Micronaut Core 5.2.23

What's Changed

Micronaut Core 5.2.23 is a patch release with security fixes and framework improvements. It addresses 38 GitHub Security Advisories.

🚨 Security fixes

HTTP server and routing

• Isolate listeners and protect id-less management endpoints: GHSA-c856-m48r-3gpc.
• Harden the CORS localhost guard against spoofed forwarded headers and IPv6 loopback Host values: GHSA-72p5-8f28-xwp2, GHSA-fv5h-6pjp-g363.
• Keep filters and route arguments from seeing different values for the same request: GHSA-hm9j-m8h9-32v9.
• Keep request-terminated events and pooled client continuations in their own propagated context: GHSA-xh4x-vj47-4px7.
• Apply @JsonView to wrapped bodies, SSE events, and fallback writers: GHSA-432j-9h93-pv45.
• Escape control characters in access log values: GHSA-wgxm-75ph-q27x.
• Evaluate CORS preflight requests against the route serving the requested method: GHSA-c79q-p83r-9vpm.
• Bound request parsing work and keep blocking calls off the event loop: GHSA-jfwr-qrpq-5g48.
• Prevent TLS listeners from serving plaintext while their SSL context is pending or has failed: GHSA-35qg-26hc-qr84.
• Run route-scoped filters for every request reaching the route: GHSA-p72j-v3qh-v5mm.
• Match filters against the path used by the router and static resource resolver: GHSA-wcgp-mmwm-x2x2.
• Reset HTTP/3 request streams that fail or close early: GHSA-6v2q-5rcc-qfmc.
• Enforce form limits across part headers, Content-Length, and tiny chunks: GHSA-h2j4-vr48-c4vv.
• Ensure context-path filters cover function and WebSocket routes and prefix-colliding paths: GHSA-gj4v-r6x3-66jp.
• Bound caches keyed by request-controlled values: GHSA-jj39-pp85-xj49.
• Correct connection lifecycle, idle-timeout, and HTTP/2 response framing behavior: GHSA-82w6-g6gh-pjrv.
• Release request body buffers and stop late-body loops when a route does not consume its body: GHSA-wjxw-jjr4-4mqr, GHSA-8rrh-x2ch-p2vv.
• Release response buffers, streams, and compressors when responses are discarded or clients disconnect: GHSA-5g2v-x779-wr6w.
• Prevent classpath resource resolution from following symlinks outside the configured base: GHSA-5hmw-vf9q-xqhv.
• Close StreamedFile input streams when returning 304 Not Modified: GHSA-mjjj-6mx9-p8px.
• Bound compressed request processing and reject truncated compressed bodies: GHSA-2j79-mgc9-v76r, GHSA-hgj7-52cp-647p.
• Fix multipart parser hangs and direct-memory leaks on malformed, truncated, or over-limit bodies: GHSA-88m6-wjjg-mc7g.
• Fail in-flight HTTP/2 request bodies and release buffered data when their stream closes: GHSA-4j6j-v86m-5xv7.

HTTP clients

• Bound HTTP client response sizes and timeouts for stalled bodies: GHSA-j3jr-9qw4-m252.
• Release client buffers and connections after malicious or failing upstream responses: GHSA-fr2f-ww99-xgcc.
• Clear stale Content-Length state and prevent unsafe connection reuse after decode failures: GHSA-wv7m-pmvh-98h9.
• Isolate client cookies and credentials and prevent unsafe request-construction behavior: GHSA-mfrv-8fw9-56vq.
• Bound JSON stream element size and processing work: GHSA-5pxm-5867-gjc9.
• Honor configured header filters on cross-origin redirects in the JDK HTTP client: GHSA-9mfm-8wr5-m838.
• Do not forward request framing or hop-by-hop headers from relayed requests in the JDK HTTP client: GHSA-64w5-89v4-549v.

WebSockets and server-sent events

• Harden WebSocket upgrade handling: GHSA-gpxf-v9p3-4hh5.
• Close WebSocket connections after sending a close frame, including when the endpoint has no @OnClose handler: GHSA-38pj-464p-88jf.
• Bound WebSocket inbound work and outbound waits: GHSA-973f-vvmg-r76v.
• Release WebSocket messages whose decoding fails: GHSA-xccf-9g9p-4q66.
• Neutralize line breaks in server-sent event fields: GHSA-596x-f5j6-xvhc.

Improvements and fixes

• Keep @InjectScope beans scoped to each creation, including nested and concurrent creations.
• Keep runtime proxy target resolutions isolated, and deliver reactive signals with the propagated context bound.
• Make propagated context entry and exit cheaper, and restore the previous context even when a thread element fails.
• Prevent environment lookups from failing while the environment is starting.
• Choose the highest-weight acceptable compression algorithm and never select an algorithm assigned q=0.
• Avoid duplicate processing of executable methods by deprecated method processors.
• Resolve @Replaces chains and allow replacements to satisfy the qualifiers of the beans they replace.
• Resolve placeholders in @Executable annotation members separately for each application context.
• Preserve Python object identity during conversion and support type-use annotation metadata without a native originating element.
• Read Kotlin annotation defaults from the compiled annotation class when the current processing round has no usage.

Other changes

• Improve test compatibility and stability for current JDK and Netty behavior, including retrying an external TLS test when the remote test service times out.

Full changelog