Repository navigation
Replace the last deprecated calls: Grizzly SSLContextConfigurator and SecurityManager - #138
Merged
vharseko merged 1 commit intoOct 2, 2026
Conversation
… SecurityManager createSSLContext() is deprecated in favour of createSSLContext(boolean); the no-arg version is exactly createSSLContext(false) (verified against the Grizzly source), so the three call sites switch to that with no behaviour change. CCLWatchThreadFactory is its own copy of java.util.concurrent.Executors.DefaultThreadFactory. The JDK's own copy dropped the SecurityManager check once the Security Manager was permanently disabled (JEP 486); this one follows suit.
vharseko
added
java
maximthomas
approved these changes
Oct 2, 2026
maximthomas
left a comment
maximthomas
left a comment
Contributor
There was a problem hiding this comment.
praise: The Grizzly swap is exactly equivalent, and the evidence holds across the whole supported range.
SSLContextConfigurator.createSSLContext()isreturn createSSLContext(false);in 3.0.1 source, andaload_0; iconst_0; invokevirtual createSSLContext:(Z)in the 4.0.2 bytecode, so the OSGi import range[3.0,5)changes nothing atConnectionManager.java:301,305andConnectorServer.java:370.- The "together with #134" claim checks out: every file on master with an open
java/deprecated-callalert is one of these three or in #134's file list.
2 tasks done
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes the remaining
java/deprecated-callalerts on real (non-MessagesUtil.*Legacy) code:SSLContextConfigurator.createSSLContext(3) andSystem.getSecurityManager(1). Together with the 67MessagesUtil.serializeLegacy/deserializeLegacyalerts (dismissed as "won't fix" — see below) and the reflection/boxing/close alerts fixed in #134, this closesjava/deprecated-callentirely.SSLContextConfigurator.createSSLContext() — 3 sites
Grizzly's
SSLContextConfigurator.createSSLContext()is deprecated in favour ofcreateSSLContext(boolean throwException). Checked the Grizzly source: the no-arg version is literallyreturn createSSLContext(false);— identical behaviour, soConnectionManager.java(×2) andConnectorServer.java(grizzly, ×1) switch tocreateSSLContext(false)with no behaviour change.System.getSecurityManager() — CCLWatchThreadFactory
This class's own comment says it is "Copied from java.util.concurrent.Executors.DefaultThreadFactory". Checked the current JDK's own copy of that class (OpenJDK 26 source): it has since dropped the
SecurityManagerbranch entirely, now unconditionallygroup = Thread.currentThread().getThreadGroup();— matching the permanent disabling of the Security Manager in JEP 486. This PR makes the same change here, with a comment explaining why.MessagesUtil.serializeLegacy / deserializeLegacy — 67 alerts, dismissed, not touched
These are the framework's only serialization path for payloads its own wire protocol defines as opaque
bytesrather than structured protobuf messages —scriptArguments(CommonObjectMessages.proto),connectorObject,attributes, and the sync tokenvalue(OperationMessages.proto). There is no drop-in non-deprecated alternative without redefining the wire protocol, which would break compatibility with the .NET connector server and existing clients. Dismissed on GitHub as "won't fix" with that reasoning recorded on each alert.Tests
No new tests: both changes are behaviour-preserving (verified against the Grizzly source and the current JDK source respectively), and neither has an observable difference a test could assert on.
Local runs of the three touched modules, all green: connector-framework-internal 469 tests (2 skipped, same as on master), connector-framework-server 29, connector-server-grizzly 34.