Skip to content

Chore: bump org.springframework.boot from 3.3.10 to 4.0.0#58

Closed
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/gradle/org.springframework.boot-4.0.0
Closed

Chore: bump org.springframework.boot from 3.3.10 to 4.0.0#58
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/gradle/org.springframework.boot-4.0.0

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github Nov 24, 2025

Bumps org.springframework.boot from 3.3.10 to 4.0.0.

Release notes

Sourced from org.springframework.boot's releases.

v4.0.0

Full release notes for Spring Boot 4.0 are available on the wiki. There is also a migration guide to help you upgrade from Spring Boot 3.5.

⭐ New Features

  • Change tomcat and jetty runtime modules to starters #48175
  • Rename spring-boot-kotlin-serialization to align with the name of the Kotlinx module that it pulls in #48076

🐞 Bug Fixes

  • Error properties are a general web concern and should not be located beneath server.* #48201
  • With both Jackson 2 and 3 on the classpath, @JsonTest fails due to duplicate jacksonTesterFactoryBean #48198
  • Gradle war task does not exclude starter POMs from lib-provided #48197
  • spring.test.webclient.mockrestserviceserver.enabled is not aligned with its module's name #48193
  • SslMeterBinder doesn't register metrics for dynamically added bundles if no bundles exist at bind time #48182
  • Properties bound in the child management context ignore the parent's environment prefix #48177
  • ssl.chain.expiry metrics doesn't update for dynamically registered SSL bundles #48171
  • Starter for spring-boot-micrometer-metrics is missing #48161
  • Elasticsearch client's sniffer functionality should not be enabled by default #48155
  • spring-boot-starter-elasticsearch should depend on elasticsearch-java #48141
  • Auto-configuration exclusions are checked using a different class loader to the one that loads auto-configuration classes #48132
  • New arm64 macbooks fail to bootBuildImage due to incorrect platform image #48128
  • Properties for configuring an isolated JsonMapper or ObjectMapper are incorrectly named #48116
  • Buildpack fails with recent Docker installs due to hardcoded version in URL #48103
  • Image building may fail when specifying a platform if an image has already been built with a different platform #48099
  • Default values of Kotlinx Serialization JSON configuration properties are not documented #48097
  • Custom XML converters should override defaults in HttpMessageConverters #48096
  • Kotlin serialization is used too aggressively when other JSON libraries are available #48070
  • PortInUseException incorrectly thrown on failure to bind port due to Netty IP misconfiguration #48059
  • Auto-configured JCacheMetrics cannot be customized #48057
  • WebSecurityCustomizer beans are excluded by WebMvcTest #48055
  • Deprecated EnvironmentPostProcessor does not resolve arguments #48047
  • RetryPolicySettings should refer to maxRetries, not maxAttempts #48023
  • Devtools Restarter does not work with a parameterless main method #47996
  • Dependency management for Kafka should not manage Scala 2.12 libraries #47991
  • spring-boot-mail should depend on jakarta.mail:jakarta.mail-api and org.eclipse.angus:angus-mail instead of org.eclipse.angus:jakarta.mail #47983
  • spring-boot-starter-data-mongodb-reactive has dependency on reactor-test #47982
  • Support for ReactiveElasticsearchClient is in the wrong module #47848

📔 Documentation

  • Removed property spring.test.webclient.register-rest-template is still documented #48199
  • Mention support for detecting AWS ECS in "Deploying to the Cloud" #48170
  • Revise AWS section of "Deploying to the Cloud" in reference manual #48163
  • Fix typo in PortInUseException Javadoc #48134
  • Correct section about required setters in "Type-safe Configuration Properties" #48131
  • Use since attribute in configuration properties deprecation consistently #48122
  • Document EndpointJsonMapper and management.endpoints.jackson.isolated-json-mapper #48115
  • Document support for configuring servlet context init parameters using properties #48112
  • Some configuration properties are not documented in the appendix #48095

... (truncated)

Commits
  • 1c0e08b Release v4.0.0
  • 3487928 Merge branch '3.5.x'
  • 29b8e96 Switch make-default in preparation for Spring Boot 4.0.0
  • 88da0dd Merge branch '3.5.x'
  • 56feeaa Next development version (v3.5.9-SNAPSHOT)
  • 3becdc7 Move server.error properties to spring.web.error
  • 2b30632 Merge branch '3.5.x'
  • 4f03b44 Merge branch '3.4.x' into 3.5.x
  • 3d15c13 Next development version (v3.4.13-SNAPSHOT)
  • dc140df Upgrade to Spring Framework 7.0.1
  • Additional commits viewable in compare view

Dependabot compatibility score

You can trigger a rebase of this PR by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

Bumps [org.springframework.boot](https://github.com/spring-projects/spring-boot) from 3.3.10 to 4.0.0.
- [Release notes](https://github.com/spring-projects/spring-boot/releases)
- [Commits](spring-projects/spring-boot@v3.3.10...v4.0.0)

---
updated-dependencies:
- dependency-name: org.springframework.boot
  dependency-version: 4.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update java code labels Nov 24, 2025
@github-actions
Copy link
Copy Markdown

github-actions Bot commented Nov 24, 2025

PR: #58
Mode: squash
Topic: GH-portal-ng-bff-58
Change-Ids:
I70595db1024a922acb9e09cf151c412e4a9b4849
GitHub-Hash: e774c90ab75ae555

@github-actions
Copy link
Copy Markdown

Change raised in Gerrit by GitHub2Gerrit: https://gerrit.onap.org/r/c/portal-ng/bff/+/142509

@github-actions
Copy link
Copy Markdown

Change raised in Gerrit by GitHub2Gerrit: https://gerrit.onap.org/r/c/portal-ng/bff/+/142837

onap-github pushed a commit that referenced this pull request Apr 23, 2026
Bumps lfreleng-actions/github2gerrit-action from 0.1.22 to 1.0.3.
## Release notes

Sourced from lfreleng-actions/github2gerrit-action's releases.

v1.0.3
Breaking Change

Feat!: GitHub/Gerrit closed loop testing fixes @​ModeSevenIndustrialSolutions (#58)

New Features

Feat!: GitHub/Gerrit closed loop testing fixes @​ModeSevenIndustrialSolutions (#58)

Bug Fixes

Fix: Update PyNaCl to 1.6.2 to fix CVE-2025-69277 @​ModeSevenIndustrialSolutions (#92)

Maintenance

Chore: Bump step-security/harden-runner from 2.13.2 to 2.13.3 @dependabot[bot] (#59)
Chore: Bump actions/checkout from 6.0.0 to 6.0.1 @dependabot[bot] (#61)
Chore: Bump astral-sh/setup-uv from 7.1.4 to 7.1.5 @dependabot[bot] (#60)
Chore: Bump lfit/releng-reusable-workflows/.github/workflows/reuse-verify-github-actions.yaml @dependabot[bot] (#62)
Chore: Bump Python dependencies, fix tests @​ModeSevenIndustrialSolutions (#64)
Chore: pre-commit autoupdate @pre-commit-ci[bot] (#63)
Chore: Bump step-security/harden-runner from 2.13.3 to 2.14.0 @dependabot[bot] (#66)
Chore: Bump actions/download-artifact from 6.0.0 to 7.0.0 @dependabot[bot] (#69)
Chore: Bump lfreleng-actions/python-test-action from 1.0.0 to 1.0.1 @dependabot[bot] (#68)
Chore: pre-commit autoupdate @pre-commit-ci[bot] (#70)
Chore: Bump lfreleng-actions/python-build-action from 0.1.22 to 1.0.0 @dependabot[bot] (#65)
Chore: Bump lfreleng-actions/python-audit-action from 0.2.3 to 0.2.4 @dependabot[bot] (#67)
Chore: Bump anchore/scan-action from 7.2.1 to 7.2.2 @dependabot[bot] (#73)
Chore: Bump actions/upload-artifact from 5.0.0 to 6.0.0 @dependabot[bot] (#72)
Chore: Bump astral-sh/setup-uv from 7.1.5 to 7.1.6 @dependabot[bot] (#71)
Chore: Bump actions/download-artifact from 6.0.0 to 7.0.0 @dependabot[bot] (#75)
Chore: Bump ruff from 0.14.8 to 0.14.10 @dependabot[bot] (#79)
Chore: Bump mypy from 1.19.0 to 1.19.1 @dependabot[bot] (#78)
Chore: Bump typer from 0.20.0 to 0.20.1 @dependabot[bot] (#77)
Chore: Update repository prior to next major code drop @​ModeSevenIndustrialSolutions (#80)
Chore: Bump types-requests from 2.31.0.0 to 2.32.4.20250913 @dependabot[bot] (#84)
Chore: Bump mypy from 1.17.1 to 1.19.1 @dependabot[bot] (#83)
Chore: Bump ruff from 0.6.3 to 0.14.10 @dependabot[bot] (#82)
Chore: Bump lfreleng-actions/pypi-publish-action from 0.1.1 to 0.1.2 @dependabot[bot] (#81)
Chore: pre-commit autoupdate @pre-commit-ci[bot] (#85)
Chore: Bump lfreleng-actions/python-build-action from 1.0.0 to 1.0.1 @dependabot[bot] (#86)
Chore: Bump typer from 0.20.1 to 0.21.0 @dependabot[bot] (#87)
Chore: pre-commit autoupdate @pre-commit-ci[bot] (#91)
Chore: Bump lfreleng-actions/python-audit-action from 0.2.4 to 0.2.5 @dependabot[bot] (#90)
Chore: Bump lfreleng-actions/python-build-action from 1.0.1 to 1.0.2 @dependabot[bot] (#89)
Chore: Bump lfreleng-actions/pypi-publish-action from 0.1.2 to 0.1.3 @dependabot[bot] (#88)
Chore: Bump ruff from 0.14.10 to 0.14.11 @dependabot[bot] (#97)
Chore: Bump typer from 0.21.0 to 0.21.1 @dependabot[bot] (#98)
Chore: Bump lfreleng-actions/repository-metadata-action from 0.1.2 to 0.2.0 @dependabot[bot] (#94)
Chore: Bump lfreleng-actions/tag-validate-action from 0.1.0 to 0.1.2 @dependabot[bot] (#95)

... (truncated)

## Changelog

Sourced from lfreleng-actions/github2gerrit-action's changelog.

Release Notes - v0.2.0
Overview
Version 0.2.0 introduces important behavioral changes and improvements to the
GitHub2Gerrit action. This release includes two breaking changes to default
settings: PRESERVE_GITHUB_PRS now defaults to true (was false) and
SIMILARITY_FILES now defaults to false (was true). These changes make the
default behavior more aligned with common use cases while improving the handling
of push events and commit reconciliation.
Breaking Changes
⚠️ PRESERVE_GITHUB_PRS Default Changed from false to true
Impact: HIGH - This is a breaking change that affects default workflow behavior
Previous Behavior (v0.1.x):

Default: PRESERVE_GITHUB_PRS=&quot;false&quot;
GitHub pull requests closed automatically when the action pushed them to Gerrit
Users had to explicitly set PRESERVE_GITHUB_PRS=&quot;true&quot; to keep PRs open

New Behavior (v0.2.0):

Default: PRESERVE_GITHUB_PRS=&quot;true&quot;
GitHub pull requests now remain open by default when the action pushes them to Gerrit
Users must explicitly set PRESERVE_GITHUB_PRS=&quot;false&quot; to close PRs after submission

Rationale:
We changed the default for these reasons:

Common Use Case: Most projects using this action want to maintain GitHub
PRs as a reference point even after they submit changes to Gerrit
Safer Default: Preserving PRs is a non-destructive operation, making it a safer default behavior
Alignment with Documentation: The README already recommended

PRESERVE_GITHUB_PRS=true as the typical configuration
Two-Way Workflow: The new CLOSE_MERGED_PRS feature (default: true)
closes PRs automatically when maintainers merge Gerrit changes, offering a
complete bidirectional workflow

Migration Guide:
If your workflow relied on the previous default behavior of closing PRs after submission:
&lt;/tr&gt;&lt;/table&gt;

... (truncated)

## Commits

99ac9d4 Merge pull request #108 from lfreleng-actions/dependabot/github_actions/relea
7a642bd Chore: Bump release-drafter/release-drafter from 6.1.0 to 6.1.1
a467010 Merge pull request #107 from lfreleng-actions/pre-commit-ci-update-config
5a19365 Chore: pre-commit autoupdate
b932838 Merge pull request #106 from modeseven-lfreleng-actions/update-workflows
c8814ba CI: Update build-test-release.yaml workflow
fdc10cc Merge pull request #105 from lfreleng-actions/dependabot/github_actions/lfrel
462503b Chore: Bump lfreleng-actions/tag-validate-action from 0.1.2 to 0.3.0
d71030c Merge pull request #104 from lfreleng-actions/dependabot/uv/ruff-0.14.13
10ca98d Chore: Bump ruff from 0.14.11 to 0.14.13
Additional commits viewable in compare view

![Dependabot compatibility score](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Issue-ID: CIMAN-33
Signed-off-by: dependabot[bot] <support@github.com>
Change-Id: I8a5b0671e615fbfa15e68b47dc045fe123ac305c
GitHub-PR: #70
GitHub-Hash: 3d4512ff8d3b1a78
Signed-off-by: onap.gh2gerrit <releng+onap-gh2gerrit@linuxfoundation.org>
@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github May 4, 2026

Superseded by #76.

@dependabot dependabot Bot closed this May 4, 2026
@dependabot dependabot Bot deleted the dependabot/gradle/org.springframework.boot-4.0.0 branch May 4, 2026 21:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file java Pull requests that update java code

Development

Successfully merging this pull request may close these issues.

0 participants