SpringBoot spring.datasource.dbcp2.username and spring.datasource.dbcp2.password are incorrectly marked as deprecated

We bind spring.datasource.dbcp2 to third-party code, namely org.apache.commons.dbcp2.BasicDataSource. getUsername and getPassword on BasicDataSource have been marked as deprecated but setUsername and setPassword have not. For configuration property binding purposes this means that they are not deprecated – the binder only need to call the setters – but the generated metadata states that they are deprecated.

I think there's a general problem here and this is a specific symptom of that problem. The problem is that a getter being deprecated is sufficient for a configuration property to be flagged as deprecated. For a scalar property, I think we should consider requiring the setter to be deprecated before flagging the property as deprecated. For maps, lists, and nested properties, a deprecated getter is probably sufficient signal as the binder needs to use the getter to retrieve any existing value.

Flagging for discussion in a team meeting to decide if and where we should fix this. Given that it's a more general problem, we may want to apply a fix in 3.1.x.

Comment From: cxhello

@wilkinsona Is the solution to this problem to modify these two configurations in spring-configuration-metadata.json ? If so, can this issue be assigned to me?

{
    "properties": [
        {
            "name": "spring.datasource.dbcp2.password",
            "type": "java.lang.String",
            "sourceType": "org.apache.commons.dbcp2.BasicDataSource",
            "deprecated": true,
            "deprecation": {}
        },
        {
            "name": "spring.datasource.dbcp2.username",
            "type": "java.lang.String",
            "sourceType": "org.apache.commons.dbcp2.BasicDataSource",
            "deprecated": true,
            "deprecation": {}
        }
    ]
}

Comment From: quaff

@wilkinsona Is the solution to this problem to modify these two configurations in spring-configuration-metadata.json ? If so, can this issue be assigned to me?

{ "properties": [ { "name": "spring.datasource.dbcp2.password", "type": "java.lang.String", "sourceType": "org.apache.commons.dbcp2.BasicDataSource", "deprecated": true, "deprecation": {} }, { "name": "spring.datasource.dbcp2.username", "type": "java.lang.String", "sourceType": "org.apache.commons.dbcp2.BasicDataSource", "deprecated": true, "deprecation": {} } ] }

spring-configuration-metadata.json is generated not a source file.

Comment From: cxhello

@quaff Sorry, it was my mistake. It is automatically generated. Is it possible to solve this issue by upgrading dbcp2 to 2.11.0?

Comment From: quaff

@quaff Sorry, it was my mistake. It is automatically generated. Is it possible to solve this issue by upgrading dbcp2 to 2.11.0?

It's actually false positive reported by spring boot, nothing related to dbcp2.

Comment From: cxhello

@quaff OK, I understand, thanks for your answer.

Comment From: wilkinsona

We're going to look at a fix that focuses only on the DBCP2 properties for now at least. We don't think we can change to requiring the setter to be deprecated as it would be a breaking change.