Upgrading org.springframework:spring-tx 2 to 3

Breaking2.5.6.SEC03 → 3.2.18.RELEASEBreaking3Security15Deprecated2New204Changed113Fixed1025Other129

Full comparison Back to org.springframework:spring-tx

SecurityPrevents the Quartz XSD from being fetched from the Internet.#18281 ↗

BreakingUpgrade verdict

3 breaking changes and 15 security fixes.

In plain terms

Renames HttpHeaders#getIfNotModifiedSince() to getIfModifiedSince().
With Hibernate 4, you can no longer configure per-session entity interceptors through HibernateTransactionManager.
Renames MvcAsyncTask to WebAsyncTask.
The framework no longer downloads the Quartz schema over the network, avoiding external fetches.

Must act Top 5 of 20 that need code or config changes

Drops commons-logging:commons-logging, javax.resource:connector-api, javax.transaction:jta, org.springframework:spring-context.

Installs 3 packages in all (was 7).

What you must change

Breaking3

Renames HttpHeaders#getIfNotModifiedSince() to getIfModifiedSince().

HttpHeaders#getIfNotModifiedSince()HttpHeaders#getIfModifiedSince()

3.2.4.RELEASEGitHub ReleaseSummarizedView source

Removes the ability to set per-session entity interceptors from HibernateTransactionManager for Hibernate 4.

HibernateTransactionManager

3.2.2.RELEASEGitHub ReleaseSummarizedView source

Renames MvcAsyncTask to WebAsyncTask.

MvcAsyncTaskWebAsyncTask

3.2.0.RELEASEGitHub ReleaseSummarizedView source

Security15

Prevents the Quartz XSD from being fetched from the Internet.

3.2.17.RELEASEGitHub ReleaseSummarizedView source

Protects against RFD exploits.

3.2.15.RELEASEGitHub ReleaseSummarizedView source

Fixes an XML input vulnerability based on DTD declaration.

3.2.14.RELEASEGitHub ReleaseSummarizedView source

Fixes a directory traversal vulnerability in static resource handling (CVE-2014-3625).

3.2.12.RELEASEGitHub ReleaseSummarizedView source

Fixes log forging in DispatcherServlet via requestURI.

DispatcherServlet

3.2.9.RELEASEGitHub ReleaseSummarizedView source

Protects against security exploits via system identifier in DTD declarations.

3.2.9.RELEASEGitHub ReleaseSummarizedView source

Fixes XXE vulnerability in Jaxb2RootElementHttpMessageConverter.

Jaxb2RootElementHttpMessageConverter

3.2.8.RELEASEGitHub ReleaseSummarizedView source

Addresses a minor issue with the fix for CVE 2010-1622.

3.2.6.RELEASEGitHub ReleaseSummarizedView source

Fixes security vulnerabilities present in Spring v2.5.6 and v3.2.4.

3.2.6.RELEASEGitHub ReleaseSummarizedView source

Disables processing of external entities in SourceHttpMessageConverter by default.

SourceHttpMessageConverter

3.2.5.RELEASEGitHub ReleaseSummarizedView source

Fixes a potential security risk when using Spring OXM.

3.2.4.RELEASEGitHub ReleaseSummarizedView source

Fixes JavaScriptUtils.javaScriptEscape insufficiently escaping some characters.

o.s.web.util.JavaScriptUtils.javaScriptEscape

3.2.2.RELEASEGitHub ReleaseSummarizedView source

Adds a directory traversal check to ResourceHttpRequestHandler.

ResourceHttpRequestHandler

3.0.6.RELEASEGitHub ReleaseSummarizedView source

Fixes a vulnerability in LocaleChangeInterceptor.

LocaleChangeInterceptor

3.0.6.RELEASEGitHub ReleaseSummarizedView source

Fixes end user access to files in the WEB-INF directory through DispatcherPortlet.

DispatcherPortlet

3.0.5.RELEASEGitHub ReleaseSummarizedView source

Deprecations to plan for

Deprecated2

Considers deprecating queryFor* methods on NamedParameterJdbcTemplate and JdbcTemplate.

NamedParameterJdbcTemplateJdbcTemplatequeryFor*

3.2.2.RELEASEGitHub ReleaseSummarizedView source

Deprecates SimpleJdbcTestUtils in favor of JdbcTestUtils.

SimpleJdbcTestUtilsJdbcTestUtils

3.1.3.RELEASEGitHub ReleaseSummarizedView source

API changes

Generated by DepDelta from published JVM bytecode. Not mixed with prose notes.

added: class DuplicateKeyException extends DataIntegrityViolationException
added: class QueryTimeoutException extends TransientDataAccessException
added: ctor DuplicateKeyException(String)
added: ctor DuplicateKeyException(String, Throwable)
added: ctor EmptyResultDataAccessException(String, int, Throwable)
added: ctor IncorrectResultSizeDataAccessException(String, int, Throwable)
added: ctor IncorrectResultSizeDataAccessException(String, int, int, Throwable)
added: ctor QueryTimeoutException(String)
added: ctor QueryTimeoutException(String, Throwable)

removed: method PersistenceExceptionTranslationPostProcessor.getOrder(): int
removed: method PersistenceExceptionTranslationPostProcessor.postProcessAfterInitialization(Object, String): Object
removed: method PersistenceExceptionTranslationPostProcessor.postProcessBeforeInitialization(Object, String): Object
removed: method PersistenceExceptionTranslationPostProcessor.setBeanClassLoader(ClassLoader): void
changed: class PersistenceExceptionTranslationPostProcessor extends ProxyConfig implements BeanPostProcessor, BeanClassLoaderAware, BeanFactoryAware, Ordered → class PersistenceExceptionTranslationPostProcessor extends AbstractAdvisingBeanPostProcessor implements BeanFactoryAware

added: method PersistenceExceptionTranslationInterceptor.setAlwaysTranslate(boolean): void

changed: interface BootstrapContextAware → interface BootstrapContextAware extends Aware
added: method SpringContextResourceAdapter.createEnvironment(): ConfigurableEnvironment
added: method SpringContextResourceAdapter.equals(Object): boolean
added: method SpringContextResourceAdapter.hashCode(): int

changed: class GenericMessageEndpointManager implements InitializingBean, Lifecycle, DisposableBean → class GenericMessageEndpointManager implements SmartLifecycle, InitializingBean, DisposableBean
added: method AbstractMessageEndpointFactory.createEndpoint(XAResource, long): MessageEndpoint
added: method GenericMessageEndpointManager.getPhase(): int
added: method GenericMessageEndpointManager.isAutoStartup(): boolean
added: method GenericMessageEndpointManager.setPhase(int): void
added: method GenericMessageEndpointManager.stop(Runnable): void

changed: method ResourceAdapterFactoryBean.getObject(): Object → method ResourceAdapterFactoryBean.getObject(): ResourceAdapter

changed: class WorkManagerTaskExecutor extends JndiLocatorSupport implements SchedulingTaskExecutor, AsyncTaskExecutor, WorkManager, BootstrapContextAware, InitializingBean → class WorkManagerTaskExecutor extends JndiLocatorSupport implements SchedulingTaskExecutor, WorkManager, BootstrapContextAware, InitializingBean
changed: method SimpleTaskWorkManager.setAsyncTaskExecutor(TaskExecutor): void → method SimpleTaskWorkManager.setAsyncTaskExecutor(AsyncTaskExecutor): void
added: method WorkManagerTaskExecutor.submit(Callable): Future
added: method WorkManagerTaskExecutor.submit(Runnable): Future

added: method JBossWorkManagerTaskExecutor.setWorkManagerMBeanName(String): void
added: static method JBossWorkManagerUtils.getWorkManager(String): WorkManager

added: method TransactionStatus.flush(): void

added: @interface EnableTransactionManagement
added: abstract class AbstractTransactionManagementConfiguration implements ImportAware
added: class ProxyTransactionManagementConfiguration extends AbstractTransactionManagementConfiguration
added: class TransactionManagementConfigurationSelector extends AdviceModeImportSelector
added: ctor AbstractTransactionManagementConfiguration()
added: ctor AnnotationTransactionAttributeSource(TransactionAnnotationParser[])
added: ctor ProxyTransactionManagementConfiguration()
added: ctor TransactionManagementConfigurationSelector()
added: field AbstractTransactionManagementConfiguration.enableTx: AnnotationAttributes
added: field AbstractTransactionManagementConfiguration.txManager: PlatformTransactionManager
added: interface TransactionManagementConfigurer
added: method AbstractTransactionManagementConfiguration.setImportMetadata(AnnotationMetadata): void
added: method Ejb3TransactionAnnotationParser.equals(Object): boolean
added: method Ejb3TransactionAnnotationParser.hashCode(): int
added: method EnableTransactionManagement.mode(): AdviceMode
added: method EnableTransactionManagement.order(): int
added: method EnableTransactionManagement.proxyTargetClass(): boolean
added: method ProxyTransactionManagementConfiguration.transactionAdvisor(): BeanFactoryTransactionAttributeSourceAdvisor
added: method ProxyTransactionManagementConfiguration.transactionAttributeSource(): TransactionAttributeSource
added: method ProxyTransactionManagementConfiguration.transactionInterceptor(): TransactionInterceptor
added: method SpringTransactionAnnotationParser.equals(Object): boolean
added: method SpringTransactionAnnotationParser.hashCode(): int
added: method TransactionManagementConfigurationSelector.selectImports(AdviceMode): String[]
added: method TransactionManagementConfigurer.annotationDrivenTransactionManager(): PlatformTransactionManager
added: method Transactional.value(): String

removed: static field JtaTransactionManagerBeanDefinitionParser.DEFAULT_TRANSACTION_MANAGER_BEAN_NAME: String
added: abstract class TransactionManagementConfigUtils
added: ctor TransactionManagementConfigUtils()
added: static field TransactionManagementConfigUtils.TRANSACTION_ADVISOR_BEAN_NAME: String
added: static field TransactionManagementConfigUtils.TRANSACTION_ASPECT_BEAN_NAME: String
added: static field TransactionManagementConfigUtils.TRANSACTION_ASPECT_CLASS_NAME: String
added: static field TransactionManagementConfigUtils.TRANSACTION_ASPECT_CONFIGURATION_CLASS_NAME: String

removed: class AttributesTransactionAttributeSource extends AbstractFallbackTransactionAttributeSource implements InitializingBean
removed: ctor AttributesTransactionAttributeSource()
removed: ctor AttributesTransactionAttributeSource(Attributes)
removed: method AttributesTransactionAttributeSource.afterPropertiesSet(): void
removed: method AttributesTransactionAttributeSource.equals(Object): boolean
removed: method AttributesTransactionAttributeSource.findTransactionAttribute(Class): TransactionAttribute
removed: method AttributesTransactionAttributeSource.findTransactionAttribute(Collection): TransactionAttribute
removed: method AttributesTransactionAttributeSource.findTransactionAttribute(Method): TransactionAttribute
removed: method AttributesTransactionAttributeSource.hashCode(): int
removed: method AttributesTransactionAttributeSource.setAttributes(Attributes): void
removed: method DelegatingTransactionAttribute.equals(Object): boolean
removed: method DelegatingTransactionAttribute.getIsolationLevel(): int
removed: method DelegatingTransactionAttribute.getName(): String
removed: method DelegatingTransactionAttribute.getPropagationBehavior(): int
removed: method DelegatingTransactionAttribute.getTimeout(): int
removed: method DelegatingTransactionAttribute.hashCode(): int
removed: method DelegatingTransactionAttribute.isReadOnly(): boolean
removed: method DelegatingTransactionAttribute.toString(): String
changed: abstract class DelegatingTransactionAttribute implements TransactionAttribute, Serializable → abstract class DelegatingTransactionAttribute extends DelegatingTransactionDefinition implements TransactionAttribute, Serializable
changed: abstract class TransactionAspectSupport implements InitializingBean → abstract class TransactionAspectSupport implements BeanFactoryAware, InitializingBean
changed: class TransactionAspectSupport.TransactionInfo → final class TransactionAspectSupport.TransactionInfo
changed: class TransactionProxyFactoryBean extends AbstractSingletonProxyFactoryBean implements FactoryBean, BeanFactoryAware → class TransactionProxyFactoryBean extends AbstractSingletonProxyFactoryBean implements BeanFactoryAware
changed: ctor TransactionAspectSupport.TransactionInfo(TransactionAspectSupport, TransactionAttribute, String) → ctor TransactionAspectSupport.TransactionInfo(TransactionAspectSupport, PlatformTransactionManager, TransactionAttribute, String)
changed: method TransactionAspectSupport.createTransactionIfNecessary(TransactionAttribute, String): TransactionAspectSupport.TransactionInfo → method TransactionAspectSupport.createTransactionIfNecessary(PlatformTransactionManager, TransactionAttribute, String): TransactionAspectSupport.TransactionInfo
changed: method TransactionAspectSupport.prepareTransactionInfo(TransactionAttribute, String, TransactionStatus): TransactionAspectSupport.TransactionInfo → method TransactionAspectSupport.prepareTransactionInfo(PlatformTransactionManager, TransactionAttribute, String, TransactionStatus): TransactionAspectSupport.TransactionInfo
added: abstract class TransactionAspectUtils
added: ctor TransactionAspectUtils()
added: interface TransactionAspectSupport.InvocationCallback
added: method DefaultTransactionAttribute.getAttributeDescription(): StringBuilder
added: method DefaultTransactionAttribute.getQualifier(): String
added: method DefaultTransactionAttribute.setQualifier(String): void
added: method DelegatingTransactionAttribute.getQualifier(): String
added: method TransactionAspectSupport.InvocationCallback.proceedWithInvocation(): Object
added: method TransactionAspectSupport.TransactionInfo.getTransactionManager(): PlatformTransactionManager
added: method TransactionAspectSupport.determineTransactionManager(TransactionAttribute): PlatformTransactionManager
added: method TransactionAspectSupport.getBeanFactory(): BeanFactory
added: method TransactionAspectSupport.getTransactionManagerBeanName(): String
added: method TransactionAspectSupport.invokeWithinTransaction(Method, Class, TransactionAspectSupport.InvocationCallback): Object
added: method TransactionAspectSupport.methodIdentification(Method, Class): String
added: method TransactionAspectSupport.setBeanFactory(BeanFactory): void
added: method TransactionAspectSupport.setTransactionManagerBeanName(String): void
added: method TransactionAttribute.getQualifier(): String
added: static method TransactionAspectUtils.getTransactionManager(BeanFactory, String): PlatformTransactionManager
added: static method TransactionAspectUtils.getTransactionManager(ConfigurableListableBeanFactory, String): PlatformTransactionManager

removed: class JotmFactoryBean implements FactoryBean, DisposableBean
removed: class WebSphereTransactionManagerFactoryBean implements FactoryBean
removed: ctor JotmFactoryBean()
removed: ctor WebSphereTransactionManagerFactoryBean()
removed: field WebSphereTransactionManagerFactoryBean.logger: Log
removed: method JotmFactoryBean.destroy(): void
removed: method JotmFactoryBean.getJotm(): Jotm
removed: method JotmFactoryBean.getObject(): Object
removed: method JotmFactoryBean.getObjectType(): Class
removed: method JotmFactoryBean.isSingleton(): boolean
removed: method JotmFactoryBean.setDefaultTimeout(int): void
removed: method WebSphereTransactionManagerFactoryBean.getObject(): Object
removed: method WebSphereTransactionManagerFactoryBean.getObjectType(): Class
removed: method WebSphereTransactionManagerFactoryBean.isSingleton(): boolean
added: class ManagedTransactionAdapter implements Transaction
added: ctor ManagedTransactionAdapter(TransactionManager)
added: method JtaTransactionManager.supportsResourceAdapterManagedTransactions(): boolean
added: method JtaTransactionObject.flush(): void
added: method ManagedTransactionAdapter.commit(): void
added: method ManagedTransactionAdapter.delistResource(XAResource, int): boolean
added: method ManagedTransactionAdapter.enlistResource(XAResource): boolean
added: method ManagedTransactionAdapter.getStatus(): int
added: method ManagedTransactionAdapter.getTransactionManager(): TransactionManager
added: method ManagedTransactionAdapter.registerSynchronization(Synchronization): void
added: method ManagedTransactionAdapter.rollback(): void
added: method ManagedTransactionAdapter.setRollbackOnly(): void
added: method SimpleTransactionFactory.supportsResourceAdapterManagedTransactions(): boolean
added: method TransactionFactory.supportsResourceAdapterManagedTransactions(): boolean
added: method WebSphereUowTransactionManager.lookupDefaultUowManager(): UOWManager
added: method WebSphereUowTransactionManager.supportsResourceAdapterManagedTransactions(): boolean

changed: class ResourceHolderSynchronization implements TransactionSynchronization → abstract class ResourceHolderSynchronization implements TransactionSynchronization
changed: method DefaultTransactionDefinition.getDefinitionDescription(): StringBuffer → method DefaultTransactionDefinition.getDefinitionDescription(): StringBuilder
added: abstract class DelegatingTransactionDefinition implements TransactionDefinition, Serializable
added: ctor DelegatingTransactionDefinition(TransactionDefinition)
added: method AbstractPlatformTransactionManager.prepareSynchronization(DefaultTransactionStatus, TransactionDefinition): void
added: method AbstractPlatformTransactionManager.prepareTransactionStatus(TransactionDefinition, Object, boolean, boolean, boolean, Object): DefaultTransactionStatus
added: method AbstractTransactionStatus.flush(): void
added: method DefaultTransactionStatus.flush(): void
added: method DelegatingTransactionDefinition.equals(Object): boolean
added: method DelegatingTransactionDefinition.getIsolationLevel(): int
added: method DelegatingTransactionDefinition.getName(): String
added: method DelegatingTransactionDefinition.getPropagationBehavior(): int
added: method DelegatingTransactionDefinition.getTimeout(): int
added: method DelegatingTransactionDefinition.hashCode(): int
added: method DelegatingTransactionDefinition.isReadOnly(): boolean
added: method DelegatingTransactionDefinition.toString(): String
added: method ResourceHolderSynchronization.flush(): void
added: method ResourceHolderSynchronization.flushResource(ResourceHolder): void
added: method ResourceHolderSynchronization.shouldReleaseAfterCompletion(ResourceHolder): boolean
added: method SmartTransactionObject.flush(): void
added: method TransactionSynchronization.flush(): void
added: method TransactionSynchronizationAdapter.flush(): void
added: static method TransactionSynchronizationUtils.triggerFlush(): void