Bloomreach Content and Spring

Overview

Bloomreach Content uses Spring Boot (in CMS webapp) and Spring Framework (in CMS and site webapps), for example for dependency injection and aspect-oriented Programming within its delivery framework (HST) to manage internal components. Also Spring Security (CRISP) and Spring Integration (Content Feed Addon) are used.

This page explains:

• Supported Spring Boot and Spring Framework versions for each Bloomreach Content release

• Bloomreach Content and OSS supported Spring versions

• How the delivery framework manages its internal Spring ApplicationContexts, how to override, extend and access internal components

Version Compatibility

Bloomreach Content	Spring Boot	Spring Framework	Spring Security	End of OSS Support *
17.x	4.x	7.x	7.x	December 2027
16.9.x	3.5.x	6.2.x	6.5.x	June 2026
15.7.x	2.7.x	5.3.x	5.8.x	June 2023

(*) See Spring Boot Support table for complete time lines.

Bloomreach only ships Spring versions that are under OSS support

Within a given Bloomreach Content major version, Spring is kept up to date with the OSS patch releases of the Spring line listed in the compatibility matrix above, up to the point where that line reaches its OSS end-of-support date.

Once a Spring line leaves OSS support, its further patch releases (including security fixes) are published only through the commercial Spring Enterprise Subscription repository operated by Broadcom (Tanzu). Those artifacts are licensed per subscriber and are distributed from a credentialed, non-public Maven repository.

Bloomreach is not permitted to redistribute or mirror Spring Enterprise artifacts in its own Maven repository and cannot make a commercial Spring subscription a prerequisite for building a Bloomreach Content project. Doing so would break the build for every customer without such a subscription.

Therefore, Bloomreach Content cannot upgrade to Spring Framework or Spring Boot versions that
are available only under commercial (Enterprise) support. The supported path to a newer, OSS-supported Spring line is to upgrade to a newer Bloomreach Content major version (see the compatibility matrix above).

Using Spring Enterprise artifacts on Bloomreach Content

Customers on Bloomreach Content who hold their own Spring Enterprise
Subscription may use the commercial Spring patch releases in their project. The Spring versions
are defined as Maven properties in the hippo-cms7-project parent POM, so they can be
overridden in the <properties> section of your project's root pom.xml.

The generated project root pom.xml already contains a placeholder section for this (see below).

1. Configure access to the Spring Enterprise repository

Configure the Spring Enterprise Maven repository and your registry credentials as described in the Spring Enterprise Subscription documentation provided by Broadcom. Make sure the credentials are available in every environment that builds the project (see the constraints below).

2. Override the Spring version properties

Set the properties in the <properties> section of your project's root pom.xml. For example, for Bloomreach Content 16.x:

<properties>
  <!-- ***START temporary override of versions*** -->
  <spring-boot.version>3.5.x</spring-boot.version>
  <spring.version>6.2.x</spring.version>
  <spring-security.version>6.5.x</spring-security.version>
  <spring-integration-ftp.version>6.5.x</spring-integration-ftp.version>
  <spring-integration-sftp.version>6.5.x</spring-integration-sftp.version>
  <!-- ***END temporary override of versions*** -->
</properties>
copy

Replace x with the commercial patch version you want to consume.

3. Constraints and support implications

• Only override to a patch release within the same minor line that your Bloomreach Content
  version was built and tested against (for example 16.9.x with Spring Framework 6.2.y). Moving
  to a different minor or major Spring line is not supported and will break binary compatibility
  with the Bloomreach Content artifacts.

• Bloomreach does not test Bloomreach Content against Spring Enterprise patch releases. Verify
  the resulting build with your own test suite before deploying to production.

• Issues that can only be reproduced with an overridden Spring version fall outside standard
  Bloomreach support. Reproduce the issue on the shipped Spring version before raising a support
  ticket.

Spring Framework Usage in the Delivery Framework

The delivery framework manages all internal container components using Spring Framework ApplicationContexts and relies on Dependency Injection for component wiring.

Internal Component Management

The delivery framework maintains several internal components, including:

• JCR Session Pool

• Request Processing Pipeline

• Hosts, Site, and Channel Configuration Management

• Observation Event Listeners

• Cache Management

• Security

These components support the framework's Context/Content-oriented Hierarchical MVC architecture.

The framework requires a reliable Dependency Injection container. Spring Framework is used for this purpose. To avoid conflicts with application-level WebApplicationContexts, the delivery framework initializes its own isolated ApplicationContexts. It loads bean configurations from specific classpath resources and allows bean overriding from designated locations.

The delivery framework loads bean configurations using org.hippoecm.hst.site.container.HstContextLoaderListener (configured in web.xml). Configuration files are loaded from the following classpath locations (packaged in hst-core-x.x.x.jar):

• classpath:org/hippoecm/hst/site/container/SpringComponentManager.xml

• classpath:org/hippoecm/hst/site/container/SpringComponentManager-*.xml

Default configuration properties are read from classpath:org/hippoecm/hst/site/container/SpringComponentManager.properties. You can override these properties using hst-properties files. For details, see HST Container Configuration.

Overriding or Extending Internal Components

You can override existing container components or add custom components in your web application. Refer to HST Core Spring Extension Points for a list of Spring beans that are considered SPIs and are safe to override. Avoid overriding beans not listed as SPI, as their interfaces may change between releases.

Add overriding or custom bean definitions in:

• classpath:META-INF/hst-assembly/overrides/*.xml

Note: In a typical Maven-based project, place these XML files in src/main/resources/META-INF/hst-assembly/overrides/ within the site/components module.

Accessing Internal Components

Access internal container components through org.hippoecm.hst.core.container.ComponentManager.

For example, to obtain a JCR session from the internal session pooling repository component:

import javax.jcr.Repository;
import javax.jcr.Session;
import javax.jcr.Credentials;
import org.hippoecm.hst.site.HstServices;
import org.hippoecm.hst.core.container.ComponentManager;

public class Example {
    public void doIt() throws Exception {
        Session session = null;

        try {
            // Obtain the ComponentManager initialized by the delivery framework
            ComponentManager componentManager = HstServices.getComponentManager();

            // Retrieve internal components by bean name
            Credentials liveSiteCreds = componentManager.getComponent("javax.jcr.Credentials.default");
            Repository repository = componentManager.getComponent("javax.jcr.Repository");

            // Acquire a JCR session from the pooling repository component
            session = repository.login(liveSiteCreds);

            // Use the session as needed
            // ...
        } finally {
            if (session != null) {
                // Return the JCR session to the pool
                session.logout();
            }
        }
    }
}
copy

For a list of Spring beans that are considered APIs and safe to use, see HST Core Spring Extension Points. Avoid using beans not explicitly listed as API, as their stability is not guaranteed across releases.

Event Communication with ComponentManager

The ComponentManager provides a simple publish-subscribe event communication mechanism between components. For details, see HST Spring ComponentManager event publishing.

Summary

Bloomreach Content's delivery framework uses core features of the Spring Framework, such as Dependency Injection and Aspect-Oriented Programming, to manage internal components. It initializes isolated ApplicationContexts by loading bean configurations from specific classpath resources and supports bean overriding from defined locations. This approach keeps internal component management separate from application-level contexts.

The framework enables you to override or extend container components, add custom components, and use publish-subscribe event communication between components. For more information on extension points and configuration, refer to the linked documentation.