> For the complete documentation index, see [llms.txt](https://pinpoint-apm.gitbook.io/pinpoint/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://pinpoint-apm.gitbook.io/pinpoint/v3.1.1/main.md). # What's New Pinpoint 3.1.1 is a maintenance release of the 3.1.x line. It focuses on **agent stability and overhead** on reactive and coroutine workloads (Reactor / WebFlux / reactor-netty / Kotlin coroutines), **Spring Framework 7 compatibility**, and **security hardening** of the Web and Batch modules. There are no schema changes; collector and web can be upgraded in place from 3.1.0. ## Highlights ### Agent — Reactor megamorphic-dispatch remediation (JDK 21/25) Backport of the master track that remediates the JIT megamorphic `invokeinterface` dispatch observed on reactive applications running on recent JDKs (C2 profile pollution across the generic reactor `CoreSubscriber` instrumentation). * The reactor `AsyncContext` carrier is unified into a single injected field, so the hot interceptors no longer go through polymorphic accessor lookups. * Each interceptor class now gets a **generated monomorphic exception-guard wrapper** instead of sharing one reflective guard. The code generation is **enabled by default**: ```properties # pinpoint.config (local / release profiles) profiler.interceptor.exception.guard.codegen=true # set false to fall back to the 3.1.0 guard ``` * The generic reactor `CoreSubscriber` instrumentation can be switched off for a lightweight mode (`profiler.reactor.subscriber.instrument=false`, default `true`). Publisher-seam wrapping and scheduler-task tracing stay behind config gates that are **off by default** (`profiler.reactor.trace.scheduler.task`, `profiler.reactor.trace.scheduler.task.periodic`). * `DefaultAsyncTraceContext` / `DefaultRecorderFactory` no longer call the Guice `Provider.get()` chain on every trace request; the singleton factories are injected or memoized (#14210). ### Agent — "Corrupted call stack" storms fixed and throttled Three layers address the `Corrupted call stack found ... call stack is empty` log floods (and the CPU spikes that came with them) reported on reactor-netty / WebFlux services: * `DefaultCallStack.peek()` returns the disabled instance while overflowed frames are outstanding, instead of `null`, so a transaction that exceeds `profiler.callstack.max.sequence` no longer logs a stack dump per span event (#14310). * `OnErrorSubscriberInterceptor` (`onErrorResume` / `onErrorReturn` / `onErrorMap` / `onErrorComplete`) carries its `TraceBlock` from `before()` to `after()` instead of looking the `AsyncContext` up twice, which closed a frame nobody opened on every failing `WebClient` response (#14319). * The corrupted-call-stack WARN and stack dump are **throttled to one per 3 s per trace type**; suppressed dumps are counted and reported on the next emitted one, and skip the exception construction entirely. ### Agent — Kotlin coroutines `ResumeWithInterceptor` keeps the span event opened in `before()` and closes exactly that one in `after()`, so a nested Reactor callback swapping the current trace during `BaseContinuationImpl.resumeWith(...)` no longer leaves unbalanced blocks (previously surfacing as corrupted call stacks on the parent `ChildTrace`). ### Agent — Spring Framework 7 compatibility * WebFlux and RestTemplate header adaptors no longer throw `NoSuchMethodError` on Spring Framework 7, where `HttpHeaders` stopped implementing `MultiValueMap` (#14278). * The RestTemplate plugin matches the new `RestTemplate(Iterable>)` constructor, so RestTemplates built by Spring Boot 4 / Framework 7 are traced again. ### Agent — Plugin fixes * **Redisson**: reactive command tracing works on Redisson 3.17+ and 3.19+ (`ReactiveProxyBuilder` callback signature changes); it had been silently inactive on modern versions. * **reactor-netty / netty HTTP client**: `HttpClientRequestWrapper.toRemoteHost()` and `HttpClientHandlerRequestWithBodyInterceptor` no longer cast a non-inet remote address (e.g. Unix domain sockets) to `InetSocketAddress`, which threw `ClassCastException` inside the interceptor. * Duplicate accessor member injection is skipped in `ASMClass` (#13962). * `StringUtils.abbreviate` no longer splits UTF-16 surrogate pairs (#14021). * Empty `PAnnotationValue` is returned for `NullAnnotation` instead of an NPE (#14154). * `ExceptionChainSampler` no longer fails on a non-positive throughput setting. * Removed the unused interceptor registry setting and bootstrap-interceptor jar references (#14008). ### Web / Batch — Security hardening * **Webhook SSRF validation** (#13857): webhook URLs are resolved and validated before sending; URLs that resolve to loopback, link-local, multicast, or **private ranges (10/8, 172.16/12, 192.168/16, 100.64/10, ...)** are rejected. The webhook payload no longer includes the user group. See *Upgrade notes*. * **Basic login** (#13858, #14103): the JWT cookie is `HttpOnly` with configurable `Secure` / `SameSite`, the authentication recursion is fixed, and the JWT secret key is now **required** when basic login is enabled. See *Upgrade notes*. * NUL bytes are rejected in null-terminated buffer values (collector-side decoding). * gRPC mappers no longer cache protobuf builders in interface fields (shared across mapper instances and threads). ## Upgrade notes ### Agent * **Default `pinpoint.modules.uid.version` is now `v3`** (254-character ApplicationName support, #13715). This matches the 3.1.0 collector/web. If the agent reports to a **collector older than 3.1.0**, set it back explicitly: ```properties pinpoint.modules.uid.version=v1 ``` * `profiler.interceptor.exception.guard.codegen=true` is the new default. Set it to `false` to restore the 3.1.0 behavior (a JVM restart is required). * `profiler.interceptorregistry.size` has been removed from `pinpoint-root.config` (no longer used). ### Web * If `pinpoint.modules.web.login=basicLogin`, the web **fails to start** unless the JWT secret is configured: ```properties web.security.auth.jwt.secretkey= # optional cookie attributes (defaults shown) #web.security.auth.jwt.cookie.http-only=true #web.security.auth.jwt.cookie.secure=false #web.security.auth.jwt.cookie.same-site=Lax ``` * **Webhooks targeting private network addresses are rejected** in this version. If your alarm webhooks resolve into 10/8, 172.16/12 or 192.168/16, keep them on 3.1.0 or route them through a publicly resolvable host; a configurable host allowlist is available on master and planned for a later release. ### Build * Minimum required Maven version is 3.7 (the bundled `mvnw` is unaffected). ## Compatibility | Component | Minimum | Notes | | --------------------------- | -------------------- | ------------------------------------------------------------------------- | | Agent JDK | 8+ | verified on 8 / 11 / 17 / 21 / 25 | | Collector / Web / Batch JDK | 17+ | | | Collector for agent 3.1.1 | 3.1.0+ | with the default `uid.version=v3`; see Upgrade notes for older collectors | | HBase schema | unchanged from 3.1.0 | | *** ## Downloads Binaries are attached to this release: * [pinpoint-agent-3.1.1.tar.gz](https://github.com/pinpoint-apm/pinpoint/releases/download/v3.1.1/pinpoint-agent-3.1.1.tar.gz) * [pinpoint-batch-3.1.1-exec.jar](https://github.com/pinpoint-apm/pinpoint/releases/download/v3.1.1/pinpoint-batch-3.1.1-exec.jar) * [pinpoint-collector-3.1.1-exec.jar](https://github.com/pinpoint-apm/pinpoint/releases/download/v3.1.1/pinpoint-collector-3.1.1-exec.jar) * [pinpoint-collector-starter-3.1.1-exec.jar](https://github.com/pinpoint-apm/pinpoint/releases/download/v3.1.1/pinpoint-collector-starter-3.1.1-exec.jar) * [pinpoint-web-3.1.1-exec.jar](https://github.com/pinpoint-apm/pinpoint/releases/download/v3.1.1/pinpoint-web-3.1.1-exec.jar) * [pinpoint-web-starter-3.1.1-exec.jar](https://github.com/pinpoint-apm/pinpoint/releases/download/v3.1.1/pinpoint-web-starter-3.1.1-exec.jar) ## What's Changed * \[#13693] Prepare 3.1.1-SNAPSHOT by @intr3p1d in * \[#13715] Backport : Change default NameVersion to v3 by @emeroad in * \[#noissue] Move maven-compiler-plugin version to pluginManagement by @emeroad in * \[#noissue] Bump minimum required Maven version to 3.7 by @emeroad in * \[#noissue] Move maven-surefire-plugin version to pluginManagement by @emeroad in * \[#noissue] Move maven-resources/javadoc-plugin versions to pluginManagement by @emeroad in * \[#noissue] Update CI workflow triggers to 3.1.x branch by @emeroad in * \[#noissue] Update README.md by @intr3p1d in * \[#noissue] Remove unused maven-surefire-plugin configuration by @emeroad in * \[#noissue] Backport: Reject NUL bytes in null-terminated buffer values by @donghun-cho in * \[#13857] Backport: Add SSRF validation and update webhook payload structure by @ga-ram in * \[#13858] Backport: Secure basic login JWT cookie and fix authentication recursion by @ga-ram in * \[#13858] Backport: Disable basic login secure cookie by default by @ga-ram in * \[#13962] Backport: Skip duplicate accessor member injection in ASMClass by @jaehong-kim in * \[#14008] Backport: Remove interceptor registry settings and bootstrap-interceptor jar references by @jaehong-kim in * \[#14021] Backport: Keep StringUtils.abbreviate from splitting surrogate pairs by @jaehong-kim in * \[#noissue] Backport: Reactor megamorphic-dispatch remediation track from master by @jaehong-kim in * \[#noissue] Backport: Fix ExceptionChainSampler failing on non-positive throughput by @donghun-cho in * \[#noissue] 3.1.1-alpha1 release by @jaehong-kim in * \[#noissue] Ignore git mergetool temp files by @emeroad in * \[#noissue] Prepare 3.1.1-SNAPSHOT by @jaehong-kim in * \[#14154] Backport : Return empty PAnnotationValue for NullAnnotation to prevent NPE by @emeroad in * \[#14103] Backport: Require jwt secret key for basic login by @ga-ram in * \[#noissue] Remove cached protobuf builders from grpc mappers by @emeroad in * \[#14278] Backport: Fix NoSuchMethodError in the WebFlux and RestTemplate header adaptors on Spring Framework 7 by @jaehong-kim in * \[#14310] Backport: Return the disabled instance from DefaultCallStack.peek() while overflowed frames are outstanding by @jaehong-kim in * \[#14319] Backport: Carry the TraceBlock through OnErrorSubscriberInterceptor instead of looking the AsyncContext up twice by @jaehong-kim in * \[#noissue] Backport: Throttle the corrupted call stack dumps of DefaultTrace and ChildTrace by @jaehong-kim in * \[#noissue] Backport: Keep coroutine resume trace blocks balanced by @jaehong-kim in * \[#noissue] Backport: Support the Iterable-based RestTemplate constructor of Spring Framework 7 by @jaehong-kim in * \[#noissue] Backport: Fix redisson reactive command tracing for redisson 3.17+ by @jaehong-kim in * \[#noissue] Backport: Avoid casting non-inet remote addresses in HttpClientHandlerRequestWithBodyInterceptor by @jaehong-kim in * \[#noissue] Backport: Avoid casting non-inet remote addresses in HttpClientRequestWrapper by @jaehong-kim in * \[#14210] Backport: Cache the singletons behind the Guice Providers on the trace request path by @jaehong-kim in * \[#14381] 3.1.1 release by @jaehong-kim in **Full Changelog**: ## Upgrade consideration HBase compatibility table: | Pinpoint Version | HBase 1.x | HBase 2.x | | ---------------- | --------- | --------------------------------------------------------------------------------------------------------------------- | | 2.0.x - 2.2.x | yes | [optional](https://pinpoint-apm.gitbook.io/pinpoint/documents/hbase-upgrade#do-you-like-to-use-hbase-2x-for-pinpoint) | | 2.3.x - 2.5.x | yes | [hbase2-module](https://github.com/pinpoint-apm/pinpoint/tree/2.3.x/hbase2-module) | | 3.0.x | no | yes | | 3.1.x | no | yes | | 4.0.x | no | yes | Agent compatibility to Collector table: | Agent Version | Collector 2.x.x | Collector 3.0.x | Collector 3.1.x | Collector 4.0.x | | ------------- | --------------- | --------------- | --------------- | --------------- | | 2.x.x | yes | yes | yes | yes | | 3.0.x | no | yes | yes | yes | | 3.1.x | no | no | yes | yes | | 4.0.x | no | no | no | yes | Additionally, the required Java version to run each Pinpoint component is given below: | Pinpoint Version | Agent | Collector | Web | Batch | | ---------------- | ----- | --------- | --- | ----- | | 2.0.x | 6-13 | 8 | 8 | 8 | | 2.1.x | 6-14 | 8 | 8 | 8 | | 2.2.x | 7-14 | 8 | 8 | 8 | | 2.3.x | 7-17 | 8 | 8 | 8 | | 2.4.x | 7-18 | 11 | 11 | 11 | | 2.5.x | 8-19 | 11 | 11 | 11 | | 3.0.x | 8-21 | 17 | 17 | 17 | | 3.1.x | 8-25 | 17 | 17 | 17 | | 4.0.x | 8-25 | 17 | 17 | 17 | ## Supported Modules * JDK 6+ * Supported versions of the \* indicated library may differ from the actual version. | Title | Instrumented Library | Min | Max | Comment | | | -------------------------------------------------------------------------------------------------------------- | ------------------------------------ | -------- | --------- | ------- | - | | [Tomcat](https://github.com/pinpoint-apm/pinpoint/tree/master/agent-module/plugins/tomcat) | | 6.x | 9.x | | | | [Jetty](https://github.com/pinpoint-apm/pinpoint/tree/master/agent-module/plugins/jetty) | | 8.x | 9.x | | | | [JBoss](https://github.com/pinpoint-apm/pinpoint/tree/master/agent-module/plugins/jboss) | | 6.x | 7.x | | | | [Websphere](https://github.com/pinpoint-apm/pinpoint/tree/master/agent-module/plugins/websphere) | | 6.x | 8.x | | | | [Vertx](https://github.com/pinpoint-apm/pinpoint/tree/master/agent-module/plugins/vertx) | | 3.3 | 3.5 | | | | [Weblogic](https://github.com/pinpoint-apm/pinpoint/tree/master/agent-module/plugins/weblogic) | | 10.x | 12.x | | | | [Undertow](https://github.com/pinpoint-apm/pinpoint/tree/master/agent-module/plugins/undertow) | | | | | | | [Undertow Servlet](https://github.com/pinpoint-apm/pinpoint/tree/master/agent-module/plugins/undertow-servlet) | | | | | | | Jasper | | | | | | | | | | | | | | Java Async Thread | | | | | | | | | | | | | | OpenWhisk | whisk.core | | | | | | | | | | | | | SpringMVC Framework | spring-webmvc | 3.0.7 | 5.3.6 | | | | Spring Web | spring-web | 4.1.2 | 4.3.30 | | | | Spring RabbitMQ | spring-rabbit | 1.3.3 | 2.2.16 | | | | Spring IBatis | spring-ibatis | 2.0.7 | 2.0.8 | | | | Spring MyBatis | mybatis-spring | 1.1.0 | 1.3.3 | | | | \*[Spring Boot](https://github.com/pinpoint-apm/pinpoint/tree/master/agent-module/plugins/spring-boot) | spring-boot-autoconfigure | | | | | | \*[Spring Webflux](https://github.com/pinpoint-apm/pinpoint/tree/master/agent-module/plugins/spring-webflux) | spring-webflux | | | | | | | | | | | | | MyBatis | mybatis | 3.0.3 | 3.3.1 | | | | [Hystrix](https://github.com/pinpoint-apm/pinpoint/tree/master/agent-module/plugins/hystrix) | hystrix-core | 1.4.0 | 1.5.18 | | | | | | | | | | | JDKHTTP | | | | | | | Httpclient3 | commons-httpclient | 3.0 | 3.1 | | | | Httpclient4 | httpclient | 4.0 | 4.5.4 | | | | Thrift | libthrift | 0.9.1 | 0.14.1 | | | | Google HTTP Client | google-http-client | 1.19.0 | 1.39.2 | | | | AsyncHttpClient | async-http-client | 1.7.24 | 1.8.17 | | | | OkHttp | okhttp | 2.0.0 | 3.3.1 | | | | Apache HttpAsyncClient | httpasyncclient | 4.0 | 4.1.3 | | | | \*Akka HTTP | akka-http\_2.12 | 10.1.0 | 10.1.x | | | | \*[Kafka](https://github.com/pinpoint-apm/pinpoint/tree/master/agent-module/plugins/kafka) | kafka-clients | 0.11.0.1 | | | | | GRPC | grpc-stub | 1.8.0 | 1.37.0 | | | | \*[Reactor](https://github.com/pinpoint-apm/pinpoint/tree/master/agent-module/plugins/reactor) | reactor-core | 3.3.0 | 3.3.1 | | | | \*[Reactor Netty](https://github.com/pinpoint-apm/pinpoint/tree/master/agent-module/plugins/reactor-netty) | reactor-netty | 0.8.0 | 0.9.2 | | | | | | | | | | | Log4j | log4j | 1.2.16 | 1.2.17 | | | | Logback | logback-classic | 1.0.13 | 1.2.3 | | | | Log4j2 | log4j-core | 2.0 | 2.12.1 | | | | | | | | | | | \*Arcus | arcus-java-client | 1.7.0 | 1.11.4 | | | | \*MsSQL (jTDS) | jtds | 1.2.8 | | | | | \*MsSQL | mssql-jdbc | | | | | | HikariCP | HikariCP-java6 | 2.3.0 | 2.3.13 | | | | Jackson-mapper-asl | jackson-mapper-asl | 1.0.1 | 1.8.11 | | | | Jackson Databind | jackson-databind | 2.0.6 | 2.12.3 | | | | MariaDB Connector/J | mariadb-java-client | 1.3.0 | 2.7.2 | | | | MongoDB Java Driver | mongodb-driver | 3.0.0 | 3.12.8 | | | | Elasticsearch | elasticsearch-rest-high-level-client | 6.0.0 | 6.8.15 | | | | Datastax Java Driver | cassandra-driver-core | 2.0.10 | 3.11.0 | | | | Druid | druid | 1.0.0 | 1.2.6 | | | | \*Cubrid | cubrid-jdbc-driver | 8.4.1 | 10.0.0 | | | | \*Commons DBCP | commons-dbcp | 1.0 | 1.4 | | | | \*Commons DBCP2 | commons-dbcp2 | 2.0 | 2.5.0 | | | | \*HBase | hbase-client | 1.2.6.1 | 1.2.6.1 | | | | \*MySQL | mysql-connector-java | 5.0 | 8.x | | | | \*Oracle JDBC Driver | ojdbc | | | | | | \*PostgreSQL JDBC Driver | postgresql | | | | | | \*[Redis](https://github.com/pinpoint-apm/pinpoint/tree/master/agent-module/plugins/redis) | jedis | 2.4.2 | | | | | \*[Redis](https://github.com/pinpoint-apm/pinpoint/tree/master/agent-module/plugins/redis-lettuce) | lettuce-core | 5.0.0 | 5.1.2 | | | | \*[Redis](https://github.com/pinpoint-apm/pinpoint/tree/master/agent-module/plugins/redis-redisson) | redisson | 3.10.0 | 3.10.4 | | | | | | | | | | | Apache CXF | cxf-rt-rs-client | 3.0.0 | 3.4.3 | | | | Netty | netty-all | 4.1.0 | 4.1.63 | | | | ActiveMQ | activemq-all | 5.1.0 | 5.16.1 | | | | [RxJAVA](https://github.com/pinpoint-apm/pinpoint/tree/master/agent-module/plugins/rxjava) | rxjava | 1.0.0 | 1.3.8 | | | | [RabbitMQ](https://github.com/pinpoint-apm/pinpoint/tree/master/agent-module/plugins/rabbitmq) | amqp-client | 2.7.0 | 5.12.0 | | | | [Paho MQTT](https://github.com/pinpoint-apm/pinpoint/tree/master/agent-module/plugins/paho-mqtt) | org.eclipse.paho.client.mqttv3 | 1.0.2 | 1.2.5 | | | | [Paho MQTT](https://github.com/pinpoint-apm/pinpoint/tree/master/agent-module/plugins/paho-mqtt) | org.eclipse.paho.mqttv5.client | 1.2.5 | 1.2.5 | | | | | | | | | | | Gson | gson | 1.1 | 2.8.3 | | | | Json | json-lib | 1.0 | 2.2.2 | | | | FastJson | fastjson | 1.2.10 | 1.2.76 | | | | Dubbo | dubbo | 2.5.1 | 2.6.9 | | | | kafka-clients | kafka-clients | 0.11.0.0 | 2.6.1 | | | | postgresql | postgresql | 9.4.1208 | 42.2.19 | | | | ojdbc8 | ojdbc8 | 12.2.0.1 | 21.1.0.0 | | | | ojdbc10 | ojdbc10 | 19.3.0.0 | 19.10.0.0 | | |