DocsICP FilingConsole
官方文档
首页

Version guide

更新时间：
复制 MD 格式
产品详情
我的收藏

These release notes describe updates to the SOFABoot development framework in reverse chronological order.

Note

  • The commercial edition of SOFABoot is based on the open source edition.

  • Starting with SOFABoot 3.2.1, the middleware starter version matches the SOFABoot version. For details on viewing the starter version in a project, see View starter information.

  • For guidance on upgrading SOFABoot, see SOFABoot upgrade guide.

  • When selecting a SOFABoot version, ensure it is documented here. Versions not listed are reserved and must not be used.

3.10.10 (2026.01.05)

Note

This version adds graceful shutdown logic for RPC compared to version 3.10.9. Upgrade as needed.

New feature

Added graceful shutdown support for RPC.

Important

The new version of CAFE includes built-in graceful shutdown functionality. Do not enable this feature again for applications deployed on CAFE, as doing so significantly prolongs service downtime.

To enable this feature, configure the following parameters:

Parameter

Description

Default value

com.alipay.sofa.rpc.graceful.shutdown.enabled

Specifies whether to enable the graceful shutdown feature.

Valid values: true and false.

false

com.alipay.sofa.rpc.graceful.shutdown.maxWaitAliveRequestDuration

The maximum time to wait before the application is shut down. This ensures that ongoing requests are processed.

Unit: seconds.

30

com.alipay.sofa.rpc.graceful.shutdown.waitRegistryUnpubDuration

The time to wait for deregistration.

Unit: seconds.

30

com.alipay.sofa.rpc.graceful.shutdown.maxWaitScheduleTaskDuration

The time to wait for tasks marked with the @Scheduled annotation to stop.

Unit: seconds.

30

3.10.9 (2025.11.27)

Note

This version includes feature optimizations compared to version 3.10.8.

Updates

Optimized memory usage for RPC service subscriptions to prevent full garbage collection (GC) when many subscribers are updated.

3.10.8 (2025.11.25)

Note

This version improves compatibility with public network JARs compared to version 3.10.7.

Updates

  • Rolled back the SOFA dependency package: alipay-system-event was reverted from version 3.2.8 to 3.2.7.

  • Removed the naming-client dependency.

3.10.7 (2025.11.20)

Note

This version addresses security vulnerabilities compared to version 3.10.6.

Updates

Updated the following dependency packages:

Dependency

Package/Component name

Version 3.10.6

Version 3.10.7

Security version upgrade

tomcat-embeded

9.0.104

9.0.109

druid

1.1.2

1.2.4

netty-handler

4.1.114.Final

4.1.121.Final

3.10.6 (2025.07.17)

Updates

Rolled back the SOFA dependency package: the Guardian component was reverted from version 1.4.20 to 1.4.15.

3.10.5 (2025.06.05)

Updates

  • Updated the following dependencies:

    Dependency

    Package/Component name

    Version 3.10.4

    Version 3.10.5

    Security version upgrade

    resteasy

    3.11.3.Final

    3.15.6.Final

    commons-io

    2.11.0

    2.17.0

    mvel2

    2.3.2.Final

    2.5.2.Final

    jackson-bom

    2.14.2

    2.15.4

    resteasy

    3.11.3.Final

    3.15.6.Final

    netty

    4.1.100.Final

    4.1.114.Final

    zstd-jni

    1.3.6-1

    1.5.6-8

    mime4j

    -

    0.8.11

    SOFA dependencies

    sofa-bolt

    1.5.10

    1.6.10

    sofa-common-tools

    1.3.11

    1.4.0

    naming-client

    -

    1.2.3

  • Removed the third-party dependency commons-httpclient.

3.10.4 (2024-11-21)

Updates

  • Updated the following dependencies:

    Dependency

    Package/Component name

    Version 3.10.3

    Version 3.10.4

    Security version upgrade

    Spring Framework

    5.3.31

    5.3.39

    tomcat

    9.0.79

    9.0.96

    plexus-utils

    3.0.20

    3.0.24

    guava

    28.0-jre

    33.3.1-jre

    apache ant

    1.9.16

    1.10.15

    velocity

    1.7

    2.4

    protobuf

    3.21.12

    3.25.5

    grpc

    1.33.0

    1.68.0

    logback

    1.2.12

    1.2.13

    aviator

    5.3.3

    5.4.3

    SOFA dependencies

    SOFABoot open source edition

    3.21.0

    3.24.0

    sofa-rpc-all

    5.11.1

    5.13.1

    sofa-enterprise-all

    5.9.4

    5.9.5

    registry-client-all

    5.3.1.cloud.20230509

    5.3.1.cloud.20240620

    registry-client-enterprise-all

    5.6.1

    5.6.2

    zoneclient

    1.2.1.antcloud

    1.2.4.antcloud

    Indirect third-party dependencies

    okio

    2.8.0

    3.4.0

  • Removed the third-party dependency bcpkix-jdk15on.

  • You can set com.alipay.sofa.rpc.compatible.rms3124=true in the configuration file to maintain compatibility with older versions of RMS collection.

3.10.3 (2024-03-06)

Add

  • RPC now supports exposing Prometheus monitoring metrics.

  • Optimized RPC for Mesh scenarios and added REST protocol support.

  • The registry center now supports configuring the subscription thread pool.

Updates

  • Upgraded the dependent SOFABoot open source edition from 3.19.1 to 3.21.0. For more information, see the release notes.

  • Upgraded the dependent Spring Boot version from 2.7.15 to 2.7.18. For more information, see the release notes.

  • Updated the following dependencies:

    • registry-client-enterprise-all: upgraded from 5.6.0 to 5.6.1.

    • sofa-rpc-enterprise-all: upgraded from 5.9.3 to 5.9.4.

    • sofa-rpc-all: upgraded from 5.8.4 to 5.11.1.

    • antcloud-antvip-client: upgraded from 1.2.0 to 1.2.1.

    • antcloud-antvip-common: upgraded from 1.2.0 to 1.2.1.

    • org.apache.dubbo: upgraded from 2.7.18 to 2.7.23.

3.10.2 (2023-10-27)

Note

This version upgrades core dependencies from version 3.6.6, including an update of Spring Boot to 2.7.15 and other security-driven dependency upgrades.

Updates

Updated the following dependencies:

Dependency

Package/Component name

Version 3.6.6

Version 3.10.2

Security version upgrade

SpringBoot

2.3.12

2.7.15

Spring Framework

5.2.21

5.3.29

logback

1.2.8

1.2.12

slf4j

1.7.30

1.7.36

gson

2.8.9

2.9.1

protobuf-java

3.11.0

3.21.12

jackson

2.11.4

2.14.2

okhttp

3.14.9

4.9.3

commons-beanutils

2.9.3

2.9.4

commons-fileupload

1.4

1.5

resteasy

3.6.3.Final

3.11.3.Final

netty

4.1.65.Final

4.1.97.Final

tomcat

9.0.43

9.0.79

aviator

4.2.7

5.3.3

ant

1.7.1

1.9.16

groovy

2.5.14

3.0.19

hibernate-validator

5.2.4.Final

6.2.5.Final

jasypt

1.5

1.9.3

velocity

1.6

1.7

snakeyaml

1.32

1.33

SOFA dependencies

SOFABoot open source edition

3.11.1

3.19.1

sofa-common-tools

1.3.6

1.3.11

registry-client-enterprise-all

5.5.1.RELEASE

5.6.0

Indirect third-party dependencies

commons-logging

1.1.1

1.1.2

commons-pool

1.3

1.6

commons-lang

3.3.10

3.3.12.0

io.prometheus:simpleclient

0.10.0

0.15.0

com.beust:jcommander

1.72

1.78

json-path

2.4.0

2.7.0

okio

1.17.2

2.8.0

javax.mail

1.6.2

1.6.7

picocli

4.3.2

4.6.3

byte-buddy

1.10.22

1.12.23

net.minidev

2.3.1

2.4.11

apiguardian-api

1.1.0

1.1.2

assertj-core

3.16.1

3.22.0

org.glassfish.jaxb

2.3.4

2.3.8

javassist

3.19.0-GA

3.28.0-GA

jboss-logging

3.4.2.Final

3.4.3.Final

jboss-annotations-api_1.3_spec

1.0.1.Final

2.0.1.Final

objenesis

2.6

3.1

asm

5.0.4

9.3

reactive-streams

1.0.3

1.0.4

jsonassert

1.5.0

1.5.1

Test frameworks

junit

5.6.3

5.8.2

junit-platform

1.6.3

1.8.2

mockito

3.3.3

3.6.28

testng

6.13.1

7.5

Compatibility notes

  • In SOFABoot 3.10.X, the underlying Spring Boot dependency has been upgraded to the 2.7.X series. For details on features and changes in Spring Boot 2.7.x, see SpringBoot 2.7.15 and Spring Boot 2.7 Release Notes.

  • With the Spring Boot upgrade, the Spring Cloud dependency must also be upgraded to the compatible 2021.0.x series. For more information, see the Spring Cloud reference.

  • Starting with SOFABoot 3.10.2, Spring Boot version control uses `import`. This allows switching the Spring Boot version without upgrading SOFABoot, though only within the 2.7.x series. We recommend using a version no earlier than 2.7.15. For instructions on modifying the version, see How to manually upgrade third-party JARs managed by SOFABoot.

3.6.6 (2023-09-19)

Note

This version includes security hardening and bug fixes compared to version 3.6.5.

Add

RPC now supports a deserialization class blacklist. The blacklist is a comma- or semicolon-separated string of class names. Configuration methods are described below:

Add the following startup parameters:

 -Drpc_serialize_blacklist_override=com.test.class,com.test.clazz
Note

The parameter value shown is an example. Use an appropriate value for your environment.

Fixes

  • Fixed an issue where the console IP address was occasionally displayed incorrectly for the first subscribed service during service subscription.

  • Addressed RPC security vulnerabilities.

  • Fixed an issue where the drm-client connection could not recover after a brief unavailability of the DRMData service.

Updates

Updated the following dependencies:

  • registry-client-all: upgraded from 5.3.1.cloud.20230227 to 5.3.1.cloud.20230509.

  • sofa-rpc-enterprise-all: upgraded from 5.8.15 to 5.8.16.

  • drm-client: upgraded from 3.9.3.4 to 3.9.3.5.

3.6.5 (2023-04-19)

New features

  • SOFARPC is now compatible with Dubbo 2.6.X and 2.7.X and defaults to version 2.7.18.

  • The batch processing client now supports connecting to a specified server-side port. Use batch.server.port to configure a custom port. For example, batch.server.port=9001.

  • Updated the SOFARPC grayscale tag key to SOFA_GREY_LANE:

    • If the SOFA_GREY_LANE or SOFA_GROUP_NAME environment variable is configured, requests are routed to the grayscale group.

    • If the SOFA_GROUP_DEFAULT environment variable is configured, requests are routed to the default group.

    • If none of these variables are configured, requests are routed to any available backend.

Fixes

  • Fixed a long polling failure that occurred when an ACVIP client connected to a server version earlier than 0.21.0.

    This compatibility issue has existed since version 3.4.11.

  • Fixed an incorrect root path for ACVIP Client logs.

    For logback and log4j2, sofa.logging.path takes precedence for root path configuration. If unset, logging.path is used as the fallback. log4j is no longer maintained and is not recommended.

Updates

Updated the following dependencies:

  • rpc: upgraded from 5.9.1 to 5.9.2.

  • commons-io: upgraded from 2.2 to 2.11.0.

  • commons-codec: upgraded from 1.4 to 1.5.

  • antvip: upgraded from 1.1.4 to 1.2.0.

  • gson: upgraded from 2.8.7 to 2.8.9.

3.6.4 (2022-09-06)

New features

  • Tomcat now supports disabling insecure HTTP methods.

    The parameter com.alipay.sofa.security.tomcat.method.disabled has been added. Its default value is false, meaning no restrictions are applied to HTTP methods. When set to true, Tomcat disables all HTTP methods except GET and POST.

  • Added support for the Resteasy4.X framework.

    This change maintains backward compatibility. To use Resteasy4.X for publishing and referencing REST services, manually exclude Resteasy3.6.3 and import Resteasy4.X.

  • Added support for publishing REST services using the web server provided by Spring Boot.

  • Added support for token-based authentication and subscribing to specific service IDs when using Consul as the registry center.

Fixes

  • Fixed an issue where interface-level and method-level timeout parameters in the SOFARPC tr protocol annotation were ineffective.

  • Resolved a thread safety issue in GroupRouter when loading a Group.

Updates

Updated the following dependencies:

  • fastjson: upgraded from 1.2.78 to 1.2.83_noneautotype.

  • jackson: upgraded from 2.11.2 to 2.13.2.1.

  • logback: upgraded from 1.2.3 to 1.2.8.

  • dubbo: upgraded from 2.6.7 to 2.6.12.

  • tomcat: upgraded from 9.0.31 to 9.0.43.

  • grpc: upgraded from 1.28.0 to 1.33.0.

3.6.3 (2022-09-05)

New feature

Updated the tracer log format in RPC. Correct parsing requires RMS 3.12.4 or later. If you cannot upgrade RMS immediately, use the following compatibility parameter in your startup arguments:

-Dcom.alipay.sofa.rpc.compatible.rms3124=true

Fixes

Upgraded Spring Framework from 5.1.14.RELEASE to 5.2.20.RELEASE, which resolves the Spring RCE vulnerability.

Updates

Updated the following dependencies:

  • jackson.version: upgraded from 2.11.2 to 2.11.4.

  • netty: upgraded from 4.1.45 to 4.1.65.

  • Upgraded the dependent SOFABoot open source edition to 3.11.1. For more information, see the release report.

  • Upgraded the following second-party packages:

    • Upgraded com.alipay.sofa:sofa-rpc-all from 5.7.8 to 5.8.3.

    • com.alipay.sofa:bolt: upgraded from 1.5.8 to 1.5.10.

    • The com.alipay.sofa.common:sofa-common-tools dependency is upgraded from version 1.3.2 to 1.3.6.

Compatibility notes

  • Starting with rpc-sofa-boot-starter 3.6.x, Dubbo, Curator, and ZooKeeper are no longer strongly referenced. If you encounter compilation issues after upgrading, manually import the relevant dependencies.

  • In SOFABoot 3.6.x, the underlying Spring Boot dependency has been upgraded from 2.1.13.RELEASE to 2.3.12.RELEASE.

    For details on features and changes in Spring Boot 2.3.12.RELEASE, see SpringBoot 2.3.12.RELEASE and Spring Boot 2.3 Release Notes.

  • With the Spring Boot upgrade, the Spring Cloud dependency must also be upgraded to the compatible version Hoxton.SR12.

3.4.20 (2024-07-08)

Note

This version fixes bugs present in version 3.4.19 and is recommended.

Fixes

Fixed a probabilistic conflict between the DRM heartbeat thread and the initial pull of certain DRM resources at application startup, which previously caused the client to report that it could not retrieve a configured DRM value.

3.4.19 (2023-12-13)

Add

  • RPC now supports the REST protocol in Mesh scenarios.

  • In Mesh scenarios, the RPC framework’s service administration feature is automatically disabled.

  • The registry center client now supports configuring related properties in the configuration file.

Updates

Updated the following dependencies:

  • sofa-rpc-enterprise-all: upgraded from 5.8.15 to 5.8.16.

  • registry-client-enterprise-all: upgraded from 5.6.0 to 5.6.1.

3.4.18 (2023-09-19)

Add

RPC now supports a deserialization class blacklist. The blacklist is a comma- or semicolon-separated string of class names. Configuration methods are described below:

You can add the following to the startup parameters:

 -Drpc_serialize_blacklist_override=com.test.class,com.test.clazz
Note

The parameter value shown is an example. Use an appropriate value for your environment.

Fixes

  • Fixed an issue where the console IP address was occasionally displayed incorrectly for the first subscribed service during service subscription.

  • Addressed RPC security vulnerabilities.

  • Fixed an issue where the drm-client connection could not recover after a brief unavailability of the DRMData service.

Updates

Updated the following dependencies:

  • registry-client-all: upgraded from 5.3.1.cloud.20230227 to 5.3.1.cloud.20230509.

  • sofa-rpc-enterprise-all: upgraded from 5.8.15 to 5.8.16.

  • drm-client: upgraded from 3.9.3.4 to 3.9.3.5.

3.4.17 (2023-05-30)

Add

  • RPC now supports LDC routing in Mesh scenarios.

  • The registry center now supports data compression.

Updates

Updated the following dependencies:

  • sofa-rpc-enterprise-all: upgraded from 5.8.14 to 5.8.15.

  • registry-client-all: upgraded from 5.3.1.cloud.20210713 to 5.3.1.cloud.20230227.

3.4.16 (2023-03-07)

Add

  • SOFARPC is now compatible with Dubbo 2.6.X and 2.7.X and defaults to version 2.7.18.

  • The batch processing client now supports connecting to a specified server-side port. Use batch.server.port to configure a custom port. For example, batch.server.port=9001.

Fixes

  • Fixed an incorrect root path for ACVIP Client logs.

    For logback and log4j2, sofa.logging.path takes precedence for root path configuration. If unset, logging.path is used as the fallback. log4j is no longer maintained and is not recommended.

  • Fixed a long polling failure that occurred when an ACVIP client connected to a server version earlier than 0.21.0.

    This compatibility issue has existed since version 3.4.11.

Updates

Updated the following dependencies:

  • gson: upgraded from 2.8.6 to 2.8.9.

  • antvip: upgraded from 1.1.4 to 1.2.0.

  • rpc: upgraded from 5.8.13 to 5.8.14.

  • commons-codec: upgraded from 1.4 to 1.15.

  • commons-io: upgraded from 2.2 to 2.11.0.

3.4.15 (2022-07-25)

Fixes

Fixed a discrepancy between SOFARPC circuit breaking configuration and actual behavior. Previously, if the circuit breaking request threshold was set to 1 and the RT to 1 ms, the second request would not be subject to circuit breaking even if the first exceeded 1 ms, but the third would be. This issue is now resolved: the second request is correctly subjected to circuit breaking under these conditions.

3.4.14 (2022-06-30)

Add

Tomcat now supports disabling insecure HTTP methods. The parameter com.alipay.sofa.security.tomcat.method.disabled has been added. Its default value is false, meaning no restrictions are applied to HTTP methods. When set to true, Tomcat disables all HTTP methods except GET and POST.

Fixes

Fixed a bug preventing logging.path from specifying the tracerlog directory. This bug has existed since version 3.4.11.

Updates

Updated the following dependencies:

  • fastjson: upgraded from 1.2.78 to 1.2.83_noneautotype.

  • jackson: upgraded from 2.11.2 to 2.13.2.1.

  • logback: upgraded from 1.2.3 to 1.2.8.

  • dubbo: upgraded from 2.6.7 to 2.6.12.

  • tomcat: upgraded from 9.0.31 to 9.0.43.

  • com.antcloud.antvip:antcloud-antvip-common: upgraded from 1.1.0 to 1.1.4.

  • com.antcloud.antvip:antcloud-antvip-client: upgraded from 1.1.0 to 1.1.4.

3.4.13 (2022-06-20)

New features

  • SOFARPC added routing support for hybrid cloud scenarios. To use this feature, enable the hybrid cloud routing switch:

    • Unit-based scenarios: If no available service endpoints exist in the current unit, requests are forwarded through a gateway. A gateway must be deployed in advance for cross-unit communication.

    • Non-unit-based scenarios: If location information is configured for both provider and consumer, routing follows the order zone > datacenter > region.

  • The triple protocol now supports using a gateway as the registry center.

Fixes

Fixed an exception occurring with boundary values (0 or empty) in weight configuration within service routing rules.

Updates

Upgraded dependency: sofa-rpc-enterprise-all from 5.8.9 to 5.8.12.

3.4.12 (2022-03-28)

Updates

Updated the following dependencies:

  • com.alipay.sofa:antschedulerclient-core: upgraded from 1.3.4 to 1.7.0.

  • com.alipay.sofa:antschedulerclient-acvip: upgraded from 1.3.4 to 1.7.0.

3.4.11 (2021-12-21)

Add

  • Added convergence for calls to DRM, ACVIP, and Registry within the same data center.

  • Added a version that addresses the log4j-core vulnerability.

  • The run.mode field now accepts numeric values.

Fixes

  • Fixed an issue where multilayer splitting of cluster tasks caused repeated execution due to only one shard being returned per layer.

  • Fixed an issue where the automatic configuration switch for the SOFATracer datasource was ineffective.

Updates

Updated the following dependencies:

  • sofaboot-dependencies: upgraded from 3.4.5 to 3.4.7.

  • sofatracer-all: upgraded from 3.1.1 to 3.1.2.

  • zoneclient-core: upgraded from 1.1.1 to 1.2.1.antcloud.

  • drm.version: upgraded from 3.9.3.3 to 3.9.3.4.

  • acvip.version: upgraded from 1.0.7 to 1.1.0.

  • registry.version: upgraded from 5.1.1 to 5.5.1.RELEASE.

  • ant.scheduler.version: upgraded from 1.1.6 to 1.3.4.

  • Added the registry-client-all: 5.3.1.cloud.20210713 dependency.

  • metrics.client.version: upgraded from 2.0.2 to 2.0.3.

  • fastjson: upgraded from 1.2.69 to 1.2.78.

  • hessian: upgraded from 3.3.12 to 3.3.13.

  • Added a dependency on a version that addresses the log4j-core vulnerability: 2.11.2_nonelookup2.

3.4.9 (2021-07-29)

Fixes

RPC: Fixed an issue where the consumer’s default timeout configuration invalidated the server-side timeout setting.

Updates

  • Upgraded the commercial edition of SOFARPC to 5.8.9.

  • Upgraded SOFABolt to 1.5.8.

3.4.8 (2021-07-16)

Add

Added support for clearing the context of internal RPC threads for HTTP requests. This is controlled by the com.alipay.sofa.rpc.mvcRemoveRpcContext environment variable, which defaults to false (do not clear).

Fixes

Fixed an inconsistency between SOFARPC xsd configuration and the open source configuration.

Updates

  • Upgraded the commercial edition of SOFARPC to 5.8.8 and the open source edition to 5.7.8.

    For the open source SOFARPC release notes, see SOFARPC Release Notes.

  • Upgraded SOFATracer to 3.1.1.

    For the release notes, see SOFATracer Release Notes.

3.4.7 (2021-03-26)

New features

  • Added the sofa.common.tools JAR package, version 1.3.2.

  • Java Management Extensions (JMX) is now disabled by default for drm-client.

  • drm-client now supports Spring Cloud and retrieves the entire Resource by resourceId, returning it in properties format.

Fixes

  • Fixed an issue where the default.registry parameter could not be configured.

  • Fixed a dependency issue with sofa-middleware-log in ZoneClient 1.1.1, introduced in version 3.4.6.

  • Fixed an issue where SOFAGateway connection failures under SOFARPC exhausted the connection pool.

  • The log4j configuration in the SOFA framework is incorrect.

  • Fixed an issue where SOFARPC did not support SOFAREST service administration capabilities.

Updates

  • Upgraded the commercial RPC edition to 5.8.7 and the open source edition to 5.7.7.

  • Upgraded drm-client to 3.9.3.3.

3.4.6 (2020-11-15)

Fixes

  • Fixed an issue where the SOFABoot version was displayed incorrectly at startup.

  • The startup process cannot locate the log configuration file.

Updates

  • Upgraded the dependent SOFABoot open source edition to 3.4.6.

  • Updated sofa.hessian.version to 3.3.11.

3.4.5 (2020-11-15)

Note

Version 3.4.5 contains a logging-related bug fixed in version 3.4.6. We recommend using version 3.4.6.

Add

  • Fault injection for SOFARPC.

  • Service routing for SOFARPC.

  • Service circuit breaking for SOFARPC.

Fixes

  • Fixed a bug where the @Tracer method annotation interceptor repeatedly removed the Trace context when a method threw an exception.

  • Addressed security vulnerabilities.

Updates

  • Upgraded the dependent SOFABoot open source edition to 3.4.5.

  • Upgraded SOFARPC to 5.8.5.

  • Upgraded Guardian to 1.4.15.

  • Upgraded jackson.version to 2.11.2.

  • Upgraded sofa.hessian.version to 3.3.10.

  • Unified the circuit breaking models for Mesh and RPC.

  • The second-party package com.alipay.zoneclient:zoneclient-core:1.1.0 has been upgraded to com.alipay.zoneclient:zoneclient-core:1.1.1 to resolve the dependency of the zoneclient on central control and prevent cross-VPC network access in the public cloud.

3.4.4 (2020-08-05)

Fixes

  • Fixed an issue where the prefetch forwarding feature was ineffective.

  • An issue occurred with service authentication.

  • A faulty reference to `AuthFilter`.

Updates

  • Upgraded the dependent SOFABoot open source edition to 3.4.4.

  • Upgraded SOFA RPC to 5.8.3.

3.4.3 (2020-07-29)

Fixes

  • A premature initialization issue during Guardian auto-configuration.

  • Fixed a key read error caused by missing trim operations when the framework set JVM System variables.

  • A memory leak occurs in the AntScheduler ONEWAY cluster.

  • Fixed an MD5 consistency check failure during AntScheduler sharding.

Updates

Upgraded AntScheduler Client to 1.1.6.

3.4.2 (2020-06-24)

New feature

Added application-level service authentication for SOFARPC. The granularity of authentication rules depends on the status of the service-level authentication rule switch:

  • Switch on: Coarse-grained service-level authentication rules apply.

  • Switch off: Fine-grained application-level authentication rules apply.

Fixes

  • Fixed an issue where an incorrect uniqueName calculation during publishing caused the unexport operation to fail.

  • The zoneClient experiences high latency during the first RPC call.

Updates

  • Adjusted the LdcRouteProvider order.

  • Upgraded the dependent SOFABoot open source edition to 3.4.1.

3.4.1 (2020-06-02)

New feature

The Bolt protocol now supports multiple parameters for JSON serialization interfaces.

Updates

  • Upgraded Fastjson to 1.2.69.

  • Upgraded the dependent SOFABoot open source edition to 3.4.1.

  • Upgraded the second-party package com.alibaba:fastjson:1.2.67 to com.alibaba:fastjson:1.2.69.

3.3.2 (2020-04-15)

New features

  • SOFARPC now supports displaying interface information with Swagger.

  • Linke now supports joint debugging environments.

Fixes

Fixed an issue where service access control configuration was ineffective.

Updates

  • Upgraded FastJson to 1.2.67.

  • Upgraded SOFARest to 1.7.2.

  • Upgraded SOFALookout to 1.5.7.

  • Upgraded the dependent SOFABoot open source edition to 3.3.2.

  • Second-party packages:

    • com.alibaba:fastjson:1.2.66 upgraded to com.alibaba:fastjson:1.2.67

    • com.alipay.sofa:sofa-rest-runtime-integration:1.6.16 upgraded to com.alipay.sofa:sofa-rest-runtime-integration:1.7.2

    • com.alipay.sofa:sofa-rest-api:1.6.16 upgraded to com.alipay.sofa:sofa-rest-api:1.7.2

    • com.alipay.sofa:sofa-rest-log:1.6.16 upgraded to com.alipay.sofa:sofa-rest-log:1.7.2

    • com.alipay.sofa:sofa-rest-spi:1.6.16 upgraded to com.alipay.sofa:sofa-rest-spi:1.7.2

    • com.alipay.sofa:sofa-rest-common:1.6.16 upgraded to com.alipay.sofa:sofa-rest-common:1.7.2

    • com.alipay.sofa:sofa-rest-core:1.6.16 upgraded to com.alipay.sofa:sofa-rest-core:1.7.2

    • com.alipay.sofa:sofa-rest-spring:1.6.16 upgraded to com.alipay.sofa:sofa-rest-spring:1.7.2-com.alipay.sofa.lookout:lookout-enterprise-sofa-boot-starter:1.5.4 upgraded to com.alipay.sofa.lookout:lookout-enterprise-sofa-boot-starter:1.5.7

3.3.1 (2020-03-17)

Updates

  • Upgraded FastJson to 1.2.66.

  • Upgraded the managed DTX Client to 2.1.1.

  • Upgraded the dependent SOFABoot open source edition to 3.3.1.

  • Upgraded Spring Boot to 2.1.13.RELEASE, which addresses the Tomcat AJP vulnerability.

    Note

    SOFABoot does not use Tomcat AJP by default and is therefore unaffected by this vulnerability. This Tomcat upgrade further enhances security.

  • Second-party packages:

    • com.alibaba:fastjson:1.2.62 upgraded to com.alibaba:fastjson:1.2.66

    • com.alipay.dtx:dtx-sofaboot:2.1.0 upgraded to com.alipay.dtx:dtx-sofaboot:2.1.1

      Note

      The latest version of the Mobile PaaS (mPaaS) starter is 2.3.0, with LDC enabled by default. If your application does not support LDC, add the following dependency to your application’s main pom.xml file:

      <dependency><br/>
     <groupId>com.alipay.sofa</groupId><br/>
     <artifactId>runtime-enterprise-sofa-boot-starter</artifactId><br/>
</dependency>

3.3.0 (2020-02-24)

Add

  • Added support for Unit-based Architecture.

    Note

    LDC is enabled by default. If your application does not support LDC, add the following dependency to your application’s main pom.xml file:

    <dependency>
     <groupId>com.alipay.sofa</groupId>
     <artifactId>runtime-enterprise-sofa-boot-starter</artifactId>
</dependency>

  • RPC Reference timeout configuration now supports Expression Language (EL) expressions.

  • SOFAMQ starter

Updates

  • Upgraded the dependent SOFABoot open source edition to 3.3.0.

  • Upgraded Spring Boot to 2.1.11.RELEASE.

  • Second-party packages:

    • com.alipay.sofa:sofa-rpc-enterprise-all:5.6.2 upgraded to com.alipay.sofa:sofa-rpc-enterprise-all:5.7.0

    • com.alibaba:fastjson:1.2.60 upgraded to com.alibaba:fastjson:1.2.62

3.2.2 (2020-02-14)

Add

  • The health check starter is now included by default.

  • Second-party packages:

    • com.alipay.sofa:sofa-tracer-datasource-plugin:3.0.10

    • com.alipay.sofa:sofa-tracer-flexible-plugin:3.0.10

    • com.alipay.sofa:sofa-tracer-resttmplate-plugin:3.0.10

    • com.alipay.sofa:sofa-tracer-springmvc-plugin:3.0.10

    • com.alipay.sofa:sofa-tracer-spring-cloud-plugin:3.0.10

    • com.alipay.sofa:sofa-tracer-zipkin-plugin:3.0.10

Fixes

Failed health checks

Updates

  • Upgraded the dependent SOFABoot open source edition to 3.2.2.

  • Second-party packages:

    • com.alipay.sofa:antschedulerclient-core:1.0.7 upgraded to com.alipay.sofa:antschedulerclient-core:1.0.8

    • com.alipay.sofa:antschedulerclient-antvip:1.0.7 upgraded to com.alipay.sofa:antschedulerclient-antvip:1.0.8

    • com.alipay.sofa:tracer-core:3.0.8 upgraded to com.alipay.sofa:tracer-core:3.0.10

    • com.alipay.sofa:tracer-extensions:3.0.8 upgraded to com.alipay.sofa:tracer-extensions:3.0.10

    • com.alipay.sofa:sofa-tracer-httpclient-plugin:3.0.8 upgraded to com.alipay.sofa:sofa-tracer-httpclient-plugin:3.0.10

    • com.alipay.common:tracer:3.0.5 upgraded to com.alipay.common:tracer:3.0.7

    • com.alipay.sofa:tracer-enterprise-httpclient-plugin:3.0.5 upgraded to com.alipay.sofa:tracer-enterprise-httpclient-plugin:3.0.7

    • com.alipay.sofa:tracer-enterprise-dst-plugin:3.0.5 upgraded to com.alipay.sofa:tracer-enterprise-dst-plugin:3.0.7

      Note

      The latest version of the Mobile PaaS (mPaaS) starter is 2.3.0.

3.2.1 (2019-12-17)

Add

  • Configuration files can now use the `.yml` extension.

  • Added support for the Bolt dynamic API.

  • RPC now supports using ZooKeeper as a registry center.

  • RPC now supports publishing and referencing services via annotations.

  • RPC now supports graceful shutdown.

Fixes

Health check failures.

Updates

  • Upgraded the dependent SOFABoot open source edition to 3.2.1.

    Note

    Do not upgrade applications using task scheduling to SOFABoot 3.2.1.

  • Second-party packages:

    • com.alipay.sofa:tracer-core:3.0.7 upgraded to com.alipay.sofa:tracer-core:3.0.8

    • com.alipay.sofa:tracer-extensions:3.0.7 upgraded to com.alipay.sofa:tracer-extensions:3.0.8

    • com.alipay.sofa:tracer-enterprise-httpclient-plugin:3.0.4 upgraded to com.alipay.sofa:tracer-enterprise-httpclient-plugin:3.0.5

    • com.alipay.sofa:tracer-enterprise-sofa-boot-starter:3.0.4 upgraded to com.alipay.sofa:tracer-enterprise-sofa-boot-starter:3.0.5

    • com.alipay.common:tracer:3.0.4 upgraded to com.alipay.common:tracer:3.2.1

    • com.antcloud.antvip:antcloud-antvip-client:1.0.6 upgraded to com.antcloud.antvip:antcloud-antvip-client:1.0.7

    • com.antcloud.antvip:antcloud-antvip-common:1.0.6 upgraded to com.antcloud.antvip:antcloud-antvip-common:1.0.7

    • com.alipay.sofa:bolt:1.4.6 upgraded to com.alipay.sofa:bolt:1.5.6

      Note

      The latest version of the Mobile PaaS (mPaaS) starter is 2.3.0.

3.1.0 (2019-09-02)

Add

Fixes

RPC may enter a disconnection-reconnection loop during network fluctuations.

Updates

  • Managed middleware versions for SOFARPC, MQ, Tracer, and Guardian: see the aggregate table of updated starter information in the latest version released in this document.

  • Enhanced annotation-based service publishing and referencing. For more information, see Publish and reference JVM services.

  • Upgraded the dependent SOFABoot open source edition to 3.1.0.

    • The underlying Spring Boot dependency has been upgraded from 2.0.3.RELEASE to 2.1.0.RELEASE.

      For details on features and changes in Spring Boot 2.1.0.RELEASE, see SpringBoot 2.1.0.RELEASE and Spring Boot 2.1 Release Notes.

    • With the Spring Boot upgrade, the Spring Cloud dependency must also be upgraded to a compatible version in the Greenwich series.

  • Second-party packages:

    • com.alipay.sofa:tracer-core:3.0.1 upgraded to com.alipay.sofa:tracer-core:3.0.3

    • com.alipay.sofa:tracer-extensions:3.0.1 upgraded to com.alipay.sofa:tracer-extensions:3.0.3

    • com.alipay.sofa:tracer-enterprise-httpclient-plugin:3.0.0 upgraded to com.alipay.sofa:tracer-enterprise-httpclient-plugin:3.0.1

    • com.alipay.sofa:tracer-enterprise-sofa-boot-starter:3.0.0 upgraded to com.alipay.sofa:tracer-enterprise-sofa-boot-starter:3.0.1

    • com.alipay.common:tracer:3.0.0 upgraded to com.alipay.common:tracer:3.0.1

    • com.alipay.sofa.lookout:lookout-enterprise-sofa-boot-starter:1.5.1 upgraded to com.alipay.sofa.lookout:lookout-enterprise-sofa-boot-starter:1.5.4

    • com.alipay.sofa.lookout:lookout-api:1.5.0 upgraded to com.alipay.sofa.lookout:lookout-api:1.5.4

      Note

      The latest version of the Mobile PaaS (mPaaS) starter is 2.3.0.

Previous：Edition selectionNext：Version compatibility description