From 24c8656062ede8b77276ad88ca47103e524c599e Mon Sep 17 00:00:00 2001 From: Saurabh Jain Date: Sat, 25 Apr 2026 15:57:53 +0200 Subject: [PATCH 1/2] chore(release): Java SDK v6.0.0 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Major release. Driven by a single observable-contract change: WebhookSubscription.equals() and .hashCode() are now identity-based on id, not value-based on every field. The prior value-based equality was a bug — WebhookSubscription is an entity, not a value object — but equals/hashCode are part of the public Java contract that callers depend on for set deduplication, map lookup, and identity caches, so the fix is breaking per strict semver. Bumps: - pom.xml: 5.7.0 -> 6.0.0 - CHANGELOG [Unreleased] -> [6.0.0] - 2026-04-25 Wire-shape baseline regenerated against community SHA 10d44eb4 (post platform v7.4.2 spec corrections). DynamicPolicyInfo entry auto-resolves. Net 39 -> 38. Coordinated v6 alignment release: ships same day as TypeScript v6.0.0, Python v6.7.0, Go v5.7.0. The TS and Java repos needed major bumps; Python and Go ship as minor because their changes are purely additive. --- CHANGELOG.md | 20 +++++++++++++++----- pom.xml | 2 +- tests/fixtures/wire-shape-baseline.json | 19 +------------------ 3 files changed, 17 insertions(+), 24 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 799c910..98ea474 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,10 +7,19 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] -### Fixed +## [6.0.0] - 2026-04-25 — Major: WebhookSubscription identity-based equality -- Telemetry pings now deliver reliably from short-lived JVMs (CLI, serverless, cold-starts). `AxonFlow` construction blocks briefly while the ping is sent synchronously (bounded by the telemetry timeout). -- Telemetry path is bounded at `TIMEOUT_SECONDS` (3s) total; the `/health` probe and checkpoint POST share a single monotonic deadline instead of stacking independent timeouts. +This is a major release. The bump is driven by a single observable-contract change: `WebhookSubscription.equals()` and `.hashCode()` now compare on `id` only, not every field. Coordinated with the TypeScript SDK v6.0.0 release (PolicyInfo rename) as a v6 alignment cycle for the SDKs that needed breaking changes; Python (v6.7.0) and Go (v5.7.0) ship as minor on the same day because their changes are purely additive. + +### BREAKING — `WebhookSubscription` equality is now identity-based on `id` + +`WebhookSubscription` is an entity, not a value object. Two instances with the same `id` represent the same logical webhook regardless of whether one view has loaded `secret` (only returned by `createWebhook`) and another has not, or whether `updatedAt` / `active` have moved between fetches. + +Previously `equals()` / `hashCode()` compared every field. That meant a webhook constructed locally with the legacy 6-arg constructor compared **unequal** to the same logical webhook deserialized from a server response that included `secret` / `tenantId` / `orgId`. `Set`, `Map` keying, and identity-tracking caches all broke under those semantics. + +Identity-based equality is the canonical entity semantics; the prior value-based equality was a bug. Because `equals()` / `hashCode()` are part of the observable Java contract that callers depend on for set deduplication, map lookup, and identity caches, the fix is a breaking change per strict semver — even though the new behaviour corrects incorrect semantics rather than introducing them. + +If you need content-equality (e.g. to detect a rotated `secret`), compare the relevant getters directly. The 6-arg constructor is preserved as a source-compat overload for callers building local instances; only `equals()` / `hashCode()` semantics changed. `toString()` is unchanged (still emits full state with `secret` redacted). ### Added @@ -19,9 +28,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - **`WebhookSubscription.secret`** — HMAC-SHA256 signing key now exposed on the response from `createWebhook`. Required to verify the `X-AxonFlow-Signature` header on inbound webhook deliveries; without it, callers can't validate payload authenticity. Also adds `tenantId` and `orgId` (ownership scoping). The 6-arg constructor is preserved as a source-compat overload that delegates to the 9-arg with nulls for the new fields. `toString()` redacts `secret` to avoid log leakage. - **`BudgetAlert.acknowledged`** — alert dismissal flag. Also adds `@JsonProperty` annotations on previously-unannotated fields (`id`, `threshold`, `message`) so the wire-shape gate can see them; Jackson's default name mapping was correct, but the validator's discovery walks `@JsonProperty` only. -### Changed +### Fixed -- **`WebhookSubscription` equality is now identity-based on `id`.** A `WebhookSubscription` is an entity, not a value object — two instances with the same `id` represent the same subscription, regardless of whether one view has loaded `secret` (returned by `createWebhook` only) and another has not, or whether `updatedAt`/`active` have moved between fetches. Previously `equals()`/`hashCode()` compared every field; that meant a webhook constructed locally with the legacy 6-arg constructor would have compared **unequal** to the same logical webhook deserialized from a server response that included `secret`/`tenantId`/`orgId`. `Set`, `Map` keying, and identity-tracking caches all break under that semantics. Identity-based equality fixes those at the source. If you need content-equality (e.g. to detect a rotated secret), compare the relevant getters directly. Same change applies to `hashCode()`. `toString()` is unchanged (still includes the full state with `secret` redacted). +- Telemetry pings now deliver reliably from short-lived JVMs (CLI, serverless, cold-starts). `AxonFlow` construction blocks briefly while the ping is sent synchronously (bounded by the telemetry timeout). +- Telemetry path is bounded at `TIMEOUT_SECONDS` (3s) total; the `/health` probe and checkpoint POST share a single monotonic deadline instead of stacking independent timeouts. ## [5.7.0] - 2026-04-22 diff --git a/pom.xml b/pom.xml index 996c782..c26fa07 100644 --- a/pom.xml +++ b/pom.xml @@ -6,7 +6,7 @@ com.getaxonflow axonflow-sdk - 5.7.0 + 6.0.0 jar AxonFlow Java SDK diff --git a/tests/fixtures/wire-shape-baseline.json b/tests/fixtures/wire-shape-baseline.json index c5457f6..08d9656 100644 --- a/tests/fixtures/wire-shape-baseline.json +++ b/tests/fixtures/wire-shape-baseline.json @@ -182,7 +182,7 @@ "PolicyMatch": 2 } }, - "openapi_specs_sha": "bf1ca22ae4bee37dbccc91aee7e03c805f73f853", + "openapi_specs_sha": "10d44eb4585a7b5321d7286b354ff8b43b8c6a57", "per_type_drift": { "AuditLogEntry": { "sdk_only": [ @@ -276,23 +276,6 @@ ], "spec_only": [] }, - "DynamicPolicyInfo": { - "sdk_only": [ - "orchestrator_reachable", - "policies_evaluated", - "processing_time_ms" - ], - "spec_only": [ - "block_reason", - "blocked", - "enabled", - "error", - "evaluated", - "evaluation_time_ms", - "policies_checked", - "policies_matched" - ] - }, "DynamicPolicyMatch": { "sdk_only": [ "reason" From ef17997a4f93f15d800caad5f73bbdb239273012 Mon Sep 17 00:00:00 2001 From: Saurabh Jain Date: Sat, 25 Apr 2026 16:07:42 +0200 Subject: [PATCH 2/2] ci: retrigger wire-shape gate with spec-pin-bump label