The default serialization library behind Broadleaf’s Caffeine and EHCache caching support has been Apache Fury.
Starting with Broadleaf Release Trains 3.0.0, 2.2.3, and 2.1.7, Apache Fury has been upgraded to Apache Fory. Apache Fory is a renamed continuation of the original library. While it introduces minor API changes, it brings a host of bugfixes and improvements that warrant the upgrade. Most notably, the upgrade fixes an issue that could corrupt serialized output in highly concurrent environments.
|
Warning
|
Most clients do not need to do anything to absorb this change, as the dependencies and classes involved are rarely directly used or extended outside the framework itself. However, if your project has explicitly configured or overridden Fury-related behavior, this section provides a short list of key changes that may be required. |
<!-- Before -->
<dependency>
<groupId>org.apache.fury</groupId>
<artifactId>fury-core</artifactId>
</dependency>
<!-- After -->
<dependency>
<groupId>org.apache.fory</groupId>
<artifactId>fory-core</artifactId>
<!-- Version is managed by the Broadleaf base dependencies pom -->
</dependency>Both classes stay in com.broadleafcommerce.common.extension.serialization:
| Before | After |
|---|---|
|
|
|
|
FurySerializer.getInstance() becomes ForySerializer.getInstance(). The Serializer and Cloner interfaces, and the defaultSerializer and defaultCloner bean names, are unchanged, so a project that injects Serializer or Cloner rather than the implementation needs no change.
If using a custom ClassChecker instead of the default RegexAllowListChecker, it must be migrated to the renamed TypeChecker interface:
| Before | After |
|---|---|
|
|
|
|
The default value of com.broadleafcommerce.serialization.convert.standard-allow-list previously included org.apache.fury.*, but now contains org.apache.fory.* instead.
A project that replaced com.broadleafcommerce.serialization.convert.standard-allow-list wholesale, or that added a Fury package to additional-allow-list, must update those entries to point to Fory instead.
Fory’s instance pool is fixed-size and eagerly allocated: max-pool-size instances are created at startup, retained for the pool’s lifetime, and never evicted, and a caller blocks once every instance is checked out.
max-pool-size still sets the size, so existing configuration keeps working, but the two properties that described a growing pool no longer map to anything and must be removed from both the convert and clone sections:
| Removed property | Note |
|---|---|
|
Remove. The pool has one size, set by |
|
Remove. Pooled instances are never evicted. |
|
Remove. The pool has one size, set by |
|
Remove. Pooled instances are never evicted. |
If a deployment set min-pool-size above max-pool-size, review max-pool-size before upgrading - that is now the only size the pool has.