4.0.0-M2

Apache Causeway v4 is based on Spring Boot v4.

This milestone release mitigates a security vulnerability, provides bug fixes and some new features.

Notable changes in this release:

  • address CVE-2025-64408 (CAUSEWAY-3988)

    By default on application start a random HMAC secret (32 bytes) is generated, to digitally sign Viewmodel Bookmarks (URLs). The HMAC secret can also be set via environment variable causeway_hmac_sha256 as comma separated list of signed integers (bytes). A minimum of 16 bytes is required, we recommend 32. (eg. -13,4,0, …​)

  • Open Telemetry integration (CAUSEWAY-3975)

    This activates when dependencies are found on the class path and Spring Profile observation is active.

    For more details, see Open Telemetry Setup

  • Better handling of Eclipse Static weaving (CAUSEWAY-3942, CAUSEWAY-3967, CAUSEWAY-3959, CAUSEWAY-3969)

New Feature

Improvement

  • CAUSEWAY-3988 - [Security] Support for Env Var provided HMAC Secret

  • CAUSEWAY-3984 - [Programming Model] Remove Support for Property Clear Methods

  • CAUSEWAY-3969 - [JPA] Fail early on inconsistent weave state within discovered entity type hierarchies

  • CAUSEWAY-3964 - Metamodel Inspector Support for Type Hierarchy

  • CAUSEWAY-3959 - [JPA] Build framework-provided Entities using Static Weaving

  • CAUSEWAY-3948 - Pickup Webjar Version Strings automatically from Classpath

  • CAUSEWAY-3945 - [Wicket Viewer] Disable client-side Caching for Tabular Downloads (eg Excel)

  • CAUSEWAY-3942 - Support EclipseLink static weaving automatically.

  • CAUSEWAY-3940 - Metamodel Validation Errors are misleading when Issue is just a missing -parameters Compiler Flag

  • CAUSEWAY-3939 - Viewmodel Bookmark Overhaul

  • CAUSEWAY-3937 - [Applib/Core] Grid Loading Overhaul

  • CAUSEWAY-3904 - [Wicket Viewer] Select2 with Object Icons

  • CAUSEWAY-3967 - [JPA] Framework Consuming App fails to bookmark Entities when Weaving is enabled

  • CAUSEWAY-3630 - [Wicket Viewer] Simplified Tabular Data Integration

  • CAUSEWAY-2445 - [Ongoing] CI Maintenance

Bug

  • CAUSEWAY-3992 - [Wicket Viewer] Dropdown Menu Clicks sometimes ignored

  • CAUSEWAY-3991 - Metamodel Introspection Policy not honored for Java Records as Viewmodels

  • CAUSEWAY-3987 - [Wicket Viewer] Regression - Latest Webjar PDFJS breaks PDF integration

  • CAUSEWAY-3983 - [Wicket Viewer] Empty Tabs should be hidden (Regression)

  • CAUSEWAY-3976 - [Wicket Viewer] Table Row Actions Redirect might fail if behind Reverse Proxy

  • CAUSEWAY-3972 - [Commons] Internal OneShot Util may deadlock

  • CAUSEWAY-3971 - [Wicket Viewer] Switching between Layout Variants may result in Members staying hidden

  • CAUSEWAY-3966 - ApplicationFeatureViewModel may fail to properly instantiate

  • CAUSEWAY-3965 - [Metamodel] Type Hierarchy Introspection misses out on Interfaces

  • CAUSEWAY-3961 - [Wicket Viewer] Actions in Tables have wrong Result Routing

  • CAUSEWAY-3960 - [Wicket Viewer] Actions in Tables have wrong Usability/Visibility Logic

  • CAUSEWAY-3958 - [Wicket Viewer] Downloadlink may fail with Network Error

  • CAUSEWAY-3950 - [Wicket Viewer] Upload Button may trigger Download of same File

  • CAUSEWAY-3949 - Unstable Tests

  • CAUSEWAY-3946 - NPE in EntityChangeTrackerDefault when Logging with DEBUG level

  • CAUSEWAY-3944 - [JPA] Collection Mementos may taint Owner Entity State

  • CAUSEWAY-3938 - [Wicket Viewer] Editing uninitialized mandatory property causes exception

  • CAUSEWAY-3913 - [Layout] Inconsistent slot-in handling when feature should appear more than once

  • CAUSEWAY-3899 - NPE guard for DomainChangeRecord

Dependency upgrade

  • CAUSEWAY-3947 - Migrate to Jackson 3.x

  • Upgrade to Spring Boot 4.0.5

  • Upgrade to EclipseLink 5.0.0

Task

Documentation

Won’t Do

  • CAUSEWAY-3963 - WONT DO - [Debug] For every Type introspected, keep track of what triggered the Introspection

  • CAUSEWAY-3744 - [Abandoned] For JPA dynamic weaving, implement LoadTimeWeaverAware as a way…​

Duplicate