Update Spring Boot to 2.2.x

[php-coder]

Spring Boot 2.2.13:

• https://spring.io/blog/2019/03/08/spring-boot-2-2-m1
• https://spring.io/blog/2019/04/16/spring-boot-2-2-m2
• https://spring.io/blog/2019/05/15/spring-boot-2-2-m3-available-now
• https://spring.io/blog/2019/06/19/spring-boot-2-2-0-m4
• https://spring.io/blog/2019/08/06/spring-boot-2-2-0-m5-available-now
• https://spring.io/blog/2019/09/10/spring-boot-2-2-0-m6
• https://spring.io/blog/2019/10/03/spring-boot-2-2-0-rc1-has-been-released
• https://spring.io/blog/2019/10/16/spring-boot-2-2-0
• https://github.com/spring-projects/spring-boot/wiki/Spring-Boot-2.2-Release-Notes
• https://github.com/spring-projects/spring-boot/wiki/Spring-Boot-2.2.0-Configuration-Changelog
• https://spring.io/blog/2019/11/07/spring-boot-2-2-1-available-now
• https://spring.io/blog/2019/12/06/spring-boot-2-2-2-is-now-available
• https://spring.io/blog/2020/01/16/spring-boot-2-2-3-released
• https://spring.io/blog/2020/01/20/spring-boot-2-2-4-released
• https://spring.io/blog/2020/02/27/spring-boot-2-2-5-released
• https://spring.io/blog/2020/03/26/spring-boot-2-2-6-available-now
• https://spring.io/blog/2020/05/07/spring-boot-2-2-7-available-now
• https://spring.io/blog/2020/06/11/spring-boot-2-2-8-available-now
• https://spring.io/blog/2020/07/24/spring-boot-2-2-9-available-now
• https://spring.io/blog/2020/09/17/spring-boot-2-2-10-available-now
• https://spring.io/blog/2020/10/29/spring-boot-2-2-11-available-now
• https://spring.io/blog/2020/12/10/spring-boot-2-2-12-available-now
• https://spring.io/blog/2021/01/14/spring-boot-2-2-13-available-now
• https://spring.io/blog/2019/03/14/lazy-initialization-in-spring-boot-2-2
• https://medium.com/@TimvanBaarsen/whats-new-in-spring-boot-2-2-dab550f664bb
• https://www.infoq.com/presentations/spring-framework-boot-performance-improvements/ (Spring Boot 2.2 performance gains) (video)
• https://rieckpil.de/review-whats-new-in-spring-boot-2-2/

Spring Framework 5.2.22:

• https://spring.io/blog/2019/04/10/spring-framework-5-2-0-m1-available-now
• https://spring.io/blog/2019/05/10/spring-framework-5-2-0-m2-5-1-7-5-0-14-and-4-3-24-available-now
• https://spring.io/blog/2019/06/13/spring-framework-5-2-0-m3-and-5-1-8-available-now
• https://spring.io/blog/2019/08/05/spring-framework-5-2-goes-rc1
• https://spring.io/blog/2019/09/05/spring-framework-5-2-rc2-available-now
• https://spring.io/blog/2019/09/30/spring-framework-5-2-goes-ga
• https://github.com/spring-projects/spring-framework/wiki/What%27s-New-in-Spring-Framework-5.x#whats-new-in-version-52
• https://github.com/spring-projects/spring-framework/wiki/Upgrading-to-Spring-Framework-5.x#upgrading-to-version-52
• https://www.infoq.com/presentations/spring-framework-5-2/ (video)
• https://spring.io/blog/2019/11/04/spring-framework-5-2-1-and-5-1-11-available-now
• https://spring.io/blog/2019/12/03/spring-framework-5-2-2-and-5-1-12-available-now
• https://spring.io/blog/2020/01/16/spring-framework-5-2-3-5-1-13-5-0-16-and-4-3-26-releases
  • https://tanzu.vmware.com/security/cve-2020-5398
  • https://tanzu.vmware.com/security/cve-2020-5397
• https://spring.io/blog/2020/02/25/spring-framework-5-2-4-and-5-1-14-available-now
• https://spring.io/blog/2020/03/24/spring-framework-5-2-5-available-now
• https://spring.io/blog/2020/04/28/spring-framework-5-2-6-5-1-15-5-0-17-and-4-3-27-available-now
• https://spring.io/blog/2020/06/09/spring-framework-5-2-7-and-5-1-16-available-now
• https://spring.io/blog/2020/07/21/spring-framework-5-2-8-5-1-17-5-0-18-and-4-3-28-available-now
• https://spring.io/blog/2020/09/15/spring-framework-5-2-9-5-1-18-5-0-19-and-4-3-29-available-now
  • https://tanzu.vmware.com/security/cve-2020-5421
• https://spring.io/blog/2020/10/27/spring-framework-5-2-10-and-5-1-19-available-now
• https://spring.io/blog/2020/11/10/spring-framework-5-3-1-and-5-2-11-available-now
• https://spring.io/blog/2020/12/09/spring-framework-5-3-2-5-2-12-5-1-20-5-0-20-and-4-3-30-available-now
• https://spring.io/blog/2021/02/16/spring-framework-5-3-4-and-5-2-13-available-now
• https://spring.io/blog/2021/04/13/spring-framework-5-3-6-and-5-2-14-available-now
• https://spring.io/blog/2021/05/11/spring-framework-5-3-7-and-5-2-15-available-now
  • https://tanzu.vmware.com/security/cve-2021-22118
• https://spring.io/blog/2021/07/14/spring-framework-5-3-9-and-5-2-16-available-now
• https://spring.io/blog/2021/09/15/spring-framework-5-3-10-and-5-2-17-available-now
• https://spring.io/blog/2021/10/14/spring-framework-5-3-11-and-5-2-18-available-now
  • https://tanzu.vmware.com/security/cve-2021-22096
• https://spring.io/blog/2021/12/16/spring-framework-5-3-14-and-5-2-19-available-now
  • https://spring.io/blog/2022/01/05/spring-framework-cve-2021-22060-has-been-published
  • https://tanzu.vmware.com/security/cve-2021-22060
  • https://tanzu.vmware.com/security/cve-2021-22096
• 5.2.20: https://spring.io/blog/2022/03/28/cve-report-published-for-spring-framework
  • https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement
  • https://spring.io/blog/2022/04/01/spring-framework-rce-mitigation-alternative
  • https://tanzu.vmware.com/security/cve-2022-22950
• https://spring.io/blog/2022/04/13/spring-framework-5-3-19-and-5-2-21-available-now
  • https://spring.io/blog/2022/04/13/spring-framework-data-binding-rules-vulnerability-cve-2022-22968
• https://spring.io/blog/2022/05/11/spring-framework-5-3-20-and-5-2-22-available-now
  • https://tanzu.vmware.com/security/cve-2022-22970
  • https://tanzu.vmware.com/security/cve-2022-22971

Spring Security 5.2.15:

• https://github.com/spring-projects/spring-security/releases/tag/5.2.0.M1
• https://spring.io/blog/2019/04/16/spring-security-5-2-0-m2-released
• https://spring.io/blog/2019/06/17/spring-security-5-2-0-m3-released
• https://spring.io/blog/2019/08/05/spring-security-5-2-0-m4-released
• https://spring.io/blog/2019/09/06/spring-security-5-2-0-rc1-released
• https://spring.io/blog/2019/10/01/spring-security-5-2-goes-ga
• https://docs.spring.io/spring-security/site/docs/5.2.0.RELEASE/reference/htmlsingle/#new
• https://spring.io/blog/2019/11/04/spring-security-5-2-1-and-5-1-7-released
• https://spring.io/blog/2020/02/05/spring-security-5-2-2-5-1-8-and-5-0-14-released
• https://spring.io/blog/2020/04/02/spring-security-5-3-1-5-2-3-5-1-9-5-0-15-4-2-15-released
• https://spring.io/blog/2020/05/07/spring-security-5-3-2-5-2-4-5-1-10-5-0-16-4-2-16-released
  • https://spring.io/blog/2020/05/13/cve-reports-published-for-spring-security
  • https://tanzu.vmware.com/security/cve-2020-5407
  • https://tanzu.vmware.com/security/cve-2020-5408
• https://spring.io/blog/2020/06/03/spring-security-5-3-3-5-2-5-5-1-11-5-0-17-4-2-17-released
• https://spring.io/blog/2020/08/12/spring-security-5-3-4-5-2-6-5-1-12-5-0-18-4-2-18-released
• https://spring.io/blog/2020/10/08/spring-security-5-4-1-5-3-5-5-2-7-5-1-13-5-0-19-4-2-19-released
• https://spring.io/blog/2020/12/03/spring-security-5-4-2-5-3-6-and-5-2-8-released
• https://spring.io/blog/2021/02/11/spring-security-5-4-4-5-3-8-and-5-2-9-released
• https://spring.io/blog/2021/04/12/spring-security-5-2-10-5-3-9-and-5-4-6-released
• https://spring.io/blog/2021/06/22/spring-security-5-5-1-5-4-7-5-3-10-and-5-2-11-released
  • https://spring.io/blog/2021/06/28/cve-report-published-for-spring-security
  • https://tanzu.vmware.com/security/cve-2021-22119
• https://github.com/spring-projects/spring-security/releases/tag/5.2.12.RELEASE
• https://github.com/spring-projects/spring-security/releases/tag/5.2.13.RELEASE
• https://github.com/spring-projects/spring-security/releases/tag/5.2.14.RELEASE
• https://spring.io/blog/2021/12/20/spring-security-5-2-15-5-3-13-5-4-10-5-5-4-and-5-6-1-released

Action points:

• JMX is not enabled by default anymore
• migrate dependencies from javax.* to jakarta.*
• use junit5 dependencies from spring-boot-starter-test (?)
• spring-boot-starter-test: revise hamcrest exclusion
• play with and consider enabling lazy initialization, at least for development (it seems faster (-1 second on my laptop), but I had to put @Lazy(false) on ThymeleafViewResolverInitializingBean)
• logging.file -> logging.file.name
• consider using logging.file.name and logging.file.path (resolution: they don't work together, only one is being used: https://stackoverflow.com/questions/29764258/why-doesnt-spring-boot-listen-to-the-logging-path-variable)
• server.use-forward-headers=true -> server.forward-headers-strategy=native
• remove spring.mvc.favicon.enabled
• use @SqlMergeMode from Spring Framework 5.2; decision: don't use it
• SecurityConfig: use nested builders
• update NEWS.txt