feature: upgrade the namingserver and console modules to JDK 25 and SpringBoot 3.5, and add the spring-ai dependency to the console module. #7870

Xb2555 · 2025-12-17T09:38:15Z

I have read the CONTRIBUTING.md guidelines.
I have registered the PR changes.

Ⅰ. Describe what this PR did

Set the JDK version of the console and namingserver modules to 25 to support Springboot 3.5 and Spring-AI dependencies, preparing for the launch of the MCP function in the future.
As the Springboot version has been upgraded from 2.7 to 3.5, most classes have been migrated from the javax package to the Jakarta package, with minor code changes.
In the ConsoleRemotingFilter of the namingserver, since AsyncRestTemplate has been deprecated, virtual threads in JDK 21 and above and RestTemplate are used to implement the original asynchronous forwarding + lightweight blocking function, which is more lightweight and usable.
The WebSecurityConfig configuration class in the Console module has also been changed to the configuration method of the new version of SpringSecurity.

Ⅱ. Does this pull request fix one issue?

Ⅲ. Why don't you add test cases (unit test/integration test)?

Ⅳ. Describe how to verify it

Ⅴ. Special notes for reviews

…0.2, imported spring-ai mcp sdk

…new version

…0.2, httpclient to version 5.4.3

…package

…h according to the old version

… plus RestTemplate to implement the function

…rsions less than 25

# Conflicts: # .github/workflows/build.yml

# Conflicts: # namingserver/src/test/java/org/apache/seata/namingserver/NamingControllerTest.java # pom.xml

…ole module

codecov · 2025-12-17T10:01:35Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 71.11%. Comparing base (a72d265) to head (cd3b4ac).
⚠️ Report is 1 commits behind head on 2.x.

Additional details and impacted files

@@             Coverage Diff              @@
##                2.x    #7870      +/-   ##
============================================
- Coverage     71.12%   71.11%   -0.01%     
  Complexity      797      797              
============================================
  Files          1294     1294              
  Lines         49528    49528              
  Branches       5873     5873              
============================================
- Hits          35228    35224       -4     
- Misses        11390    11398       +8     
+ Partials       2910     2906       -4

see 9 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Copilot

Pull request overview

This PR upgrades the namingserver and console modules to JDK 25 and Spring Boot 3.5.2, completing a major framework modernization that enables future AI features through the spring-ai module. The upgrade involves migrating from the javax namespace to jakarta, replacing deprecated async APIs with virtual threads, and updating Spring Security configuration to the latest patterns.

Key Changes

Upgraded from JDK 8 to JDK 25 and Spring Boot 2.7.18 to 3.5.2 across console and namingserver modules
Replaced deprecated AsyncRestTemplate with RestTemplate + virtual threads (JDK 21+) for lightweight asynchronous processing
Migrated Spring Security configuration from deprecated WebSecurityConfigurerAdapter to SecurityFilterChain bean approach

Reviewed changes

Copilot reviewed 19 out of 19 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
namingserver/pom.xml	Updated JDK version to 25, Spring Boot to 3.5.2, Tomcat to 11.0.2, and migrated from httpclient 4.x to httpclient5
console/pom.xml	Updated Spring Boot to 3.5.2, added spring-ai-starter-mcp-server-webmvc dependency for future MCP functionality
namingserver/src/main/java/org/apache/seata/namingserver/filter/ConsoleRemotingFilter.java	Replaced AsyncRestTemplate with virtual threads + RestTemplate, implementing async forwarding with CompletableFuture and timeout handling
namingserver/src/main/java/org/apache/seata/namingserver/config/WebConfig.java	Updated HTTP client configuration to use httpclient5 packages, removed AsyncRestTemplate bean
console/src/main/java/org/apache/seata/console/config/WebSecurityConfig.java	Migrated from WebSecurityConfigurerAdapter to SecurityFilterChain bean pattern with lambda DSL configuration
console/src/main/java/org/apache/seata/console/filter/JwtAuthenticationTokenFilter.java	Migrated from javax.servlet to jakarta.servlet, minor code style improvements
namingserver/src/main/resources/application.yml	Added ant_path_matcher configuration to maintain compatibility with legacy Ant-style path patterns
Multiple test files	Updated imports from javax.servlet to jakarta.servlet for Spring Boot 3.x compatibility
.github/workflows/codeql-analysis.yml	Added Java 25 setup to ensure CI builds with the new JDK version

Comments suppressed due to low confidence (1)

console/pom.xml:173

The spring-ai-starter-mcp-server-webmvc dependency is added but appears to be unused in the codebase. Consider removing this dependency or document its intended use if it's meant for future functionality. Adding unused dependencies increases the application's footprint and potential security surface area.

                        <configuration>
                            <nodeVersion>v19.5.0</nodeVersion>
                        </configuration>
                    </execution>
                    <execution>

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

namingserver/src/main/java/org/apache/seata/namingserver/filter/ConsoleRemotingFilter.java

namingserver/src/main/resources/application.yml

namingserver/src/main/java/org/apache/seata/namingserver/filter/ConsoleRemotingFilter.java

console/src/main/java/org/apache/seata/console/filter/JwtAuthenticationTokenFilter.java

Copilot

Pull request overview

Copilot reviewed 19 out of 19 changed files in this pull request and generated 3 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

console/src/main/java/org/apache/seata/console/config/WebSecurityConfig.java

namingserver/src/main/resources/application.yml

namingserver/src/main/java/org/apache/seata/namingserver/filter/ConsoleRemotingFilter.java

…s request

Copilot

Pull request overview

Copilot reviewed 21 out of 21 changed files in this pull request and generated 7 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2025-12-18T09:09:09Z

namingserver/src/main/resources/application.yml

+    virtual:
+      enabled: true
+  mvc:
+    pathmatch:


The PathMatchingStrategy configuration using 'ant_path_matcher' forces Spring MVC to use the legacy AntPathMatcher instead of the newer PathPatternParser (default in Spring Boot 3.x). While this maintains backward compatibility with patterns like /**/*.css, be aware that PathPatternParser is more efficient. Consider migrating path patterns to be compatible with PathPatternParser in the future for better performance, or document why the legacy matcher is required.

Suggested change

pathmatch:

pathmatch:

# Use legacy AntPathMatcher for compatibility with existing patterns like /**/*.css, /**/*.js, etc.

# Switching to PathPatternParser (Spring Boot 3.x default) would require updating these patterns.

Copilot · 2025-12-18T09:09:09Z

console/src/main/java/org/apache/seata/console/config/WebSecurityConfig.java

+                // PathPatternParser using the new version of Security cannot directly achieve the same matching effect
+                // as the deprecated Ant style mode /**/*.css


The comment explaining why AntPathRequestMatcher is used is helpful. However, the explanation could be clearer. The issue is that Spring Security 6.x uses PathPatternParser by default, which has stricter matching rules than the legacy Ant style matcher. Patterns like /**/*.css work differently between the two. Consider adding a reference or example to make this clearer for future maintainers.

Suggested change

// PathPatternParser using the new version of Security cannot directly achieve the same matching effect

// as the deprecated Ant style mode /**/*.css

// In Spring Security 6.x, requestMatchers(String...) uses PathPatternParser by default, which has

// stricter matching rules than the legacy Ant-style matcher. For example, the Ant pattern "/**/*.css"

// (often used for static resources) is not interpreted the same way by PathPatternParser and may no

// longer match all nested paths as expected. We therefore use AntPathRequestMatcher explicitly so

// that ignore / CSRF patterns coming from configuration keep their original Ant-style semantics.

// See: Spring Security Reference - "Request Matchers" section.

Copilot · 2025-12-18T09:09:10Z

namingserver/src/main/java/org/apache/seata/namingserver/filter/ConsoleRemotingFilter.java


                            // Create the HttpEntity with headers and body
                            HttpEntity<byte[]> httpEntity = new HttpEntity<>(request.getCachedBody(), headers);
-
-                            // Forward the request
-                            AsyncContext asyncContext = servletRequest.startAsync();
-                            asyncContext.setTimeout(5000L);
-                            ListenableFuture<ResponseEntity<byte[]>> responseEntityFuture = asyncRestTemplate.exchange(
-                                    URI.create(targetUrl),
-                                    Objects.requireNonNull(HttpMethod.resolve(request.getMethod())),
-                                    httpEntity,
-                                    byte[].class);
-                            responseEntityFuture.addCallback(new ListenableFutureCallback<ResponseEntity<byte[]>>() {
-                                @Override
-                                public void onFailure(Throwable ex) {
-                                    try {
-                                        logger.error(ex.getMessage(), ex);
-                                        response.setStatus(HttpServletResponse.SC_INTERNAL_SERVER_ERROR);
-                                    } finally {
-                                        asyncContext.complete();
+                            HttpMethod httpMethod;
+                            try {
+                                httpMethod = HttpMethod.valueOf(request.getMethod());
+                            } catch (IllegalArgumentException ex) {
+                                logger.error("Unsupported HTTP method: {}", request.getMethod(), ex);
+                                response.setStatus(HttpServletResponse.SC_METHOD_NOT_ALLOWED);
+                                return;
+                            }
+                            try {
+                                ResponseEntity<byte[]> responseEntity = restTemplate.exchange(
+                                        URI.create(targetUrl), httpMethod, httpEntity, byte[].class);
+                                responseEntity.getHeaders().forEach((key, value) -> {
+                                    value.forEach(v -> response.addHeader(key, v));
+                                });
+                                response.setStatus(
+                                        responseEntity.getStatusCode().value());
+                                Optional.ofNullable(responseEntity.getBody()).ifPresent(body -> {
+                                    try (ServletOutputStream outputStream = response.getOutputStream()) {
+                                        outputStream.write(body);
+                                        outputStream.flush();
+                                    } catch (IOException e) {
+                                        logger.error(e.getMessage(), e);
                                    }
-                                }
-
-                                @Override
-                                public void onSuccess(ResponseEntity<byte[]> responseEntity) {
-                                    // Copy response headers and status code
-                                    responseEntity.getHeaders().forEach((key, value) -> {
-                                        value.forEach(v -> response.addHeader(key, v));
-                                    });
-                                    response.setStatus(responseEntity.getStatusCodeValue());
-                                    // Write response body
-                                    Optional.ofNullable(responseEntity.getBody())
-                                            .ifPresent(body -> {
-                                                try (ServletOutputStream outputStream = response.getOutputStream()) {
-                                                    outputStream.write(body);
-                                                    outputStream.flush();
-                                                } catch (IOException e) {
-                                                    logger.error(e.getMessage(), e);
-                                                }
-                                            });
-                                    asyncContext.complete();
-                                }
-                            });
+                                });
+                            } catch (Exception ex) {
+                                logger.error(ex.getMessage(), ex);
+                                response.sendError(HttpServletResponse.SC_INTERNAL_SERVER_ERROR);
+                            }


The significant refactoring of ConsoleRemotingFilter from AsyncRestTemplate to RestTemplate changes the core request forwarding mechanism. This change lacks test coverage to verify that the synchronous RestTemplate with virtual threads provides equivalent functionality to the previous asynchronous implementation. Consider adding tests to verify proper request forwarding, error handling, and timeout behavior.

console/pom.xml

namingserver/src/main/java/org/apache/seata/namingserver/config/WebConfig.java

namingserver/src/main/java/org/apache/seata/namingserver/filter/ConsoleRemotingFilter.java

Copilot · 2025-12-18T09:09:11Z

namingserver/src/main/java/org/apache/seata/namingserver/config/WebConfig.java

+import org.apache.hc.client5.http.impl.classic.CloseableHttpClient;
+import org.apache.hc.client5.http.impl.classic.HttpClients;
+import org.apache.hc.client5.http.impl.io.PoolingHttpClientConnectionManager;


The migration from org.apache.httpcomponents:httpclient (HttpClient 4.x) to org.apache.httpcomponents.client5:httpclient5 (HttpClient 5.x) involves significant API changes. The imports have been correctly updated to use org.apache.hc.client5 packages. However, ensure that the HttpComponentsClientHttpRequestFactory from Spring is compatible with HttpClient 5.x at runtime, as Spring's HttpComponentsClientHttpRequestFactory may have different configuration methods for HttpClient 5.

funky-eyes

LGTM

…pringBoot 3.5, and add the spring-ai dependency to the console module. (apache#7870)

Xb2555 and others added 26 commits December 2, 2025 18:49

feature: update springboot to version 3.5.2 and tomcat to version 11.…

33000a7

…0.2, imported spring-ai mcp sdk

feature: Replace the original javax package with the new jakarta package

15effb0

feature: Replace the old SpringSecurity configuration class with the …

9d52e9d

…new version

feature: update springboot to version 3.5.2 and tomcat to version 11.…

633bcae

…0.2, httpclient to version 5.4.3

feature: Replace the reference of the javax package with the jakarta …

22cdff2

…package

optimize: optimize import

7d21236

feature: Change the matching policy of PathMatch to configure the pat…

ae50dfa

…h according to the old version

feature: Replace the outdated AsyncRestTemplate with a virtual thread…

6a337f6

… plus RestTemplate to implement the function

feature: update namingserver JDK version to 25

7859531

Merge branch 'apache:2.x' into spring-ai-mcp

b9cb1d4

Merge branch '2.x' into spring-ai-mcp

c59f1a9

Merge branch '2.x' into spring-ai-mcp

ae79913

fix: upgrade pmd check plugins to adapt java 25

e6e228e

fix: upgrade pmd check plugins to adapt java 25

67c5efc

Merge remote-tracking branch 'origin/spring-ai-mcp' into spring-ai-mcp

63af488

fix: upgrade pmd check plugins to adapt java 25

6a0b866

fix: upgrade pmd check plugins to adapt java 25

3f85239

feature: codeql-analysis.yml add JDK25 Setup

0ba4033

feature: codeql-analysis.yml add JDK25 Setup

ef85132

feature: Exclude namingserver builds from build workflows with JDK ve…

4417658

…rsions less than 25

Merge remote-tracking branch 'origin/jdk-update' into jdk-update

a1bb77e

# Conflicts: # .github/workflows/build.yml

Merge remote-tracking branch 'origin/jdk-update' into jdk-update

b89e814

# Conflicts: # namingserver/src/test/java/org/apache/seata/namingserver/NamingControllerTest.java # pom.xml

optimize: skip the PMD check for the namingserver as well as the cons…

7ced2de

…ole module

optimize: change Resource to jakarta package

7e0aa71

optimize: codeql set JDK25 version

bee898a

fix: delete unnecessary Settings

386eead

funky-eyes requested a review from Copilot December 18, 2025 03:36

Copilot started reviewing on behalf of funky-eyes December 18, 2025 03:37 View session

fix: Remove unnecessary dependency comments

ced838f

fix: remove unnecessary dependency comments at console

0153a2c

Copilot AI reviewed Dec 18, 2025

View reviewed changes

Xb2555 added 4 commits December 18, 2025 11:52

fix: change to Javadoc style

fe94953

fix: future.get() without a timeout

67452b0

fix: remove unnecessary supplyAsync

4ffd59f

fix: spotless apply

0903489

funky-eyes requested a review from Copilot December 18, 2025 05:58

funky-eyes added this to the 2.6.0 milestone Dec 18, 2025

funky-eyes added type: feature Category issues or prs related to feature request. module/console module/namingserver labels Dec 18, 2025

Copilot started reviewing on behalf of funky-eyes December 18, 2025 05:59 View session

Copilot AI reviewed Dec 18, 2025

View reviewed changes

console/src/main/java/org/apache/seata/console/config/WebSecurityConfig.java Show resolved Hide resolved

funky-eyes reviewed Dec 18, 2025

View reviewed changes

Xb2555 added 2 commits December 18, 2025 16:28

fix: configure Tomcat to use a virtual thread pool and use Synchronou…

0d349c3

…s request

optimize: add change

3dfbb37

funky-eyes requested a review from Copilot December 18, 2025 08:53

Copilot started reviewing on behalf of funky-eyes December 18, 2025 08:54 View session

Copilot AI reviewed Dec 18, 2025

View reviewed changes

Merge branch '2.x' into jdk-update

cd3b4ac

funky-eyes approved these changes Dec 18, 2025

View reviewed changes

funky-eyes merged commit c13207c into apache:2.x Dec 18, 2025
11 checks passed

Xb2555 deleted the jdk-update branch December 18, 2025 10:00

YvCeung pushed a commit to YvCeung/incubator-seata that referenced this pull request Dec 25, 2025

feature: upgrade the namingserver and console modules to JDK 25 and S…

d6c30a8

…pringBoot 3.5, and add the spring-ai dependency to the console module. (apache#7870)

		// PathPatternParser using the new version of Security cannot directly achieve the same matching effect
		// as the deprecated Ant style mode /*/.css

-                // PathPatternParser using the new version of Security cannot directly achieve the same matching effect
-                // as the deprecated Ant style mode /**/*.css
+                // In Spring Security 6.x, requestMatchers(String...) uses PathPatternParser by default, which has
+                // stricter matching rules than the legacy Ant-style matcher. For example, the Ant pattern "/**/*.css"
+                // (often used for static resources) is not interpreted the same way by PathPatternParser and may no
+                // longer match all nested paths as expected. We therefore use AntPathRequestMatcher explicitly so
+                // that ignore / CSRF patterns coming from configuration keep their original Ant-style semantics.
+                // See: Spring Security Reference - "Request Matchers" section.

feature: upgrade the namingserver and console modules to JDK 25 and SpringBoot 3.5, and add the spring-ai dependency to the console module. #7870

feature: upgrade the namingserver and console modules to JDK 25 and SpringBoot 3.5, and add the spring-ai dependency to the console module. #7870

Uh oh!

Conversation

Xb2555 commented Dec 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Ⅰ. Describe what this PR did

Ⅱ. Does this pull request fix one issue?

Ⅲ. Why don't you add test cases (unit test/integration test)?

Ⅳ. Describe how to verify it

Ⅴ. Special notes for reviews

Uh oh!

codecov bot commented Dec 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Key Changes

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Dec 18, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 18, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 18, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI Dec 18, 2025

Choose a reason for hiding this comment

Uh oh!

funky-eyes left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Xb2555 commented Dec 17, 2025 •

edited

Loading

codecov bot commented Dec 17, 2025 •

edited

Loading