4.0.x
  • 6c9e52a Next development version (v3.5.14-SNAPSHOT)
  • a413e95 Upgrade to Netty 4.2.12.Final
  • c1694b5 Add missing Spring Integration test module to the relevant starter
  • 51ffdc6 Merge branch '3.5.x' into 4.0.x
  • 696a60e Full auto-configure transaction management in slice tests
  • ba70d41 Upgrade to Tomcat 11.0.20
  • fd94ca0 Upgrade to Netty 4.2.11.Final
  • 7e6833b Upgrade to jOOQ 3.19.31
  • Additional commits viewable in compare view

Updates org.testcontainers:testcontainers-bom from 1.21.3 to 2.0.4

Release notes

Sourced from org.testcontainers:testcontainers-bom's releases.

2.0.4

What's Changed

📖 Documentation

📦 Dependency updates

2.0.3

What's Changed

🐛 Bug Fixes

📖 Documentation

📦 Dependency updates

2.0.2

What's Changed

... (truncated)

Commits
  • ccd28bf Update docker-java version to 3.7.1 (#11572)
  • cdca4b1 Update cockroachdb image version
  • 01451d1 Disable DockerComposeContainerVolumeRemovalTest and ComposeContainerVolumeRem...
  • 326987f Update Pull Request template
  • a756bc6 Improve k6 docs (#11564)
  • 5323acd Use non-deprecated MSSQLServerContainer in ServiceBusEmulatorContainer (#11223)
  • 8da56ff Support apache/activemq in ActiveMQContainer (#11498)
  • dea9725 Update ryuk version to 0.14.0 (#11486)
  • 43c6a97 Combined dependencies PR (#11353)
  • 7778cc5 Merge remote-tracking branch 'origin/dependabot/gradle/modules/activemq/org.a...
  • Additional commits viewable in compare view

Updates com.baomidou:mybatis-plus-spring-boot3-starter from 3.5.5 to 3.5.16

Release notes

Sourced from com.baomidou:mybatis-plus-spring-boot3-starter's releases.

v3.5.16

  • fix: 修复Jackson3TypeHandler自定义ObjectMapper无效
  • fix: 处理代码生成器PackageConfig指定模块为空时拼接错误
  • fix: 修复配置加密无法在环境变量中使用
  • feat: 升级SpringBoot3至3.5.9
  • feat: 升级JUnit单元测试
  • feat: 升级fastjson至2.0.60
  • feat: 升级jackson至2.20.1
  • feat: 升级gson至2.13.2
  • feat: 升级postgresql至42.7.8
  • feat: 升级h2database至2.4.240
  • feat: 升级mysql-connector-j至9.5.0
  • feat: 升级sqlite-jdbc至3.51.1.0
  • feat: 升级jaybird至5.0.10.java8
  • feat: 升级mybatis-spring4.0.0

v3.5.15

  • fix: 修复Enjoy模板生成xml错误
  • feat: 调整代码生成器元数据构建
  • feat: 优化CrudRepository批量执行前判断非事务中关闭连接
  • feat: 支持SpringBoot4.0.0
  • feat: 支持Jackson3.0

v3.5.14

  • feat: 增加bom对mybatis-plus-spring-boot4-starter与mybatis-plus-spring-boot4-starter-test管理

v3.5.13

  • fix: 修复在Spring中使用@PostConstruct调用Db方法查询出现警告日志
  • fix: 修复Db使用count返回null导致的空指针异常
  • fix: 修复BaseMapper在非Spring项目中报错
  • feat: 升级Jsqlparser5.2
  • feat: OrderItem增加withExpression根据表达式排序(注意:不支持序列化方式使用,自行控制sql注入)
  • feat: OracleDdlGenerator支持指定schema模式运行
  • feat: 适配华为云GaussDb数据库
  • feat: 雪花生成器初始化错误增加降级处理
  • feat: 新增spring-boot4支持
  • feat: 升级gradle8.13
  • opt: SqlUtils中replaceSqlPlaceholder方法增加缓存处理
  • opt：优化DDL执行记录表检查是否存在
  • opt: 容器环境下workerId获取优化

v3.5.12

  • fix: 修复批量操作异步执行首次可能的出现NoSuchElementException错误
  • fix: 修复默认SQL解析线程池在JVM退出关闭导致的任务拒绝
  • fix: 修复entity.java.btl生成toString方法样式错误
  • fix: 修复entity.java.ftl模板类注释与导包缺少换行
  • opt: 重构SqlRunner执行SQL语句 (动态传参，不再根据参数值生成执行SQL)
  • opt: 增强SqlRunner执行(支持单参数使用Map({key}),List({index}),JavaBean({property})获取值)
  • opt: 改进MybatisUtils对自SqlSessionFactory的提取(支持自定义SqlSessionTemplate子类)
  • opt: 自动识别数据库支持TDengine数据库websocket连接

... (truncated)

Changelog

Sourced from com.baomidou:mybatis-plus-spring-boot3-starter's changelog.

[v3.5.16] 2026.1.11

  • fix: 修复Jackson3TypeHandler自定义ObjectMapper无效
  • fix: 处理代码生成器PackageConfig指定模块为空时拼接错误
  • feat: 升级SpringBoot3至3.5.9
  • feat: 升级JUnit单元测试
  • feat: 升级fastjson至2.0.60
  • feat: 升级jackson至2.20.1
  • feat: 升级gson至2.13.2
  • feat: 升级postgresql至42.7.8
  • feat: 升级h2database至2.4.240
  • feat: 升级mysql-connector-j至9.5.0
  • feat: 升级sqlite-jdbc至3.51.1.0
  • feat: 升级jaybird至5.0.10.java8
  • feat: 升级mybatis-spring4.0.0

[v3.5.15] 2025.11.30

  • fix: 修复Enjoy模板生成xml错误
  • feat: 调整代码生成器元数据构建
  • feat: 优化CrudRepository批量执行前判断非事务中关闭连接
  • feat: 支持SpringBoot4.0.0
  • feat: 支持Jackson3.0

[v3.5.14] 2025.08.29

  • feat: 增加bom对mybatis-plus-spring-boot4-starter与mybatis-plus-spring-boot4-starter-test管理

[v3.5.13] 2025.08.29

  • fix: 修复在Spring中使用@PostConstruct调用Db方法查询出现警告日志
  • fix: 修复Db使用count返回null导致的空指针异常
  • fix: 修复BaseMapper在非Spring项目中报错
  • feat: 升级Jsqlparser5.2
  • feat: OrderItem增加withExpression根据表达式排序(注意:不支持序列化方式使用,自行控制sql注入)
  • feat: OracleDdlGenerator支持指定schema模式运行
  • feat: 适配华为云GaussDb数据库
  • feat: 雪花生成器初始化错误增加降级处理
  • feat: 新增spring-boot4支持
  • feat: 升级gradle8.13
  • opt: SqlUtils中replaceSqlPlaceholder方法增加缓存处理
  • opt：优化DDL执行记录表检查是否存在
  • opt: 容器环境下workerId获取优化

[v3.5.12] 2025.04.27

  • fix: 修复批量操作异步执行首次可能的出现NoSuchElementException错误
  • fix: 修复默认SQL解析线程池在JVM退出关闭导致的任务拒绝
  • fix: 修复entity.java.btl生成toString方法样式错误
  • fix: 修复entity.java.ftl模板类注释与导包缺少换行
  • opt: 重构SqlRunner执行SQL语句 (动态传参，不再根据参数值生成执行SQL)
  • opt: 增强SqlRunner执行(支持单参数使用Map({key}),List({index}),JavaBean({property})获取值)
  • opt: 改进MybatisUtils对自SqlSessionFactory的提取(支持自定义SqlSessionTemplate子类)
  • opt: 自动识别数据库支持TDengine数据库websocket连接
  • opt: 支持Db工具类对多数据源的支持

... (truncated)

Commits
  • adb5615 升级依赖
  • 1287959 处理子包路径为空.
  • 7d1ce24 feat: 升级mybatis-plus-spring-boot3-starter测试依赖mybatis-spring-boot-starter至3.0.5
  • 60e109b fix:Jackson3TypeHandler
  • c118158 mybatis-plus-spring-boot4-starter依赖升级mybatis-spring4.0.0
  • 933a292 发布3.5.15
  • 1dfd48a 更新日志.
  • 1e4bd33 更新json支持.
  • ff0d32f feat(mybatis-plus-extension): 添加对 Jackson 3 的支持
  • db91d1a 升级springboot4.0.0
  • Additional commits viewable in compare view

Updates org.redisson:redisson-spring-boot-starter from 3.27.0 to 4.3.1

Updates io.jsonwebtoken:jjwt-api from 0.12.5 to 0.13.0

Release notes

Sourced from io.jsonwebtoken:jjwt-api's releases.

0.13.0

This is the last minor JJWT release branch that will support Java 7.

Any necessary emergency bug fixes will be fixed in subsequent 0.13.x patch releases, but all new development, including Java 8 compatible changes, will be in the next minor (0.14.0) release.

All future JJWT major and minor versions ( 0.14.0 and later) will require Java 8 or later.

What's Changed

This release contains a single change:

  • The previously private JacksonDeserializer(ObjectMapper objectMapper, Map<String, Class<?>> claimTypeMap) constructor is now public for those that want register a claims type converter on their own specified ObjectMapper instance. Thank you to @​kesrishubham2510 for PR #972. See Issue 914.

Full Changelog: jwtk/jjwt@0.12.7...0.13.0

0.12.7

This patch release:

  • Adds a new Maven BOM! This is useful for multi-module projects. See Issue 967.

  • Allows the JwtParserBuilder to have empty nested algorithm collections, effectively disabling the parser's associated feature:

    • Emptying the zip() nested collection disables JWT decompression.
    • Emptying the sig() nested collection disables JWS mac/signature verification (i.e. all JWSs will be unsupported/rejected).
    • Emptying either the enc() or key() nested collections disables JWE decryption (i.e. all JWEs will be unsupported/rejected)

    See Issue 996.

  • Fixes bug 961 where JwtParserBuilder nested collection builders were not correctly replacing algorithms with the same id.

  • Ensures a JwkSet's keys collection is no longer entirely secret/redacted by default. This was an overzealous default that was unnecessarily restrictive; the keys collection itself should always be public, and each individual key within should determine which fields should be redacted when printed. See Issue 976.

  • Improves performance slightly by ensuring all jjwt-api utility methods that create *Builder instances (Jwts.builder(), Jwts.parserBuilder(), Jwks.builder(), etc) no longer use reflection.

    Instead,static factories are created via reflection only once during initial jjwt-api classloading, and then *Builders are created via standard instantiation using the new operator thereafter. This also benefits certain environments that may not have ideal ClassLoader implementations (e.g. Tomcat in some cases).

    NOTE: because this changes which classes are loaded via reflection, any environments that must explicitly reference reflective class names (e.g. GraalVM applications) will need to be updated to reflect the new factory class names.

    See Issue 988.

  • Upgrades the Gson dependency to 2.11.0

  • Upgrades the BouncyCastle dependency to 1.78.1

New Contributors

Full Changelog: jwtk/jjwt@0.12.6...0.12.7

0.12.6

This patch release:

  • Ensures that after successful JWS signature verification, an application-configured Base64Url Decoder output is used to construct a Jws instance (instead of JJWT's default decoder). See jwtk/jjwt#947.

... (truncated)

Changelog

Sourced from io.jsonwebtoken:jjwt-api's changelog.

0.13.0

This is the last minor JJWT release branch that will support Java 7. Any necessary emergency bug fixes will be fixed in subsequent 0.13.x patch releases, but all new development, including Java 8 compatible changes, will be in the next minor (0.14.0) release.

All future JJWT major and minor versions ( 0.14.0 and later) will require Java 8 or later.

This 0.13.0 minor release has only one change:

  • The previously private JacksonDeserializer(ObjectMapper objectMapper, Map<String, Class<?>> claimTypeMap) constructor is now public for those that want register a claims type converter on their own specified ObjectMapper instance. See Issue 914.

0.12.7

This patch release:

  • Adds a new Maven BOM, useful for multi-module projects. See Issue 967.

  • Allows the JwtParserBuilder to have empty nested algorithm collections, effectively disabling the parser's associated feature:

    • Emptying the zip() nested collection disables JWT decompression.
    • Emptying the sig() nested collection disables JWS mac/signature verification (i.e. all JWSs will be unsupported/rejected).
    • Emptying either the enc() or key() nested collections disables JWE decryption (i.e. all JWEs will be unsupported/rejected)

    See Issue 996.

  • Fixes bug 961 where JwtParserBuilder nested collection builders were not correctly replacing algorithms with the same id.

  • Ensures a JwkSet's keys collection is no longer entirely secret/redacted by default. This was an overzealous default that was unnecessarily restrictive; the keys collection itself should always be public, and each individual key within should determine which fields should be redacted when printed. See Issue 976.

  • Improves performance slightly by ensuring all jjwt-api utility methods that create *Builder instances (Jwts.builder(), Jwts.parserBuilder(), Jwks.builder(), etc) no longer use reflection.

    Instead,static factories are created via reflection only once during initial jjwt-api classloading, and then *Builders are created via standard instantiation using the new operator thereafter. This also benefits certain environments that may not have ideal ClassLoader implementations (e.g. Tomcat in some cases).

    NOTE: because this changes which classes are loaded via reflection, any environments that must explicitly reference reflective class names (e.g. GraalVM applications) will need to be updated to reflect the new factory class names.

    See Issue 988.

  • Upgrades the Gson dependency to 2.11.0

  • Upgrades the BouncyCastle dependency to 1.78.1

0.12.6

This patch release:

  • Ensures that after successful JWS signature verification, an application-configured Base64Url Decoder output is used to construct a Jws instance (instead of JJWT's default decoder). See Issue 947.
  • Fixes a decompression memory leak in concurrent/multi-threaded environments introduced in 0.12.0 when decompressing JWTs with a zip header of GZIP. See Issue 949.
  • Upgrades BouncyCastle to 1.78 via PR 941.
  • Ensures that a JwkSet's keys list member is no longer considered secret and is not redacted by default. However, each individual JWK element within the keys list may still have redacted private or secret members as expected. See Issue 976.
Commits

Updates io.jsonwebtoken:jjwt-impl from 0.12.5 to 0.13.0

Release notes

Sourced from io.jsonwebtoken:jjwt-impl's releases.

0.13.0

This is the last minor JJWT release branch that will support Java 7.

Any necessary emergency bug fixes will be fixed in subsequent 0.13.x patch releases, but all new development, including Java 8 compatible changes, will be in the next minor (0.14.0) release.

All future JJWT major and minor versions ( 0.14.0 and later) will require Java 8 or later.

What's Changed

This release contains a single change:

  • The previously private JacksonDeserializer(ObjectMapper objectMapper, Map<String, Class<?>> claimTypeMap) constructor is now public for those that want register a claims type converter on their own specified ObjectMapper instance. Thank you to @​kesrishubham2510 for PR #972. See Issue 914.

Full Changelog: jwtk/jjwt@0.12.7...0.13.0

0.12.7

This patch release:

  • Adds a new Maven BOM! This is useful for multi-module projects. See Issue 967.

  • Allows the JwtParserBuilder to have empty nested algorithm collections, effectively disabling the parser's associated feature:

    • Emptying the zip() nested collection disables JWT decompression.
    • Emptying the sig() nested collection disables JWS mac/signature verification (i.e. all JWSs will be unsupported/rejected).
    • Emptying either the enc() or key() nested collections disables JWE decryption (i.e. all JWEs will be unsupported/rejected)

    See Issue 996.

  • Fixes bug 961 where JwtParserBuilder nested collection builders were not correctly replacing algorithms with the same id.

  • Ensures a JwkSet's keys collection is no longer entirely secret/redacted by default. This was an overzealous default that was unnecessarily restrictive; the keys collection itself should always be public, and each individual key within should determine which fields should be redacted when printed. See Issue 976.

  • Improves performance slightly by ensuring all jjwt-api utility methods that create *Builder instances (Jwts.builder(), Jwts.parserBuilder(), Jwks.builder(), etc) no longer use reflection.

    Instead,static factories are created via reflection only once during initial jjwt-api classloading, and then *Builders are created via standard instantiation using the new operator thereafter. This also benefits certain environments that may not have ideal ClassLoader implementations (e.g. Tomcat in some cases).

    NOTE: because this changes which classes are loaded via reflection, any environments that must explicitly reference reflective class names (e.g. GraalVM applications) will need to be updated to reflect the new factory class names.

    See Issue 988.

  • Upgrades the Gson dependency to 2.11.0

  • Upgrades the BouncyCastle dependency to 1.78.1

New Contributors

Full Changelog: jwtk/jjwt@0.12.6...0.12.7

0.12.6

This patch release:

  • Ensures that after successful JWS signature verification, an application-configured Base64Url Decoder output is used to construct a Jws instance (instead of JJWT's default decoder). See jwtk/jjwt#947.

... (truncated)

Changelog

Sourced from io.jsonwebtoken:jjwt-impl's changelog.

0.13.0

This is the last minor JJWT release branch that will support Java 7. Any necessary emergency bug fixes will be fixed in subsequent 0.13.x patch releases, but all new development, including Java 8 compatible changes, will be in the next minor (0.14.0) release.

All future JJWT major and minor versions ( 0.14.0 and later) will require Java 8 or later.

This 0.13.0 minor release has only one change:

  • The previously private JacksonDeserializer(ObjectMapper objectMapper, Map<String, Class<?>> claimTypeMap) constructor is now public for those that want register a claims type converter on their own specified ObjectMapper instance. See Issue 914.

0.12.7

This patch release:

  • Adds a new Maven BOM, useful for multi-module projects. See Issue 967.

  • Allows the JwtParserBuilder to have empty nested algorithm collections, effectively disabling the parser's associated feature:

    • Emptying the zip() nested collection disables JWT decompression.
    • Emptying the sig() nested collection disables JWS mac/signature verification (i.e. all JWSs will be unsupported/rejected).
    • Emptying either the enc() or key() nested collections disables JWE decryption (i.e. all JWEs will be unsupported/rejected)

    See Issue 996.

  • Fixes bug 961 where JwtParserBuilder nested collection builders were not correctly replacing algorithms with the same id.

  • Ensures a JwkSet's keys collection is no longer entirely secret/redacted by default. This was an overzealous default that was unnecessarily restrictive; the keys collection itself should always be public, and each individual key within should determine which fields should be redacted when printed. See Issue 976.

  • Improves performance slightly by ensuring all jjwt-api utility methods that create *Builder instances (Jwts.builder(), Jwts.parserBuilder(), Jwks.builder(), etc) no longer use reflection.

    Instead,static factories are created via reflection only once during initial jjwt-api classloading, and then *Builders are created via standard instantiation using the new operator thereafter. This also benefits certain environments that may not have ideal ClassLoader implementations (e.g. Tomcat in some cases).

    NOTE: because this changes which classes are loaded via reflection, any environments that must explicitly reference reflective class names (e.g. GraalVM applications) will need to be updated to reflect the new factory class names.

    See Issue 988.

  • Upgrades the Gson dependency to 2.11.0

  • Upgrades the BouncyCastle dependency to 1.78.1

0.12.6

This patch release:

  • Ensures that after successful JWS signature verification, an application-configured Base64Url Decoder output is used to construct a Jws instance (instead of JJWT's default decoder). See Issue 947.
  • Fixes a decompression memory leak in concurrent/multi-threaded environments introduced in 0.12.0 when decompressing JWTs with a zip header of GZIP. See Issue 949.
  • Upgrades BouncyCastle to 1.78 via PR 941.
  • Ensures that a JwkSet's keys list member is no longer considered secret and is not redacted by default. However, each individual JWK element within the keys list may still have redacted private or secret members as expected. See Issue 976.
Commits

Updates io.jsonwebtoken:jjwt-jackson from 0.12.5 to 0.13.0

Updates io.jsonwebtoken:jjwt-impl from 0.12.5 to 0.13.0

Release notes

Sourced from io.jsonwebtoken:jjwt-impl's releases.

0.13.0

This is the last minor JJWT release branch that will support Java 7.

Any necessary emergency bug fixes will be fixed in subsequent 0.13.x patch releases, but all new development, including Java 8 compatible changes, will be in the next minor (0.14.0) release.

All future JJWT major and minor versions ( 0.14.0 and later) will require Java 8 or later.

What's Changed

This release contains a single change:

  • The previously private JacksonDeserializer(ObjectMapper objectMapper, Map<String, Class<?>> claimTypeMap) constructor is now public for those that want register a claims type converter on their own specified ObjectMapper instance. Thank you to @​kesrishubham2510 for PR #972. See Issue 914.

Full Changelog: jwtk/jjwt@0.12.7...0.13.0

0.12.7

This patch release:

  • Adds a new Maven BOM! This is useful for multi-module projects. See Issue 967.

  • Allows the JwtParserBuilder to have empty nested algorithm collections, effectively disabling the parser's associated feature:

    • Emptying the zip() nested collection disables JWT decompression.
    • Emptying the sig() nested collection disables JWS mac/signature verification (i.e. all JWSs will be unsupported/rejected).
    • Emptying either the enc() or key() nested collections disables JWE decryption (i.e. all JWEs will be unsupported/rejected)

    See Issue 996.

  • Fixes bug 961 where JwtParserBuilder nested collection builders were not correctly replacing algorithms with the same id.

  • Ensures a JwkSet's keys collection is no longer entirely secret/redacted by default. This was an overzealous default that was unnecessarily restrictive; the keys collection itself should always be public, and each individual key within should determine which fields should be redacted when printed. See Issue 976.

  • Improves performance slightly by ensuring all jjwt-api utility methods that create *Builder instances (Jwts.builder(), Jwts.parserBuilder(), Jwks.builder(), etc) no longer use reflection.

    Instead,static factories are created via reflection only once during initial jjwt-api classloading, and then *Builders are created via standard instantiation using the new operator thereafter. This also benefits certain environments that may not have ideal ClassLoader implementations (e.g. Tomcat in some cases).

    NOTE: because this changes which classes are loaded via reflection, any environments that must explicitly reference reflective class names (e.g. GraalVM applications) will need to be updated to reflect the new factory class names.

    See Issue 988.

  • Upgrades the Gson dependency to 2.11.0

  • Upgrades the BouncyCastle dependency to 1.78.1

New Contributors

Full Changelog: jwtk/jjwt@0.12.6...0.12.7

0.12.6

This patch release:

  • Ensures that after successful JWS signature verification, an application-configured Base64Url Decoder output is used to construct a Jws instance (instead of JJWT's default decoder). See jwtk/jjwt#947.

... (truncated)

Changelog

Sourced from io.jsonwebtoken:jjwt-impl's changelog.

0.13.0

This is the last minor JJWT release branch that will support Java 7. Any necessary emergency bug fixes will be fixed in subsequent 0.13.x patch releases, but all new development, including Java 8 compatible changes, will be in the next minor (0.14.0) release.

All future JJWT major and minor versions ( 0.14.0 and later) will require Java 8 or later.

This 0.13.0 minor release has only one change:

  • The previously private JacksonDeserializer(ObjectMapper objectMapper, Map<String, Class<?>> claimTypeMap) constructor is now public for those that want register a claims type converter on their own specified ObjectMapper instance. See Issue 914.

0.12.7

This patch release:

  • Adds a new Maven BOM, useful for multi-module projects. See Issue 967.

  • Allows the JwtParserBuilder to have empty nested algorithm collections, effectively disabling the parser's associated feature:

    • Emptying the zip() nested collection disables JWT decompression.
    • Emptying the sig() nested collection disables JWS mac/signature verification (i.e. all JWSs will be unsupported/rejected).
    • Emptying either the enc() or key() nested collections disables JWE decryption (i.e. all JWEs will be unsupported/rejected)

    See Issue 996.

  • Fixes bug 961 where JwtParserBuilder nested collection builders were not correctly replacing algorithms with the same id.

  • Ensures a JwkSet's keys collection is no longer entirely secret/redacted by default. This was an overzealous default that was unnecessarily restrictive; the keys collection itself should always be public, and each individual key within should determine which fields should be redacted when printed. See Issue 976.

  • Improves performance slightly by ensuring all jjwt-api utility methods that create *Builder instances (Jwts.builder(), Jwts.parserBuilder(), Jwks.builder(), etc) no longer use reflection.

    Instead,static factories are created via reflection only once during initial jjwt-api classloading, and then *Builders are created via standard instantiation using the new operator thereafter. This also benefits certain environments that may not have ideal ClassLoader implementations (e.g. Tomcat in some cases).

    NOTE: because this changes which classes are loaded via reflection, any environments that must explicitly reference reflective class names (e.g. GraalVM applications) will need to be updated to reflect the new factory class names.

    See Issue 988.

  • Upgrades the Gson dependency to 2.11.0

  • Upgrades the BouncyCastle dependency to 1.78.1

0.12.6

This patch release:

  • Ensures that after successful JWS signature verification, an application-configured Base64Url Decoder output is used to construct a Jws instance (instead of JJWT's default decoder). See Issue 947.
  • Fixes a decompression memory leak in concurrent/multi-threaded environments introduced in 0.12.0 when decompressing JWTs with a zip header of GZIP. See Issue 949.
  • Upgrades BouncyCastle to 1.78 via PR 941.
  • Ensures that a JwkSet's keys list member is no longer considered secret and is not redacted by default. However, each individual JWK element within the keys list may still have redacted private or secret members as expected. See Issue 976.
Commits

Updates io.jsonwebtoken:jjwt-jackson from 0.12.5 to 0.13.0

Updates org.springdoc:springdoc-openapi-starter-webmvc-ui from 2.3.0 to 3.0.3

Release notes

Sourced from org.springdoc:springdoc-openapi-starter-webmvc-ui's releases.

springdoc-openapi v3.0.3 released!

Added

  • #3246 – Add Springdoc OpenAPI MCP (Model Context Protocol) support
  • #3256 – Auto-set nullable: true for Kotlin nullable types in schema properties
  • #3239 – Add support for the @Range constraint validation annotation
  • #3244 – Handle default values for LocalDate

Changed

  • Upgrade Spring Boot to version 4.0.5
  • Upgrade swagger-core to version 2.2.47
  • Upgrade swagger-ui to version 5.32.2
  • #3260 – @ConditionalOnClass(HateoasProperties.class) in SpringDocHateoasConfiguration
  • Forwards all MCP non-transport headers to downstream methods
  • Dynamically resolve the base path from window.location.pathname for MCP UI

Fixed

@dependabot
chore(deps): bump the all-maven group in /backend-spring with 17 updates
cfd4441 
Bumps the all-maven group in /backend-spring with 17 updates:

| Package | From | To |
| --- | --- | --- |
| [org.springframework.boot:spring-boot-starter-parent](https://github.com/spring-projects/spring-boot) | `3.5.12` | `4.0.5` |
| [org.testcontainers:testcontainers-bom](https://github.com/testcontainers/testcontainers-java) | `1.21.3` | `2.0.4` |
| [com.baomidou:mybatis-plus-spring-boot3-starter](https://github.com/baomidou/mybatis-plus) | `3.5.5` | `3.5.16` |
| org.redisson:redisson-spring-boot-starter | `3.27.0` | `4.3.1` |
| [io.jsonwebtoken:jjwt-api](https://github.com/jwtk/jjwt) | `0.12.5` | `0.13.0` |
| [io.jsonwebtoken:jjwt-impl](https://github.com/jwtk/jjwt) | `0.12.5` | `0.13.0` |
| io.jsonwebtoken:jjwt-jackson | `0.12.5` | `0.13.0` |
| [org.springdoc:springdoc-openapi-starter-webmvc-ui](https://github.com/springdoc/springdoc-openapi) | `2.3.0` | `3.0.3` |
| [org.projectlombok:lombok](https://github.com/projectlombok/lombok) | `1.18.30` | `1.18.44` |
| [cn.hutool:hutool-all](https://github.com/looly/hutool) | `5.8.26` | `5.8.44` |
| [org.mapstruct:mapstruct](https://github.com/mapstruct/mapstruct) | `1.5.5.Final` | `1.6.3` |
| [org.mapstruct:mapstruct-processor](https://github.com/mapstruct/mapstruct) | `1.5.5.Final` | `1.6.3` |
| [org.owasp.encoder:encoder](https://github.com/owasp/owasp-java-encoder) | `1.3.1` | `1.4.0` |
| [com.meilisearch.sdk:meilisearch-java](https://github.com/meilisearch/meilisearch-java) | `0.11.0` | `0.20.0` |
| [com.squareup.okhttp3:okhttp](https://github.com/square/okhttp) | `4.12.0` | `5.3.2` |
| [org.apache.dubbo:dubbo-spring-boot-starter](https://github.com/apache/dubbo) | `3.2.14` | `3.3.6` |
| [org.apache.dubbo:dubbo-registry-nacos](https://github.com/apache/dubbo) | `3.2.14` | `3.3.6` |


Updates `org.springframework.boot:spring-boot-starter-parent` from 3.5.12 to 4.0.5
- [Release notes](https://github.com/spring-projects/spring-boot/releases)
- [Commits](spring-projects/spring-boot@v3.5.12...v4.0.5)

Updates `org.testcontainers:testcontainers-bom` from 1.21.3 to 2.0.4
- [Release notes](https://github.com/testcontainers/testcontainers-java/releases)
- [Changelog](https://github.com/testcontainers/testcontainers-java/blob/main/CHANGELOG.md)
- [Commits](testcontainers/testcontainers-java@1.21.3...2.0.4)

Updates `com.baomidou:mybatis-plus-spring-boot3-starter` from 3.5.5 to 3.5.16
- [Release notes](https://github.com/baomidou/mybatis-plus/releases)
- [Changelog](https://github.com/baomidou/mybatis-plus/blob/3.0/CHANGELOG.md)
- [Commits](baomidou/mybatis-plus@v3.5.5...v3.5.16)

Updates `org.redisson:redisson-spring-boot-starter` from 3.27.0 to 4.3.1

Updates `io.jsonwebtoken:jjwt-api` from 0.12.5 to 0.13.0
- [Release notes](https://github.com/jwtk/jjwt/releases)
- [Changelog](https://github.com/jwtk/jjwt/blob/master/CHANGELOG.md)
- [Commits](jwtk/jjwt@0.12.5...0.13.0)

Updates `io.jsonwebtoken:jjwt-impl` from 0.12.5 to 0.13.0
- [Release notes](https://github.com/jwtk/jjwt/releases)
- [Changelog](https://github.com/jwtk/jjwt/blob/master/CHANGELOG.md)
- [Commits](jwtk/jjwt@0.12.5...0.13.0)

Updates `io.jsonwebtoken:jjwt-jackson` from 0.12.5 to 0.13.0

Updates `io.jsonwebtoken:jjwt-impl` from 0.12.5 to 0.13.0
- [Release notes](https://github.com/jwtk/jjwt/releases)
- [Changelog](https://github.com/jwtk/jjwt/blob/master/CHANGELOG.md)
- [Commits](jwtk/jjwt@0.12.5...0.13.0)

Updates `io.jsonwebtoken:jjwt-jackson` from 0.12.5 to 0.13.0

Updates `org.springdoc:springdoc-openapi-starter-webmvc-ui` from 2.3.0 to 3.0.3
- [Release notes](https://github.com/springdoc/springdoc-openapi/releases)
- [Changelog](https://github.com/springdoc/springdoc-openapi/blob/v3.0.3/CHANGELOG.md)
- [Commits](springdoc/springdoc-openapi@v2.3.0...v3.0.3)

Updates `org.projectlombok:lombok` from 1.18.30 to 1.18.44
- [Changelog](https://github.com/projectlombok/lombok/blob/master/doc/changelog.markdown)
- [Commits](projectlombok/lombok@v1.18.30...v1.18.44)

Updates `cn.hutool:hutool-all` from 5.8.26 to 5.8.44
- [Release notes](https://github.com/looly/hutool/releases)
- [Changelog](https://github.com/chinabugotech/hutool/blob/v5-master/CHANGELOG.md)
- [Commits](chinabugotech/hutool@5.8.26...v5.8.44)

Updates `org.mapstruct:mapstruct` from 1.5.5.Final to 1.6.3
- [Release notes](https://github.com/mapstruct/mapstruct/releases)
- [Commits](mapstruct/mapstruct@1.5.5.Final...1.6.3)

Updates `org.mapstruct:mapstruct-processor` from 1.5.5.Final to 1.6.3
- [Release notes](https://github.com/mapstruct/mapstruct/releases)
- [Commits](mapstruct/mapstruct@1.5.5.Final...1.6.3)

Updates `org.owasp.encoder:encoder` from 1.3.1 to 1.4.0
- [Release notes](https://github.com/owasp/owasp-java-encoder/releases)
- [Commits](OWASP/owasp-java-encoder@v1.3.1...v1.4.0)

Updates `com.meilisearch.sdk:meilisearch-java` from 0.11.0 to 0.20.0
- [Release notes](https://github.com/meilisearch/meilisearch-java/releases)
- [Commits](meilisearch/meilisearch-java@v0.11.0...v0.20.0)

Updates `com.squareup.okhttp3:okhttp` from 4.12.0 to 5.3.2
- [Changelog](https://github.com/square/okhttp/blob/master/CHANGELOG.md)
- [Commits](lysine-dev/okhttp@parent-4.12.0...parent-5.3.2)

Updates `org.apache.dubbo:dubbo-spring-boot-starter` from 3.2.14 to 3.3.6
- [Release notes](https://github.com/apache/dubbo/releases)
- [Changelog](https://github.com/apache/dubbo/blob/3.3/CHANGES.md)
- [Commits](apache/dubbo@dubbo-3.2.14...dubbo-3.3.6)

Updates `org.apache.dubbo:dubbo-registry-nacos` from 3.2.14 to 3.3.6
- [Release notes](https://github.com/apache/dubbo/releases)
- [Changelog](https://github.com/apache/dubbo/blob/3.3/CHANGES.md)
- [Commits](apache/dubbo@dubbo-3.2.14...dubbo-3.3.6)

Updates `org.mapstruct:mapstruct-processor` from 1.5.5.Final to 1.6.3
- [Release notes](https://github.com/mapstruct/mapstruct/releases)
- [Commits](mapstruct/mapstruct@1.5.5.Final...1.6.3)

---
updated-dependencies:
- dependency-name: org.springframework.boot:spring-boot-starter-parent
  dependency-version: 4.0.5
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-maven
- dependency-name: org.testcontainers:testcontainers-bom
  dependency-version: 2.0.4
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-maven
- dependency-name: com.baomidou:mybatis-plus-spring-boot3-starter
  dependency-version: 3.5.16
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-maven
- dependency-name: org.redisson:redisson-spring-boot-starter
  dependency-version: 4.3.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-maven
- dependency-name: io.jsonwebtoken:jjwt-api
  dependency-version: 0.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-maven
- dependency-name: io.jsonwebtoken:jjwt-impl
  dependency-version: 0.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-maven
- dependency-name: io.jsonwebtoken:jjwt-jackson
  dependency-version: 0.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-maven
- dependency-name: io.jsonwebtoken:jjwt-impl
  dependency-version: 0.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-maven
- dependency-name: io.jsonwebtoken:jjwt-jackson
  dependency-version: 0.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-maven
- dependency-name: org.springdoc:springdoc-openapi-starter-webmvc-ui
  dependency-version: 3.0.3
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-maven
- dependency-name: org.projectlombok:lombok
  dependency-version: 1.18.44
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-maven
- dependency-name: cn.hutool:hutool-all
  dependency-version: 5.8.44
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-maven
- dependency-name: org.mapstruct:mapstruct
  dependency-version: 1.6.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-maven
- dependency-name: org.mapstruct:mapstruct-processor
  dependency-version: 1.6.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-maven
- dependency-name: org.owasp.encoder:encoder
  dependency-version: 1.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-maven
- dependency-name: com.meilisearch.sdk:meilisearch-java
  dependency-version: 0.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-maven
- dependency-name: com.squareup.okhttp3:okhttp
  dependency-version: 5.3.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-maven
- dependency-name: org.apache.dubbo:dubbo-spring-boot-starter
  dependency-version: 3.3.6
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-maven
- dependency-name: org.apache.dubbo:dubbo-registry-nacos
  dependency-version: 3.3.6
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-maven
- dependency-name: org.mapstruct:mapstruct-processor
  dependency-version: 1.6.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-maven
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Apr 18, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: automated, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@DavidHLP

DavidHLP commented Apr 18, 2026

Copy link
Copy Markdown
Owner

Closing: Spring Boot 3.5→4.0 is a major framework migration requiring dedicated planning. Includes breaking changes in Redisson 3→4, OkHttp 4→5, jjwt 0.12→0.13, Dubbo 3.2→3.3, springdoc 2→3, and testcontainers 1→2. Will handle as a separate milestone.

@DavidHLP DavidHLP closed this Apr 18, 2026
@dependabot @github

dependabot Bot commented on behalf of github Apr 18, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/maven/backend-spring/all-maven-884459f2cc branch April 18, 2026 05:42
DavidHLP pushed a commit that referenced this pull request Jun 11, 2026
DavidHLP
fix(achievement): escape MySQL reserved word key, add BadSqlGrammar…
1bc766a 
… handler, compute real progress

Fixes 6 issues from docs/achievement-api-test-report-2026-06-11.md
plus 2 newly-discovered typeHandler bugs (Bug #7, Bug #8) surfaced
during validation.

CRITICAL #1 — escape `key` column via @TableField(value = "`key`")
  - Achievement.java:19 — affects MyBatis-Plus auto-generated column
    lists in selectById / selectPage / selectBatchIds.
  - Without this, every SQL that lists the achievements columns fails
    with 'You have an error in your SQL syntax ... near key,...'.

CRITICAL #2 — escape `key` in @select SQL
  - AchievementMapper.findByKey:24 — WHERE clause now backticks.
  - Fixes admin POST /achievements which called findByKey for dedup.

HIGH #3 — T2b /achievements/{invalid} now returns 404 (was 500)
  - Follows from CRITICAL #1+#2: the BadSqlGrammarException
    no longer fires before the business-level ACHIEVEMENT_NOT_FOUND
    can be raised.

MEDIUM #4 — BadSqlGrammarException → DATABASE_ERROR (50001)
  - GlobalExceptionHandler:227 — new handler preserves root cause
    in server log while returning generic 'Database error' to clients.
  - Pairs with existing MyBatisSystemException / BindingException /
    DataIntegrityViolationException handlers (no fallback to 50000
    'Unknown error').

LOW #5 — getUserAchievements progress is no longer hard-coded to 0
  - AchievementServiceImpl:280 — mirrors getUserProgress logic,
    reads criteria.type from JSON Map, dispatches to SubmissionMapper
    counter.

LOW #6 — re-scoped Javadoc: getUserAchievements and
  getUserProgress are NOT duplicates (verified UserController
  /me/achievements/progress uses the latter). Both serve different
  endpoints with different DTO shapes.

Bug #7 — findAllActive missing JacksonTypeHandler
  - AchievementMapper:46 — @select bypassed @TableField(typeHandler=
    JacksonTypeHandler.class), returning criteria=null.
  - Converted to default method via BaseMapper.selectList.

Bug #8 — findByKey same typeHandler bypass
  - Discovered by AchievementMapperIT (L2) on first run;
    findByKey_criteriaIsDeserializedAsMap failed.
  - AchievementMapper:24 — also converted to default method.
  - Latent: only caller (create) never read criteria.

Refactors
  - M1 (review): getUserAchievements extracted buildProgressDTO helper
    (52 → 16 lines).
  - L1 (review): findAllActive uses LambdaQueryWrapper<Achievement>
    method refs instead of string column names.
  - L3 (review): Javadoc clarified the two service methods.

Tests
  + AchievementMapperSQLGuardTest: 3 reflection-guard tests
    (CRITICAL #1, CRITICAL #2, no @select on findAllActive/findByKey).
  + AchievementMapperIT: 5 Testcontainers MySQL 8.0 IT tests
    verifying JacksonTypeHandler runtime behavior + Bug #7/#8
    regression guards.
  + AchievementServiceTest: 3 progress tests + 2 new mock fields
    (SubmissionMapper, ContestParticipantMapper).
  + GlobalExceptionHandlerTest: 2 BadSqlGrammarException tests.

Validation
  - compile / package: BUILD SUCCESS
  - Unit tests: 36/36 pass
  - Testcontainers IT: 5/5 pass
  - 8 curl integration tests on worktree:9091: all match expected
    HTTP codes (200/400/404/409) and real progress values
    (admin 6 accepted problems → progress=6 for all 3 rows).

Refs: docs/achievement-api-test-report-2026-06-11.md,
      .claude/PRPs/plans/completed/achievement-api-fixes.plan.md,
      .claude/PRPs/reports/achievement-api-fixes-report.md,
      .claude/reviews/achievement-api-fixes-review.md
DavidHLP pushed a commit that referenced this pull request Jun 11, 2026
DavidHLP
Merge branch 'fix/achievement-api': 6 fixes + 2 new bugs from IT vali…
c91adcf 
…dation

Merges the fix/achievement-api worktree changes:
- CRITICAL #1, #2 (MySQL reserved word `key`)
- HIGH #3 (T2b 404)
- MEDIUM #4 (BadSqlGrammarException handler)
- LOW #5 (real progress computation)
- LOW #6 (Javadoc re-scoped)
- Bug #7 (findAllActive typeHandler)
- Bug #8 (findByKey typeHandler, IT-discovered)

M1/L1/L2/L3/L4 from .claude/reviews/achievement-api-fixes-review.md
all addressed. Test coverage: 36 unit + 5 Testcontainers IT.
DavidHLP added a commit that referenced this pull request Jul 3, 2026
@DavidHLP
fix(achievement): escape MySQL reserved word key, add BadSqlGrammar…
0db76f3 
… handler, compute real progress

Fixes 6 issues from docs/achievement-api-test-report-2026-06-11.md
plus 2 newly-discovered typeHandler bugs (Bug #7, Bug #8) surfaced
during validation.

CRITICAL #1 — escape `key` column via @TableField(value = "`key`")
  - Achievement.java:19 — affects MyBatis-Plus auto-generated column
    lists in selectById / selectPage / selectBatchIds.
  - Without this, every SQL that lists the achievements columns fails
    with 'You have an error in your SQL syntax ... near key,...'.

CRITICAL #2 — escape `key` in @select SQL
  - AchievementMapper.findByKey:24 — WHERE clause now backticks.
  - Fixes admin POST /achievements which called findByKey for dedup.

HIGH #3 — T2b /achievements/{invalid} now returns 404 (was 500)
  - Follows from CRITICAL #1+#2: the BadSqlGrammarException
    no longer fires before the business-level ACHIEVEMENT_NOT_FOUND
    can be raised.

MEDIUM #4 — BadSqlGrammarException → DATABASE_ERROR (50001)
  - GlobalExceptionHandler:227 — new handler preserves root cause
    in server log while returning generic 'Database error' to clients.
  - Pairs with existing MyBatisSystemException / BindingException /
    DataIntegrityViolationException handlers (no fallback to 50000
    'Unknown error').

LOW #5 — getUserAchievements progress is no longer hard-coded to 0
  - AchievementServiceImpl:280 — mirrors getUserProgress logic,
    reads criteria.type from JSON Map, dispatches to SubmissionMapper
    counter.

LOW #6 — re-scoped Javadoc: getUserAchievements and
  getUserProgress are NOT duplicates (verified UserController
  /me/achievements/progress uses the latter). Both serve different
  endpoints with different DTO shapes.

Bug #7 — findAllActive missing JacksonTypeHandler
  - AchievementMapper:46 — @select bypassed @TableField(typeHandler=
    JacksonTypeHandler.class), returning criteria=null.
  - Converted to default method via BaseMapper.selectList.

Bug #8 — findByKey same typeHandler bypass
  - Discovered by AchievementMapperIT (L2) on first run;
    findByKey_criteriaIsDeserializedAsMap failed.
  - AchievementMapper:24 — also converted to default method.
  - Latent: only caller (create) never read criteria.

Refactors
  - M1 (review): getUserAchievements extracted buildProgressDTO helper
    (52 → 16 lines).
  - L1 (review): findAllActive uses LambdaQueryWrapper<Achievement>
    method refs instead of string column names.
  - L3 (review): Javadoc clarified the two service methods.

Tests
  + AchievementMapperSQLGuardTest: 3 reflection-guard tests
    (CRITICAL #1, CRITICAL #2, no @select on findAllActive/findByKey).
  + AchievementMapperIT: 5 Testcontainers MySQL 8.0 IT tests
    verifying JacksonTypeHandler runtime behavior + Bug #7/#8
    regression guards.
  + AchievementServiceTest: 3 progress tests + 2 new mock fields
    (SubmissionMapper, ContestParticipantMapper).
  + GlobalExceptionHandlerTest: 2 BadSqlGrammarException tests.

Validation
  - compile / package: BUILD SUCCESS
  - Unit tests: 36/36 pass
  - Testcontainers IT: 5/5 pass
  - 8 curl integration tests on worktree:9091: all match expected
    HTTP codes (200/400/404/409) and real progress values
    (admin 6 accepted problems → progress=6 for all 3 rows).

Refs: docs/achievement-api-test-report-2026-06-11.md,
      .claude/PRPs/plans/completed/achievement-api-fixes.plan.md,
      .claude/PRPs/reports/achievement-api-fixes-report.md,
      .claude/reviews/achievement-api-fixes-review.md
DavidHLP added a commit that referenced this pull request Jul 3, 2026
@DavidHLP
Merge branch 'fix/achievement-api': 6 fixes + 2 new bugs from IT vali…
c5f5f8d 
…dation

Merges the fix/achievement-api worktree changes:
- CRITICAL #1, #2 (MySQL reserved word `key`)
- HIGH #3 (T2b 404)
- MEDIUM #4 (BadSqlGrammarException handler)
- LOW #5 (real progress computation)
- LOW #6 (Javadoc re-scoped)
- Bug #7 (findAllActive typeHandler)
- Bug #8 (findByKey typeHandler, IT-discovered)

M1/L1/L2/L3/L4 from .claude/reviews/achievement-api-fixes-review.md
all addressed. Test coverage: 36 unit + 5 Testcontainers IT.
DavidHLP added a commit that referenced this pull request Jul 10, 2026
@DavidHLP
feat(shared): add submission-status contract package linking verdicts…
e7d6cc5 
… to colors

Architecture review candidate #8:

Create shared/submission-status — the single source of truth linking
sandbox verdicts (DFormVerdict 'Title Case') to badge colors
(SUBMISSION_STATUS_COLOR_MAP UPPERCASE_UNDERSCORE).

Before this module, the two types were unlinked: adding a new verdict
could silently produce a colorless badge. Four verdicts (Output Limit
Exceeded, Presentation Error, System Error, Sandbox Error) had no
color mapping at all.

The contract test (34 assertions) verifies:
- Every DFormVerdict has a status key and a color
- Colors are consistent with the original SUBMISSION_STATUS_COLOR_MAP
  on shared keys
- All status keys are unique and UPPERCASE_UNDERSCORE

Verified: 34 tests pass in 6ms.
DavidHLP added a commit that referenced this pull request Jul 10, 2026
@DavidHLP
feat(console): port i18n key validator from management
fab6e6a 
Console had no validate:i18n-keys pipeline, allowing hardcoded strings
and missing translations to ship silently (asymmetry documented in
AGENTS.md). Port management's check.ts (uses jiti — already in devDeps)
and add check:i18n / validate:i18n-keys npm scripts.

First run surfaced 24 previously-undetected missing keys (translation
debt to resolve separately; the validator is the architectural fix).

Architecture review Card #8 — see /tmp/architecture-review-1783403689.html.
DavidHLP added a commit that referenced this pull request Jul 10, 2026
@DavidHLP
refactor(arch): deepen 6 modules from the 2026-07-08 architecture review
20314b0 
#1 SecurityUtil → CurrentUserProvider port
  - New CurrentUserProvider interface in common/auth/
  - SecurityCurrentUserProvider @component adapter (wraps SecurityContextHolder)
  - 37 files migrated from static SecurityUtil calls to injected interface
  - Eliminates duplicated userId==null guards across controller layer

#2 DashboardMapper+Service → DashboardStatsProjection
  - New DashboardStatsProjection interface + DefaultDashboardStatsProjection
  - Absorbs 7 private sub-aggregators + 6 mapper default methods
  - DashboardService + DashboardServiceImpl deleted
  - DashboardController now injects the projection directly
  - Mirrors ADR-0011 *Projection pattern

#3 AdminCommentService → CommentModerator polymorphic seam
  - New CommentModerator interface with ForumCommentModerator + SolutionCommentModerator
  - AdminCommentServiceImpl refactored to thin router
  - Eliminates 5x duplicated forum/solution type-string switch

#5 SubmissionMapper.calculateStreak → SubmissionStreakCalculator
  - New SubmissionStreakCalculator interface + JdbcSubmissionStreakCalculator
  - Streak algorithm (recursive CTE) now behind a JVM-testable interface
  - 3 production callers redirected + 3 test classes updated

#7 Frontend wrapper cleanup
  - 8 re-export wrapper files deleted (markdown, useTheme, useTypographyDensity, cn)
  - tsconfig path remaps @/lib/utils → @/shared/auth-core/src/utils
  - shared/sidebar-menu cn() consolidated to import from auth-core
  - LOCALE_HEADER_KEY duplicate declarations removed

#8 OAuthService → OAuthClient port + adapters
  - New OAuthClient interface + OAuthTokenResponse/OAuthUserInfo DTOs
  - GithubOAuthClient + GoogleOAuthClient @component adapters
  - OAuthService refactored to thin coordinator (221→195 LoC)
  - 11 unit tests covering dispatch, callback, DB upsert

Production code compiles (BUILD SUCCESS). 53 test compilation errors
from constructor signature changes — mechanical @mock field additions.
Candidates #4 (analytics projections) and #6 (contest.ts split) pending.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@DavidHLP