Upgrade Notes for Dropwizard 2.1.x
Hibernate Validator Expression Language overhaul
The Expression Language is now disabled by default for custom violations.
@SelfValidating feature has been a source of various security vulnerabilities in Dropwizard:
This originally lead to the introduction of SelfValidating#escapeExpressions().
Due to some changes regarding the interpolation of messages in custom violations in Hibernate Validator 6.2.0.Final and later, this flag is not required anymore and has been removed in Dropwizard 2.1.0.
While strongly discouraged, you can enable EL interpolation in custom violations with Hibernate Validator, by customizing the
HibernateValidatorConfiguration created by
Validators#newConfiguration() and use the Hibernate Validator instance created from it in your application via
Details about these changes in Hibernate Validator can be found at:
Migrating from dropwizard-health
Migrating from the HealthBundle
dropwizard/dropwizard-health module Starting in Dropwizard 2.1, the functionality from the external dropwizard/dropwizard-health module has been integrated into the main dropwizard/dropwizard project.
Perform the following steps to migrate your application:
Remove the HealthBundle from your Application’s initialize() method.
Remove the reference to HealthConfiguration from your application’s Configuration class.
Migrate YAML configuration previously associated with your HealthConfiguration field to instead be nested under a top-level health field (at the same level as server, logging, and metrics).
Review the new and changed configuration options mentioned below.
Ensure that you don’t already have a custom configuration class member using the health name or rename it to something else or nest it under another field in order not to conflict with the new top-level field.
Remove the dependency on the io.dropwizard.modules:dropwizard-health library from your application’s pom.xml file (or other build dependency definition file).
New Configuration Options
enabledflag added to turn on/off health functionality (defaults to
nameconfiguration added, used in metric naming, thread naming, and log messages.
responderfactory added, to control how health check requests are responded to. For more info, see the config reference.
responseProviderfactory added, to control the body of health check responses, separate from the mechanics of responding. For more info, see the config reference.
Changed Configuration Options
delayedShutdownHandlerEnableddefault value changed to
servletremoved in favor of the new