4.0.0-M2

Apache Causeway v4 is based on Spring Boot v4. This milestone release mitigates a security vulnerability, provides bug fixes and some new features.

Notable changes in this release:

⚠️ Attention Required

  • Mitigates CVE-2025-64408

  • By default on application start a random HMAC secret (32 bytes) is generated, to digitally sign Viewmodel Bookmarks (URLs). The HMAC secret can also be set via environment variable causeway_hmac_sha256 as Base64 encoded byte array, like e.g. gogmem5YXl0IQzw/kB0tkcxTN9y07Cnf3s1kP4WIf3g= A minimum of 16 bytes is required, we recommend 32. CAUSEWAY-3988

    32 byte HMAC Generator
    import org.apache.causeway.commons.internal.base._Bytes;
//..
var secret = new byte[32]; // double the minimum requirement of 16
SecureRandom.getInstanceStrong().nextBytes(secret);
var hmacBase64 = _Bytes.stringifyUtf8Base64(secret);
System.out.println(hmacBase64);

  • [Programming Model] Support for Property Clear Methods was removed CAUSEWAY-3984

  • [Programming Model] Support for ValueSemanticsProvider registration via Spring factory methods.

⭐ New Features

  • Open Telemetry integration, activates when dependencies are found on the class path and Spring Profile observation is active. (see Appendix below) CAUSEWAY-3975

  • Pickup Webjar Version Strings automatically from Classpath CAUSEWAY-3948

  • [Wicket Viewer] Select2 with Object Icons CAUSEWAY-3904

  • Built-in Value Semantics for various number grouping separation styles, changing the default grouping character to a narrow space CAUSEWAY-4006

🐞 Bug Fixes

  • ApplicationFeatureViewModel may fail to properly instantiate CAUSEWAY-3966

  • NPE in EntityChangeTrackerDefault when Logging with DEBUG level CAUSEWAY-3946

  • Metamodel Introspection Policy not honored for Java Records as Viewmodels CAUSEWAY-3991

  • Switching between Layout Variants may result in Members staying hidden CAUSEWAY-3971

  • [Commons] Internal OneShot Util may deadlock (potentially preventing App from startup) CAUSEWAY-3972

  • [Wicket Viewer] Hide Tabs when content is permanently hidden CAUSEWAY-3983

  • [Wicket Viewer] Table Row Actions Redirect might fail if behind Reverse Proxy CAUSEWAY-3976

  • [Wicket Viewer] Upload Button may trigger Download of same File CAUSEWAY-3950

  • [Wicket Viewer] Downloadlink may fail with Network Error CAUSEWAY-3958

  • [Wicket Viewer] Actions in Tables have wrong Usability/Visibility Logic CAUSEWAY-3958

  • [Wicket Viewer] Actions in Tables have wrong Result Routing CAUSEWAY-3961

  • [Wicket Viewer] Dropdown Menu Clicks sometimes ignored CAUSEWAY-3992

🔨 Dependency Upgrades

  • Upgrade to Spring Boot 4.0.5

  • Upgrade to EclipseLink 5.0.0

Appendix

Open Telemetry Minimal Setup (for Applications)

Maven
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-opentelemetry</artifactId>
</dependency>
<dependency>
    <groupId>io.micrometer</groupId>
    <artifactId>micrometer-registry-otlp</artifactId>
</dependency>
Configuration
spring:
  application:
    name: <name of service>

management:
  tracing:
    sampling:
      probability: 1
  opentelemetry:
    tracing:
      export:
        otlp:
          endpoint: http://<my-endpoint>:4318/v1/traces
Spring - disables 'metric' export (we are currently only using 'traces')
@Bean
OtlpConfig otlpConfig() {
    return new OtlpConfig() {
        @Override public @Nullable String get(final String key) { return null;}
        @Override public boolean enabled() { return false; }
    };
}
Docker - one of many options is to use Jaeger as telemetry collector
docker run -d --name jaeger \
-p 16686:16686 \
-p 4317:4317 \
-p 4318:4318 \
-p 5778:5778 \
-p 9411:9411 \
cr.jaegertracing.io/jaegertracing/jaeger

Exposing Jaeger’s UI at http://<my-endpoint>:16686

Open Telemetry Usage