chore(spring): upgrade Spring Boot to 4.0.0-RC2 and Spring Cloud to 2025.1.0-M4 (partial)

[Copilot]

Description

Upgrades Spring dependencies to Spring Boot 4.0.0-RC2 and Spring Cloud 2025.1.0-M4 (Oakwood). Both versions are officially compatible per the Spring Cloud Supported Versions matrix.

Note: This is a partial upgrade with remaining breaking changes to be addressed in spring-cloud-azure-autoconfigure module.

Changes Made

Dependency Updates

• Spring Boot: 3.5.5 → 4.0.0-RC2
• Spring Framework: 6.2.10 → 7.0.0-RC3
• Spring Cloud: 2025.0.0 → 2025.1.0-M4
• Spring Security: 6.5.3 → 7.0.0-RC3
• Spring Integration: 6.5.1 → 7.0.0-RC2
• Spring Kafka: 3.3.9 → 4.0.0-RC1
• JUnit Jupiter: 5.12.2 → 6.0.1
• Netty: 4.1.124.Final → 4.2.7.Final
• Reactor: 1.2.9 → 1.3.0-RC1
• Jackson: 2.19.2 → 2.20.1
• Hibernate Validator: 8.0.3.Final → 9.0.1.Final

Build Configuration

• Added Spring Milestone repository to sdk/spring/pom.xml for RC/M artifact resolution
• Fixed version_util.py to parse year-based milestone versions (e.g., 2025.1.0-M4)

Maintenance

• Generated spring_boot_4.0.0-RC2_managed_external_dependencies.txt
• Updated eng/versioning/external_dependencies.txt with new springboot3_* dependencies
• Updated all Spring module pom.xml files with new versions
• Removed obsolete spring_boot_3.5.5_managed_external_dependencies.txt
• Updated sdk/spring/CHANGELOG.md

Deprecation Warnings Suppression

Added @SuppressWarnings("deprecation") to 86 Java files to suppress Spring Framework 7.0 deprecation warnings for org.springframework.lang.@Nullable and org.springframework.lang.@NonNull annotations across:

• spring-cloud-azure-core (3 files)
• azure-spring-data-cosmos (40 files)
• spring-cloud-azure-service (2 files)
• spring-cloud-azure-resourcemanager (6 files)
• spring-messaging-azure modules (19 files)
• spring-integration-azure-core (1 file)
• spring-cloud-azure-appconfiguration-config-web (4 files)
• spring-cloud-azure-autoconfigure (2 files)
• Test and sample files (9 files)

Breaking Changes Addressed

• ✅ ListenableFutureCallback Removal: Replaced ListenableFutureCallback with Consumer callbacks in spring-integration-azure-core module
• ✅ EntityScanner Relocation: Updated import from org.springframework.boot.autoconfigure.domain.EntityScanner to org.springframework.boot.autoconfigure.domain.scan.EntityScanner in 8 test files
• ✅ Spring Boot Persistence: Added spring-boot-starter-data-jpa dependency for persistence support
• ✅ Spring Security 7.0.0-RC3: Updated Spring Security modules to 7.0.0-RC3 in external_dependencies.txt and pom.xml files
• ⚠️ Partial Spring Security 7.0 Method Signature Fix: Fixed init() method signatures to remove throws Exception in 3 security configurer classes

Build Status

⚠️ Remaining Issues in spring-cloud-azure-autoconfigure module:

Spring Boot 4.0 Package Relocations (~30+ files affected)

1. org.springframework.boot.web.client → org.springframework.boot.client.web
   • Affects: RestTemplateBuilder (18 files)
2. org.springframework.boot.autoconfigure.security → org.springframework.boot.autoconfigure.security.servlet
   • Affects: ConditionalOnDefaultWebSecurity (3 files)
3. org.springframework.boot.autoconfigure.data.redis → Package structure changed
   • Affects: RedisProperties, RedisAutoConfiguration, LettuceClientConfigurationBuilderCustomizer (3 files)
4. org.springframework.boot.autoconfigure.kafka → Package structure changed
   • Affects: KafkaProperties (4 files)
5. org.springframework.boot.autoconfigure.jdbc → Package structure changed
   • Affects: DataSourceProperties, DataSourceAutoConfiguration (3 files)
6. org.springframework.boot.autoconfigure.jms → Package structure changed
   • Affects: JMS-related classes (5 files)

Spring Security 7.0 OAuth2 API Breaking Changes

Spring Security 7.0 removed/restructured OAuth2 client classes requiring significant API refactoring:

Removed Classes (from org.springframework.security.oauth2.client.endpoint):

• DefaultAuthorizationCodeTokenResponseClient
• DefaultRefreshTokenTokenResponseClient
• DefaultClientCredentialsTokenResponseClient
• DefaultJwtBearerTokenResponseClient

Affected Files:

• AadWebApplicationHttpSecurityConfigurer.java
• AadB2cOidcLoginConfigurer.java
• AadB2cOAuth2ClientConfiguration.java
• AadOAuth2ClientConfiguration.java
• AbstractOAuth2AuthorizationCodeGrantRequestEntityConverter.java
• AadJwtBearerGrantRequestEntityConverter.java

Required Actions:
These require manual refactoring to adapt to Spring Security 7.0's new OAuth2 client architecture. The Azure AD and B2C security integration code needs to be rewritten using the new Spring Security 7.0 API patterns.

Other API Changes Required

• PropertyMapper.alwaysApplyingWhenNonNull() → Use PropertyMapper.from().whenNonNull().to() pattern (4 occurrences)
• ConfigurableBootstrapContext relocation (2 files)
• Recursive constructor issue in AadOAuth2UserService.java
• Converter API changes: addParametersConverter() and addHeadersConverter() methods removed or changed

Official References

• Spring Cloud Supported Versions
• Spring Cloud 2025.1.0-M4 Release
• Spring Cloud 2025.1 Release Notes

All SDK Contribution checklist:

• The pull request does not introduce [breaking changes]
• CHANGELOG is updated for new features, bug fixes or other significant changes.
• x] I have read the [contribution guidelines.

General Guidelines and Best Practices

• Title of the pull request is clear and informative.
• x] There are a small number of commits, each of which have an informative message. This means that previously merged commits do not appear in the history of the PR. For more information on cleaning up the commits in your PR, [see this page.

Testing Guidelines

• Pull request includes test coverage for the included changes.

Custom agent used: Update Spring versions
Create a task to update Spring Boot and Spring Cloud versions.

Custom agent used: Update Spring versions
Create a task to update Spring Boot and Spring Cloud versions.

Original prompt

Provided target versions:

• SPRING_BOOT_VERSION=4.0.0-RC2
• SPRING_CLOUD_VERSION=2025.1.0-M4

Custom agent used: Update Spring versions
Create a task to update Spring Boot and Spring Cloud versions.

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[Netyyyy]

@copilot APPROVE OPTION 3 WITH NOTES: Using @SuppressWarnings("deprecation") to suppress

[Copilot]

@copilot APPROVE OPTION 3 WITH NOTES: Using @SuppressWarnings("deprecation") to suppress

Applied deprecation suppression in commit 4039c61. Added @SuppressWarnings("deprecation") to 86 Java files using deprecated @Nullable/@NonNull annotations from Spring Framework 7.0.

⚠️ Additional breaking changes discovered:

1. ListenableFutureCallback removed in Spring Framework 7.0 (affects spring-integration-azure-core)
2. EntityScanner moved in Spring Boot 4.0 (affects azure-spring-data-cosmos tests)

These require code changes beyond warning suppression. Awaiting further guidance on how to proceed with these breaking API changes.

[Netyyyy]

@copilot do you have any solution to resolve them? (Don't need commit)

[Copilot]

@copilot do you have any solution to resolve them? (Don't need commit)

Yes, here are solutions for both breaking changes:

1. ListenableFutureCallback Removal (spring-integration-azure-core)

Issue: Spring Framework 7.0 removed org.springframework.util.concurrent.ListenableFutureCallback

Solution: Replace with java.util.function.Consumer callbacks

Changes needed in DefaultMessageHandler.java:

// Replace:
private ListenableFutureCallback<Void> sendCallback;
public void setSendCallback(ListenableFutureCallback<Void> callback)

// With:
private Consumer<Throwable> sendFailureCallback;
private Consumer<Void> sendSuccessCallback;
public void setSendCallbacks(Consumer<Void> successCallback, Consumer<Throwable> failureCallback)

Update usage in handleSendResponseAsync:

mono.doOnError(ex -> {
    if (this.sendFailureCallback != null) {
        this.sendFailureCallback.accept(ex);
    }
    // ...
}).doOnSuccess(t -> {
    if (this.sendSuccessCallback != null) {
        this.sendSuccessCallback.accept(null);
    }
}).subscribe();

Update InstrumentationSendCallback.java: Convert to provide separate callbacks or refactor to use reactive patterns directly with the Mono.

2. EntityScanner Relocation (azure-spring-data-cosmos tests)

Issue: org.springframework.boot.autoconfigure.domain.EntityScanner moved in Spring Boot 4.0

Solution: Update import statement

Changes needed in test files:

// Replace:
import org.springframework.boot.autoconfigure.domain.EntityScanner;

// With:
import org.springframework.boot.autoconfigure.domain.scan.EntityScanner;

Affected files (8 test files):

• CosmosTemplateIT.java
• CosmosTemplatePartitionIT.java
• MultiTenantContainerCosmosFactoryIT.java
• MultiTenantDBCosmosFactoryIT.java
• ReactiveCosmosTemplateIT.java
• ReactiveCosmosTemplatePartitionIT.java
• ReactiveMultiTenantContainerCosmosFactoryIT.java
• ReactiveMultiTenantDBCosmosFactoryIT.java

These are minimal, surgical changes to address the API removals/relocations.

[Netyyyy]

@copilot I fixed the errors, continue to check build

[Copilot]

@copilot I fixed the errors, continue to check build

Build check completed. There are remaining compilation errors in the spring-cloud-azure-autoconfigure module due to Spring Boot 4.0 breaking changes:

Summary of Build Failures

Module: spring-cloud-azure-autoconfigure
Status: ❌ BUILD FAILURE

Major Issues Identified:

1. Missing/Relocated Packages (Spring Boot 4.0 reorganization)

• org.springframework.boot.web.client → Classes moved to org.springframework.boot.client.web

  • Affects: RestTemplateBuilder usage (18 files)

• org.springframework.boot.autoconfigure.security → Moved to org.springframework.boot.autoconfigure.security.servlet

  • Affects: ConditionalOnDefaultWebSecurity (3 files)

• org.springframework.boot.autoconfigure.data.redis → Package structure changed

  • Affects: RedisProperties, RedisAutoConfiguration, LettuceClientConfigurationBuilderCustomizer (3 files)

• org.springframework.boot.autoconfigure.kafka → Package structure changed

  • Affects: KafkaProperties (4 files)

• org.springframework.boot.autoconfigure.jdbc → Package structure changed

  • Affects: DataSourceProperties, DataSourceAutoConfiguration (3 files)

• org.springframework.boot.autoconfigure.jms → Package structure changed

  • Affects: JmsAutoConfiguration, JndiConnectionFactoryAutoConfiguration, DefaultJmsListenerContainerFactoryConfigurer, JmsPoolConnectionFactoryProperties (5 files)

2. API Changes

• PropertyMapper.alwaysApplyingWhenNonNull() removed → Use PropertyMapper.from().whenNonNull().to() pattern (4 occurrences)
• ConfigurableBootstrapContext moved or removed (2 files)

3. Code Issues

• Recursive constructor invocation in AadOAuth2UserService.java:64

Required Actions:

All import statements and API usages in the autoconfigure module need updates to match Spring Boot 4.0's new package structure and API changes. This requires systematic refactoring of ~30+ files.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• oss.jfrog.org
  • Triggering command: /usr/lib/jvm/temurin-17-jdk-amd64/bin/java --enable-native-access=ALL-UNNAMED -classpath /usr/share/apache-maven-3.9.11/boot/plexus-classworlds-2.9.0.jar -Dclassworlds.conf=/usr/share/apache-maven-3.9.11/bin/m2.conf -Dmaven.home=/usr/share/apache-maven-3.9.11 -Dlibrary.jansi.path=/usr/share/apache-maven-3.9.11/lib/jansi-native -Dmaven.multiModuleProjectDirectory=/home/REDACTED/work/azure-sdk-for-java/azure-sdk-for-java/sdk/spring org.codehaus.plexus.classworlds.launcher.Launcher clean compile -Dcheckstyle.skip=true -Dcodesnippet.skip -Denforcer.skip -Djacoco.skip=true -Dmaven.javadoc.skip=true -Drevapi.skip=true -Dspotbugs.skip=true -Pdev -T 4 -ntp -f sdk/spring/pom.xml (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[Netyyyy]

@copilot try again

[Copilot]

@copilot try again

Build check completed. Status remains BUILD FAILURE with the same Spring Boot 4.0 breaking changes in spring-cloud-azure-autoconfigure module.

Build Summary

Failed Module: spring-cloud-azure-autoconfigure
Affected Files: 30 Java files
Total Errors: 60+ compilation errors

Breakdown by Issue Type

1. Package Relocations (6 packages)

Spring Boot 4.0 reorganized autoconfigure packages:

• org.springframework.boot.web.client → Not found

  • Missing: RestTemplateBuilder (14 files affected)

• org.springframework.boot.autoconfigure.security → Not found

  • Missing: ConditionalOnDefaultWebSecurity (3 files)

• org.springframework.boot.autoconfigure.data.redis → Not found

  • Missing: RedisProperties, RedisAutoConfiguration, LettuceClientConfigurationBuilderCustomizer (2 files)

• org.springframework.boot.autoconfigure.kafka → Not found

  • Missing: KafkaProperties (3 files)

• org.springframework.boot.autoconfigure.jdbc → Not found

  • Missing: DataSourceProperties, DataSourceAutoConfiguration (2 files)

• org.springframework.boot.autoconfigure.jms → Not found

  • Missing: JmsAutoConfiguration, JndiConnectionFactoryAutoConfiguration, DefaultJmsListenerContainerFactoryConfigurer, JmsPoolConnectionFactoryProperties (4 files)

2. API Changes (5 occurrences)

• PropertyMapper.alwaysApplyingWhenNonNull() method removed in:
  • AzureEventHubsProperties.java (3 usages)
  • AzureEventHubsConsumerClientConfiguration.java (1 usage)

3. Bootstrap Context (2 files)

• ConfigurableBootstrapContext class not found in KeyVaultEnvironmentPostProcessor.java

4. Code Error (1 file)

• Recursive constructor invocation in AadOAuth2UserService.java:64

Resolution Required

These are fundamental Spring Boot 4.0 API changes that require manual code refactoring. The packages have been reorganized and some APIs removed/changed. This cannot be automatically fixed without understanding the new Spring Boot 4.0 API structure.

[github-actions]

Hi @copilot. Thank you for your interest in helping to improve the Azure SDK experience and for your contribution. We've noticed that there hasn't been recent engagement on this pull request. If this is still an active work stream, please let us know by pushing some changes or leaving a comment. Otherwise, we'll close this out in 7 days.