Version 2.11.16

• [all]

  • ❗ Dependency on spotbugs-annotations should be optional, follows recommendation from here and is no longer provided as transient dependency. In case you need it, you can add it by yourself in pom.xml:

    <properties>
         <spotbugs.annotations.version>4.6.0</spotbugs.annotations.version>
    </properties>
    ...
    <dependency>
       <groupId>com.github.spotbugs</groupId>
       <artifactId>spotbugs-annotations</artifactId>
       <version>${spotbugs.annotations.version}</version>
    </dependency>

• [spring-xsuaa]

  • ❗ Dependency on javax.annotation-api should be optional and is no longer provided as transient dependency. In case you need it, you can add it by yourself in pom.xml:

    <properties>
         <javax.annotation.version>1.3.2</javax.annotation.version>
    </properties>
    ...
    <dependency>
         <groupId>javax.annotation</groupId>
         <artifactId>javax.annotation-api</artifactId>
         <version>${javax.annotation.version}</version>
     </dependency>

• [java-api] [token-client] Dependency on spotbugs-annotations is now optional

• [java-security] [spring-security] JwtSignatureValidator improvements:

  • Only identity service requires x-zone_uuid header for token keys retrieval
  • in case of signature mismatch the result should expose the signature of the encoded JWT token

• [spring-security]
  Introduces with spring-security-compatibility a compatibility module that provides with XsuaaTokenComp class an option to decorate a token issued by xsuaa to com.sap.cloud.security.xsuaa.token.Token api, which was used in spring-xsuaa.

  • See also Migration Guide and PR #847

Dependency upgrades

• Bump spring-boot-starter-parent version from 2.5.2 to 2.6.6
• Bump reactor-core from 3.4.16 to 3.4.17

Full Changelog: 2.11.15...2.11.16