Spring Cloud Open Service Broker 5.1.1

Spring Cloud Open Service Broker 5.1.1 is now GA. Version 5.1.1 is built against Spring Boot 4.1 and requires Java 17+. It includes continued support for OSB API v2.16. This release closes several OSB API v2.16 compliance gaps, fixes incorrect HTTP status codes returned when polling a missing resource's last operation, and continues modernizing the Gradle build infrastructure.

Versions

Component	Version
Spring Boot	4.1.1
Spring Framework	7.0.9
Java	17+
OSB API	2.16

Highlights

• Closed three OSB API v2.16 field gaps: app_annotations and credential_client_id on BindResource, and instance_annotations on CloudFoundryContext
• Fixed the X-Broker-API-Request-Identity response header not being echoed back on Spring MVC brokers
• Polling last_operation for a missing service instance or service binding now correctly returns 404 Not Found instead of 400/422
• Gradle 9.7.1 build infrastructure (upgraded from Gradle 9.6.1)
• Documented @since OSB API version tags across the core javadoc

OSB API Compliance

• Added app_annotations to BindResource, part of the OSB API v2.16 Cloud Foundry Bind Resource object.
• Added credential_client_id to BindResource, the optional Cloud Foundry Bind Resource property carrying the CredHub client id for a service key request.
• Added instance_annotations to CloudFoundryContext, part of the OSB API v2.16 Cloud Foundry Context object.
• Registered RequestIdentityWebMvcConfigurerAdapter so the existing RequestIdentityInterceptor bean is actually applied to Spring MVC brokers. The interceptor implemented the spec's X-Broker-API-Request-Identity echo requirement but was never added to the InterceptorRegistry, so it had no effect; WebFlux brokers were unaffected since RequestIdentityWebFilter applies globally regardless of registration. Added end-to-end tests in both the webmvc and webflux acceptance modules that exercise the header through a real running application.
• Documented which OSB API spec version introduced each field, method, and endpoint across the model, exception, controller, and service classes, and pointed spec links at the v2.16 tag instead of master so they don't drift as the spec evolves.

Bug Fixes

• Polling last_operation for a missing service instance now returns 404 Not Found instead of 400 Bad Request, matching the OSB API v2.16 spec.
• Polling last_operation for a missing service binding now returns 404 Not Found instead of 422; ServiceInstanceBindingController previously had no exception handling here at all, so the failure fell through to the generic handler's 422 mapping.
• Added unit test coverage for the remaining ServiceInstanceBindingController last_operation status branches (in progress, succeeded, succeeded-with-delete, failed), matching the existing coverage for service instances.

Documentation

• Folded the WebFlux and MVC support note into the reference docs Overview.
• Fixed a broken table-of-contents sidebar in the reference docs.
• Updated stale contributing guidance in the README and CONTRIBUTING.
• Replaced the CLA link with the Developer Certificate of Origin requirement.
• Adopted the Spring Cloud org-wide Code of Conduct.
• Used a version placeholder in the README dependency snippets instead of a hardcoded version.
• Fixed a broken GitHub Actions badge and added Java 21/25 badges.
• Updated published POM metadata and cleaned up other project metadata.

Build Improvements

• Upgraded Gradle from 9.6.1 through 9.7.1 over the course of the release.
• Migrated plugin and dependency versions to a Gradle version catalog.
• Upgraded Spring Java Format to 0.0.48.
• Enabled BlockHound in contract-tests and documented allow-list sharing.
• Bumped the pinned local JDK to 17.0.20.
• Bumped actions/setup-java from 5 to 6.

Dependency Upgrades

• Bumped org.springframework.boot from 4.1.0 to 4.1.1.
• Bumped nl.jqno.equalsverifier:equalsverifier from 4.5 to 4.5.1.

Full Changelog: v5.1.0...v5.1.1

Spring Cloud Open Service Broker 5.1.0

Spring Cloud Open Service Broker 5.1.0 is now GA. Version 5.1.0 is built against Spring Boot 4.1 and requires Java 17+. It includes continued support for OSB API v2.16. This release upgrades core dependencies, replaces third-party utility libraries with Spring equivalents, and modernizes the Gradle build infrastructure.

Versions

Component	Version
Spring Boot	4.1.0
Spring Framework	7.0.8
Java	17+
OSB API	2.16

Highlights

• Spring Boot 4.1.0 (upgraded from Spring Boot 4.0.x)
• Gradle 9.6.1 build infrastructure (upgraded from Gradle 9.4.x)
• Replaced third-party commons-beanutils and commons-collections with Spring equivalents
• Bug fix for null safety in ServiceInstanceBindingController operation equality check
• CI now builds and tests the 5.1.x branch, with Dependabot enabled and the unsupported 4.5.x branch retired

Dependency Improvements

Remove Apache Commons Dependencies

• Replaced usage of commons-collections with Spring's CollectionUtils in EventFlowRegistry, eliminating the transitive dependency.
• Replaced usage of commons-beanutils with Spring's BeanWrapper in ParameterBeanMapperUtils, eliminating the transitive dependency.

Build Dependency Cleanup

• Use the Spring Boot managed version of Hamcrest rather than a manually pinned version.
• Removed the Wiremock Gradle constraint, previously required for a Logback classpath conflict resolved by the Spring Cloud Contract upgrade.
• Reduced scope of the findbugs dependency from testImplementation to testCompileOnly.
• Pinned spring-mock-mvc to support Groovy 5, then extracted the rest-assured version to a Gradle property and bumped rest-assured:spring-mock-mvc from 6.0.0 to 6.0.1.
• Bumped spring-cloud-contract from 5.0.2 to 5.0.3 and blockhound-junit-platform from 1.0.16 to 1.0.17.

Bug Fixes

• Fixed a null pointer risk in the operation equality check in ServiceInstanceBindingController, making the logic consistent with the equivalent check in ServiceInstanceController.

Improvements

• Simplified the service binding last operation response mapping in ServiceInstanceBindingController.

Build Improvements

• Upgraded Gradle from 9.4.0 through 9.6.1 over the course of the release.
• Removed deprecated Gradle APIs: getProperties, implicit parent property lookup, and the optionalApi feature variant.
• Removed unnecessary Gradle eclipse/idea plugins and old Java version guards for Java 11/13.
• Fixed eager task configuration by using the modern Gradle configureEach block.
• Suppressed a spurious JDK IO subsystem warning from AsciidoctorJ's JRuby engine during the docs build.
• Added support for retrieving build dependencies from an alternative artifactory.
• Enabled Dependabot and CI pipelines for the 5.1.x branch; fixed the documentation workflow (javadoc JAR generation, apidocs path, shell issues).
• Removed the unsupported 4.5.x branch from CI pipelines and Dependabot configuration.
• Updated the README version compatibility matrix.

Upgrade Notes

The spring-cloud-open-service-broker-webmvc and spring-cloud-open-service-broker-webflux dependencies are no longer marked as optional in the published Maven POMs. Consumers that relied on this hint to see the dependency suggested transitively will no longer see it listed; this has no functional effect, and projects must continue to explicitly declare a Spring MVC or Spring WebFlux dependency as before.

Full Changelog: v5.0.0...v5.1.0

Spring Cloud Open Service Broker 5.0.1

Spring Cloud Open Service Broker 5.0.1 is a patch release in the 5.0.x line. Version 5.0.1 is built against Spring Boot 4.0, and requires Java 17+. It includes support for OSB API v2.16. This release reduces third-party library dependencies in favor of Spring-provided utilities, includes a bug fix, and upgrades core dependencies.

Highlights

• Spring Boot 4.0.7 (upgraded from Spring Boot 4.0.3)
• Gradle 9.5.1 build infrastructure
• Replace third-party commons-beanutils and commons-collections with Spring equivalents
• Bug fix for null safety in ServiceInstanceBindingController operation equality check

Upgrade Notes

This release removes usage of Apache Commons libraries in favor of Spring Framework equivalents:

• commons-beanutils is no longer a dependency of spring-cloud-open-service-broker-core. It was previously pulled in as a direct dependency; ParameterBeanMapperUtils now uses Spring's BeanWrapper instead of BeanUtilsBean.

Action required: if your project relied on commons-beanutils being available on the classpath transitively through spring-cloud-open-service-broker-core, you will need to add it as an explicit dependency going forward.

See #971 for details.

Dependency Improvements

Remove Apache Commons Dependencies

• Replaced usage of commons-collections with Spring's CollectionUtils in EventFlowRegistry, eliminating the transitive dependency (#971).
• Replaced usage of commons-beanutils with Spring's BeanWrapper in ParameterBeanMapperUtils, eliminating the transitive dependency.

Build Dependency Cleanup

• Use the Spring Boot managed version of Hamcrest rather than a manually pinned version.
• Removed the Wiremock Gradle constraint, which was previously required for a Logback classpath conflict resolved by the Spring Cloud Contract upgrade.
• Reduced scope of the findbugs dependency from testImplementation to testCompileOnly.
• Removed the obsolete junitPlatformLauncherVersion variable.

Bug Fixes

• Fixed a null pointer risk in the operation equality check in ServiceInstanceBindingController, making the logic consistent with the equivalent check in ServiceInstanceController.

Improvements

• Simplified the service binding last operation response mapping in ServiceInstanceBindingController.

Full Changelog: v5.0.0...v5.0.1

Spring Cloud Open Service Broker v5.0.0

Spring Cloud Open Service Broker 5.0.0 is now GA. Version 5.0.0 is built against Spring Boot 4.0, Spring Framework 7.0, Jackson 3, and requires Java 17+. It includes support for OSB API v2.16. This release includes significant upgrades to core dependencies and introduces null safety annotations across the API.

Highlights

• Spring Boot 4.0.3 (upgraded from Spring Boot 3.5.x in the 4.x line)
• Jackson 3 (tools.jackson.core:jackson-databind)
• Null safety with JSpecify across all public API packages
• Gradle 9.3.1 build infrastructure (upgraded from Gradle 8.x)
• Java 25 CI now verifies and tests against Java 17, 21, and 25

Breaking Changes

Spring Boot 4 Upgrade

• All Spring Boot dependencies and starters have been migrated to the 4.0.x line.
• Package, class, and method name changes from Spring Boot 4 are reflected throughout the codebase.

Jackson 3 Migration

• The core module now depends on tools.jackson.core:jackson-databind (Jackson 3) instead of com.fasterxml.jackson.core:jackson-databind (Jackson 2).
• Jackson 2 is retained only in test scope for JsonPath support.
• Model classes have been updated to apply Jackson 3 best practices:
  • @JsonCreator and @JsonProperty annotations added to model constructors.
  • Removed usage of builderWithJackson2Defaults().
  • Reviewed and updated @JsonProperty usage on private members.

New Features

Null Safety with JSpecify

• Comprehensive null safety annotations have been added across all packages using JSpecify.
• package-info.java files added to all packages to declare null safety at the package level.
• JSpecify is declared as an api dependency, making null safety information available to consumers.
• This enables better static analysis and IDE support for service broker implementations.

Full Changelog: v4.5.1...v5.0.0

Spring Cloud Open Service Broker 4.5.2

Spring Cloud Open Service Broker 4.5.2 is a patch release in the 4.5.x line. Version 4.5.2 is built against Spring Boot 3.5, and requires Java 17+. It includes support for OSB API v2.16. This release reduces third-party library dependencies in favor of Spring-provided utilities, includes bug fixes, and upgrades core dependencies.

Highlights

• Spring Boot 3.5.16 (upgraded from Spring Boot 3.5.9)
• Gradle 9.5.1 build infrastructure
• Replace third-party commons-beanutils and commons-collections with Spring equivalents
• Bug fixes for log formatting and null safety in ServiceInstanceBindingController

Upgrade Notes

This release removes usage of Apache Commons libraries in favor of Spring Framework equivalents:

• commons-beanutils is no longer a dependency of spring-cloud-open-service-broker-core. It was previously pulled in as a direct dependency; ParameterBeanMapperUtils now uses Spring's BeanWrapper instead of BeanUtilsBean.

Action required: if your project relied on commons-beanutils being available on the classpath transitively through spring-cloud-open-service-broker-core, you will need to add it as an explicit dependency going forward.

See #971 for details.

Dependency Improvements

Remove Apache Commons Dependencies

• Replaced usage of commons-collections with Spring's CollectionUtils in EventFlowRegistry, eliminating the transitive dependency (#971).
• Replaced usage of commons-beanutils with Spring's BeanWrapper in ParameterBeanMapperUtils, eliminating the transitive dependency.

Build Dependency Cleanup

• Use the Spring Boot managed version of Hamcrest rather than a manually pinned version.
• Removed the Wiremock Gradle constraint, which was previously required for a Logback classpath conflict resolved by the Spring Cloud Contract upgrade.
• Reduced scope of the findbugs dependency from testImplementation to testCompileOnly.
• Removed the obsolete junitPlatformLauncherVersion variable.

Bug Fixes

• Fixed log formatting and output issues across CatalogController, ServiceBrokerExceptionHandler, ServiceInstanceController, and ServiceInstanceBindingController (#945).
• Fixed a null pointer risk in the operation equality check in ServiceInstanceBindingController, making the logic consistent with the equivalent check in ServiceInstanceController.

Improvements

• Simplified the service binding last operation response mapping in ServiceInstanceBindingController.

Full Changelog: v4.5.1...v4.5.2