jdaugherty opened a new pull request, #15985:
URL: https://github.com/apache/grails-core/pull/15985
## Description
Restores Undertow as an embedded servlet container option for Grails 8.
Spring Boot 4 removed its Undertow support (`spring-boot-starter-undertow`)
before GA because
Undertow did not yet support Servlet 6.1, which Spring Boot 4 requires.
Undertow has since shipped
Servlet 6.1 support (`io.undertow:undertow-core` 2.4.x plus the new
`io.undertow.ee` servlet and
websockets artifacts). This PR brings that support back to Grails:
- **`grails-undertow-spring-boot`** (`grails-undertow/spring-boot`): the
`spring-boot-undertow`
module vendored from Spring Boot 4.0.0-M1 (the last tag it existed in),
repackaged as
`org.apache.grails.undertow.core` and adapted to the Spring Boot 4.1 APIs.
Spring Framework 7
removed the reactive Undertow bridge classes (`UndertowHttpHandlerAdapter`
et al.), so those are
vendored from Spring Framework 6.2.19 and adapted. Per-file Spring license
headers are retained,
a module `META-INF/NOTICE` is included, the root `NOTICE` is updated, and
the upstream source
URLs are recorded in `build.gradle` (same approach as the vendored Spring
ORM Hibernate 5 support).
- **`grails-undertow`** (`grails-undertow/plugin`, package
`org.apache.grails.undertow.plugin`):
a Grails plugin that puts the vendored Undertow web server support and its
dependencies on the
application classpath, so switching containers is a single dependency:
`implementation 'org.apache.grails:grails-undertow'`.
- **Grails Forge**: the Undertow servlet feature is re-enabled and renamed
`grails-undertow`
(previously hidden and rejected with an error); `--servlet=undertow` works
again and applies the
new plugin. The fail-fast rejection in `ContextFactory` is removed.
- **BOM / dependency management**: `undertow.version` (2.4.2.Final),
`undertow-servlet.version` and
`undertow-websockets.version` (2.0.1.Final, `io.undertow.ee`) are pinned
in `dependencies.gradle`;
both new modules are published and managed by `grails-bom`. Spring Boot 4
no longer manages
Undertow, so these pins are required.
- **Security note**: `server.undertow.max-http-post-size` defaults to 2MB,
matching Undertow 2.4's
hardened `DEFAULT_MAX_ENTITY_SIZE` (CVE-2024-3884, CVE-2024-4027). A
non-positive value is still
honored as an explicit opt-out to unlimited. This is called out in the
upgrade notes.
- **Tests**: the upstream self-contained tests are kept; tests that depended
on unpublished Spring
Boot test fixtures were rewritten as self-contained equivalents (server
start/stop, SSL, access
log, customizers, Spring MVC round-trip, autoconfiguration back-off). A
new functional example app
(`grails-test-examples/undertow`, mirroring the jetty example) verifies
end-to-end that a Grails
application boots on Undertow and serves a full request/redirect/session
cycle, including an
assertion that the running web server is the Undertow implementation.
- **Documentation**: upgrade notes rewritten (migration snippet, post-size
default), CLI reference
pages updated for the renamed `grails-undertow` feature, and `run-app`
documents the Undertow
alternative.
Fixes #<!-- link the Undertow ticket -->
## Contributor Checklist
### Issue and Scope
- [x] This PR is linked to an existing issue that has been **acknowledged or
approved** by the project team.
- [x] This PR addresses the **complete scope** of the linked issue.
- [x] This PR contains a **single, focused change**.
- [x] This PR targets the **correct branch** for the type of change (new
feature targeting the major release branch, `8.0.x`).
### Code Quality
- [x] I have **added or updated tests** that cover the changes introduced in
this PR.
- [ ] I have verified that all existing tests pass by running `./gradlew
build --rerun-tasks`.
<!-- Run before submitting: targeted verification so far = new module
test suites,
forge SpringBootSpec, the undertow functional example (Docker),
per-module
validateDependencyVersions, and a clean repo-wide
aggregateViolations. -->
- [x] My code follows the project's **code style** guidelines. I have run
`./gradlew codeStyle` and resolved any violations.
- [x] This PR does **not** include mass reformatting, style-only changes, or
large-scale refactoring.
- [x] If generative AI tooling was used in preparing this contribution, a
quality model was used to ensure contributions are **consistent with the
project's quality standards**.
### Licensing and Attribution
- [x] All contributed code is provided under the Apache License 2.0. New
Grails source files carry the
Apache license header; the vendored Spring Boot / Spring Framework
sources retain their original
Apache 2.0 license headers, with provenance documented in the module
`META-INF/NOTICE`, the root
`NOTICE`, and `grails-undertow/spring-boot/build.gradle`.
- [x] I have the necessary rights to submit this contribution.
- [x] If generative AI tooling was used in preparing this contribution, I
have followed the ASF policy on generative tooling and have properly attributed
its use.
### Documentation
- [x] If this PR introduces user-facing changes, I have included or updated
the relevant documentation.
- [x] If this PR adds a new feature, I have updated the **What's New**
section of the Grails Guide.
<!-- Not applicable: Undertow support previously existed in Grails 7;
this restores it.
The migration is covered in the Grails 8 Upgrade Notes. -->
- [x] If this PR introduces breaking changes or changes that require user
action during an upgrade, I have updated the **Upgrade Notes** for the
corresponding version in the Grails Guide (Undertow migration + the 2MB
`server.undertow.max-http-post-size` default).
- [x] The PR description clearly explains **what** was changed and **why**.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
