automatic project update for v8.4.0

.devcontainer/devcontainer.json

@@ -13,7 +13,7 @@
       // maven and gradle wrappers are used by default, we don't need them installed globally
       // "INSTALL_MAVEN": "false",
       // "INSTALL_GRADLE": "true",
-      "NODE_VERSION": "20.12.1"
+      "NODE_VERSION": "20.12.2"
     }
   },
 

.yo-rc.json

@@ -27,7 +27,7 @@
     "gradleEnterpriseHost": "https://ge.jhipster.tech",
     "hibernateCache": "ehcache",
     "jhiPrefix": "jhi",
-    "jhipsterVersion": "8.3.0",
+    "jhipsterVersion": "8.4.0",
     "languages": ["en"],
     "messageBroker": false,
     "nativeLanguage": "en",

README.md

@@ -1,6 +1,6 @@
 # jhipsterGradleSampleApplication
 
-This application was generated using JHipster 8.3.0, you can find documentation and help at [https://www.jhipster.tech/documentation-archive/v8.3.0](https://www.jhipster.tech/documentation-archive/v8.3.0).
+This application was generated using JHipster 8.4.0, you can find documentation and help at [https://www.jhipster.tech/documentation-archive/v8.4.0](https://www.jhipster.tech/documentation-archive/v8.4.0).
 
 ## Project Structure
 
@@ -256,13 +256,13 @@ For more information refer to [Using Docker and Docker-Compose][], this page als
 To configure CI for your project, run the ci-cd sub-generator (`jhipster ci-cd`), this will let you generate configuration files for a number of Continuous Integration systems. Consult the [Setting up Continuous Integration][] page for more information.
 
 [JHipster Homepage and latest documentation]: https://www.jhipster.tech
-[JHipster 8.3.0 archive]: https://www.jhipster.tech/documentation-archive/v8.3.0
-[Using JHipster in development]: https://www.jhipster.tech/documentation-archive/v8.3.0/development/
-[Using Docker and Docker-Compose]: https://www.jhipster.tech/documentation-archive/v8.3.0/docker-compose
-[Using JHipster in production]: https://www.jhipster.tech/documentation-archive/v8.3.0/production/
-[Running tests page]: https://www.jhipster.tech/documentation-archive/v8.3.0/running-tests/
-[Code quality page]: https://www.jhipster.tech/documentation-archive/v8.3.0/code-quality/
-[Setting up Continuous Integration]: https://www.jhipster.tech/documentation-archive/v8.3.0/setting-up-ci/
+[JHipster 8.4.0 archive]: https://www.jhipster.tech/documentation-archive/v8.4.0
+[Using JHipster in development]: https://www.jhipster.tech/documentation-archive/v8.4.0/development/
+[Using Docker and Docker-Compose]: https://www.jhipster.tech/documentation-archive/v8.4.0/docker-compose
+[Using JHipster in production]: https://www.jhipster.tech/documentation-archive/v8.4.0/production/
+[Running tests page]: https://www.jhipster.tech/documentation-archive/v8.4.0/running-tests/
+[Code quality page]: https://www.jhipster.tech/documentation-archive/v8.4.0/code-quality/
+[Setting up Continuous Integration]: https://www.jhipster.tech/documentation-archive/v8.4.0/setting-up-ci/
 [Node.js]: https://nodejs.org/
 [NPM]: https://www.npmjs.com/
 [Webpack]: https://webpack.github.io/

buildSrc/gradle/libs.versions.toml

@@ -1,6 +1,6 @@
 [versions]
-gatling-plugin = "3.10.5.1"
-gatling-highcharts = "3.10.5"
+gatling-plugin = "3.11.1"
+gatling-highcharts = "3.11.1"
 # jhipster-needle-gradle-dependency-catalog-version - JHipster will add additional versions for convention plugins heref
 # jhipster-needle-gradle-build-src-dependency-catalog-version - Deprecated: JHipster will add additional versions for convention plugins here
 

buildSrc/src/main/groovy/jhipster.gatling-conventions.gradle

@@ -13,5 +13,5 @@ sourceSets {
 }
 
 gatling {
-    simulations = { include "**/*Test*.java" }
+    includes = ["**/*Test*.java"]
 }

buildSrc/src/main/groovy/jhipster.node-gradle-conventions.gradle

@@ -4,8 +4,8 @@ plugins {
 
 if (project.hasProperty("nodeInstall")) {
     node {
-        version = "20.12.1"
-        npmVersion = "10.5.1"
+        version = "20.12.2"
+        npmVersion = "10.6.0"
         download = true
     }
 

gradle.properties

@@ -3,17 +3,17 @@ profile=dev
 
 # Dependency versions
 mapstructVersion=1.5.5.Final
-archunitJunit5Version=1.2.1
+archunitJunit5Version=1.3.0
 
 # gradle plugin version
-gitPropertiesPluginVersion=2.4.1
-gradleEnterprisePluginVersion=3.17
-gradleCommonCustomUserDataPluginVersion=2.0
+gitPropertiesPluginVersion=2.4.2
+gradleEnterprisePluginVersion=3.17.2
+gradleCommonCustomUserDataPluginVersion=2.0.1
 
 ## Install and use a local version of node and npm.
 nodeInstall
 liquibaseTaskPrefix=liquibase
-liquibasePluginVersion=2.2.1
+liquibasePluginVersion=2.2.2
 # jhipster-needle-gradle-property - JHipster will add additional properties here
 
 ## below are some of the gradle performance improvement settings that can be used as required, these are not enabled by default

gradle/libs.versions.toml

@@ -1,15 +1,15 @@
 [versions]
-gatling-plugin = "3.10.5.1"
-gatling-highcharts = "3.10.5"
+gatling-plugin = "3.11.1"
+gatling-highcharts = "3.11.1"
 jacoco = "0.8.12"
-checkstyle = "10.15.0"
+checkstyle = "10.16.0"
 # jhipster-needle-gradle-dependency-catalog-version - JHipster will add additional versions for convention plugins heref
 
 [libraries]
-jhipster-framework = { module = "tech.jhipster:jhipster-framework", version = "8.3.0" }
+jhipster-framework = { module = "tech.jhipster:jhipster-framework", version = "8.4.0" }
 springdoc-openapi-starter-webmvc-api = { module = "org.springdoc:springdoc-openapi-starter-webmvc-api", version = "2.5.0" }
 # jhipster-needle-gradle-dependency-catalog-libraries - JHipster will add additional libraries versions
 
 [plugins]
-spring-boot = { id = "org.springframework.boot", version = "3.2.4" }
+spring-boot = { id = "org.springframework.boot", version = "3.2.5" }
 # jhipster-needle-gradle-dependency-catalog-plugins - JHipster will add additional plugins versions

gradle/profile_dev.gradle

@@ -70,7 +70,7 @@ processResources {
             it.replace("#project.version#", version)
         }
         filter {
-            it.replace("#spring.profiles.active#", springProfiles)
+            it.replace("@spring.profiles.active@", springProfiles)
         }
     }
 }

gradle/profile_prod.gradle

@@ -41,7 +41,7 @@ processResources {
             it.replace("#project.version#", version)
         }
         filter {
-            it.replace("#spring.profiles.active#", springProfiles)
+            it.replace("@spring.profiles.active@", springProfiles)
         }
     }
 }

package.json

@@ -83,14 +83,14 @@
     "packaging": "jar"
   },
   "dependencies": {
-    "@angular/common": "17.3.3",
-    "@angular/compiler": "17.3.3",
-    "@angular/core": "17.3.3",
-    "@angular/forms": "17.3.3",
-    "@angular/localize": "17.3.3",
-    "@angular/platform-browser": "17.3.3",
-    "@angular/platform-browser-dynamic": "17.3.3",
-    "@angular/router": "17.3.3",
+    "@angular/common": "17.3.6",
+    "@angular/compiler": "17.3.6",
+    "@angular/core": "17.3.6",
+    "@angular/forms": "17.3.6",
+    "@angular/localize": "17.3.6",
+    "@angular/platform-browser": "17.3.6",
+    "@angular/platform-browser-dynamic": "17.3.6",
+    "@angular/router": "17.3.6",
     "@fortawesome/angular-fontawesome": "0.14.1",
     "@fortawesome/fontawesome-svg-core": "6.5.2",
     "@fortawesome/free-solid-svg-icons": "6.5.2",
@@ -99,7 +99,7 @@
     "@ngx-translate/http-loader": "8.0.0",
     "@popperjs/core": "2.11.8",
     "bootstrap": "5.3.3",
-    "dayjs": "1.11.10",
+    "dayjs": "1.11.11",
     "ngx-infinite-scroll": "17.0.0",
     "rxjs": "7.8.1",
     "tslib": "2.6.2",
@@ -108,52 +108,52 @@
   "devDependencies": {
     "@angular-builders/custom-webpack": "17.0.2",
     "@angular-builders/jest": "17.0.3",
-    "@angular-devkit/build-angular": "17.3.3",
+    "@angular-devkit/build-angular": "17.3.6",
     "@angular-eslint/eslint-plugin": "17.3.0",
-    "@angular/cli": "17.3.3",
-    "@angular/compiler-cli": "17.3.3",
-    "@angular/service-worker": "17.3.3",
+    "@angular/cli": "17.3.6",
+    "@angular/compiler-cli": "17.3.6",
+    "@angular/service-worker": "17.3.6",
     "@types/jest": "29.5.12",
     "@types/node": "20.11.25",
-    "@typescript-eslint/eslint-plugin": "7.6.0",
-    "@typescript-eslint/parser": "7.6.0",
+    "@typescript-eslint/eslint-plugin": "7.7.1",
+    "@typescript-eslint/parser": "7.7.1",
     "browser-sync": "3.0.2",
     "browser-sync-webpack-plugin": "2.3.0",
     "buffer": "6.0.3",
     "concurrently": "8.2.2",
     "copy-webpack-plugin": "12.0.2",
-    "cypress": "13.7.2",
+    "cypress": "13.8.1",
     "cypress-audit": "1.1.0",
     "eslint": "8.57.0",
     "eslint-config-prettier": "9.1.0",
-    "eslint-plugin-cypress": "2.15.1",
+    "eslint-plugin-cypress": "3.0.2",
     "eslint-webpack-plugin": "4.1.0",
     "folder-hash": "4.0.4",
-    "generator-jhipster": "8.3.0",
+    "generator-jhipster": "8.4.0",
     "husky": "9.0.11",
     "jest": "29.7.0",
-    "jest-date-mock": "1.0.9",
+    "jest-date-mock": "1.0.10",
     "jest-environment-jsdom": "29.7.0",
     "jest-junit": "16.0.0",
     "jest-preset-angular": "14.0.3",
     "jest-sonar": "0.2.16",
-    "lighthouse": "11.7.0",
+    "lighthouse": "12.0.0",
     "lint-staged": "15.2.2",
     "merge-jsons-webpack-plugin": "2.0.1",
     "prettier": "3.2.5",
     "prettier-plugin-java": "2.6.0",
-    "prettier-plugin-packagejson": "2.4.14",
+    "prettier-plugin-packagejson": "2.5.0",
     "rimraf": "5.0.5",
-    "swagger-ui-dist": "5.13.0",
+    "swagger-ui-dist": "5.17.2",
     "ts-jest": "29.1.2",
-    "typescript": "5.4.4",
+    "typescript": "5.4.5",
     "wait-on": "7.2.0",
-    "webpack-bundle-analyzer": "4.10.1",
+    "webpack-bundle-analyzer": "4.10.2",
     "webpack-merge": "5.10.0",
     "webpack-notifier": "1.15.0"
   },
   "engines": {
-    "node": ">=20.12.1"
+    "node": ">=20.12.2"
   },
   "cacheDirectories": [
     "node_modules"

src/main/docker/monitoring.yml

@@ -2,7 +2,7 @@
 name: jhipstergradlesampleapplication
 services:
   prometheus:
-    image: prom/prometheus:v2.51.1
+    image: prom/prometheus:v2.51.2
     volumes:
       - ./prometheus/:/etc/prometheus/
     command:
@@ -15,7 +15,7 @@ services:
     # grafana/provisioning/datasources/datasource.yml
     network_mode: 'host' # to test locally running service
   grafana:
-    image: grafana/grafana:10.4.1
+    image: grafana/grafana:10.4.2
     volumes:
       - ./grafana/provisioning/:/etc/grafana/provisioning/
     environment:

src/main/docker/sonar.yml

@@ -3,7 +3,7 @@ name: jhipstergradlesampleapplication
 services:
   sonar:
     container_name: sonarqube
-    image: sonarqube:10.4.1-community
+    image: sonarqube:10.5.0-community
     # Forced authentication redirect for UI is turned off for out of the box experience while trying out SonarQube
     # For real use cases delete SONAR_FORCEAUTHENTICATION variable or set SONAR_FORCEAUTHENTICATION=true
     environment:

src/main/java/io/github/jhipster/sample/GeneratedByJHipster.java

@@ -6,7 +6,7 @@
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;
 
-@Generated(value = "JHipster", comments = "Generated by JHipster 8.3.0")
+@Generated(value = "JHipster", comments = "Generated by JHipster 8.4.0")
 @Retention(RetentionPolicy.SOURCE)
 @Target({ ElementType.TYPE })
 public @interface GeneratedByJHipster {

src/main/java/io/github/jhipster/sample/config/SecurityConfiguration.java

@@ -5,6 +5,9 @@
 
 import io.github.jhipster.sample.security.*;
 import io.github.jhipster.sample.web.filter.SpaWebFilter;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import java.util.function.Supplier;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.core.env.Environment;
@@ -20,11 +23,11 @@
 import org.springframework.security.web.authentication.RememberMeServices;
 import org.springframework.security.web.authentication.logout.HttpStatusReturningLogoutSuccessHandler;
 import org.springframework.security.web.authentication.www.BasicAuthenticationFilter;
-import org.springframework.security.web.csrf.CookieCsrfTokenRepository;
-import org.springframework.security.web.csrf.CsrfTokenRequestAttributeHandler;
+import org.springframework.security.web.csrf.*;
 import org.springframework.security.web.header.writers.ReferrerPolicyHeaderWriter;
 import org.springframework.security.web.servlet.util.matcher.MvcRequestMatcher;
 import org.springframework.security.web.util.matcher.OrRequestMatcher;
+import org.springframework.util.StringUtils;
 import org.springframework.web.servlet.handler.HandlerMappingIntrospector;
 import tech.jhipster.config.JHipsterConstants;
 import tech.jhipster.config.JHipsterProperties;
@@ -55,11 +58,12 @@ public PasswordEncoder passwordEncoder() {
     public SecurityFilterChain filterChain(HttpSecurity http, MvcRequestMatcher.Builder mvc) throws Exception {
         http
             .cors(withDefaults())
-            .csrf(csrf ->
-                csrf
-                    .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())
-                    // See https://stackoverflow.com/q/74447118/65681
-                    .csrfTokenRequestHandler(new CsrfTokenRequestAttributeHandler()))
+            .csrf(
+                csrf ->
+                    csrf
+                        .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())
+                        .csrfTokenRequestHandler(new SpaCsrfTokenRequestHandler())
+            )
             .addFilterAfter(new SpaWebFilter(), BasicAuthenticationFilter.class)
             .addFilterAfter(new CookieCsrfFilter(), BasicAuthenticationFilter.class)
             .headers(
@@ -139,4 +143,45 @@ public SecurityFilterChain filterChain(HttpSecurity http, MvcRequestMatcher.Buil
     MvcRequestMatcher.Builder mvc(HandlerMappingIntrospector introspector) {
         return new MvcRequestMatcher.Builder(introspector);
     }
+
+    /**
+     * Custom CSRF handler to provide BREACH protection.
+     *
+     * @see <a href="https://docs.spring.io/spring-security/reference/servlet/exploits/csrf.html#csrf-integration-javascript-spa">Spring Security Documentation - Integrating with CSRF Protection</a>
+     * @see <a href="https://github.com/jhipster/generator-jhipster/pull/25907">JHipster - use customized SpaCsrfTokenRequestHandler to handle CSRF token</a>
+     * @see <a href="https://stackoverflow.com/q/74447118/65681">CSRF protection not working with Spring Security 6</a>
+     */
+    static final class SpaCsrfTokenRequestHandler extends CsrfTokenRequestAttributeHandler {
+
+        private final CsrfTokenRequestHandler delegate = new XorCsrfTokenRequestAttributeHandler();
+
+        @Override
+        public void handle(HttpServletRequest request, HttpServletResponse response, Supplier<CsrfToken> csrfToken) {
+            /*
+             * Always use XorCsrfTokenRequestAttributeHandler to provide BREACH protection of
+             * the CsrfToken when it is rendered in the response body.
+             */
+            this.delegate.handle(request, response, csrfToken);
+        }
+
+        @Override
+        public String resolveCsrfTokenValue(HttpServletRequest request, CsrfToken csrfToken) {
+            /*
+             * If the request contains a request header, use CsrfTokenRequestAttributeHandler
+             * to resolve the CsrfToken. This applies when a single-page application includes
+             * the header value automatically, which was obtained via a cookie containing the
+             * raw CsrfToken.
+             */
+            if (StringUtils.hasText(request.getHeader(csrfToken.getHeaderName()))) {
+                return super.resolveCsrfTokenValue(request, csrfToken);
+            }
+            /*
+             * In all other cases (e.g. if the request contains a request parameter), use
+             * XorCsrfTokenRequestAttributeHandler to resolve the CsrfToken. This applies
+             * when a server-side rendered form includes the _csrf request parameter as a
+             * hidden input.
+             */
+            return this.delegate.resolveCsrfTokenValue(request, csrfToken);
+        }
+    }
 }

src/main/resources/config/application.yml

@@ -95,7 +95,7 @@ spring:
     # The commented value for `active` can be replaced with valid Spring profiles to load.
     # Otherwise, it will be filled in by gradle when building the JAR file
     # Either way, it can be overridden by `--spring.profiles.active` value passed in the commandline or `-Dspring.profiles.active` set in `JAVA_OPTS`
-    active: #spring.profiles.active#
+    active: '@spring.profiles.active@'
     group:
       dev:
         - dev