00.73.00

Latest release — and a breaking one. 00.73.00 does two things: it completes the fluent-bootstrap surface V00.72 left half-wired, and it rebrands every coordinate, package and Security* service type to the jSentinel namespace. There is no compatibility shim — consumers must update dependencies and imports. Behaviour of the existing SPIs is unchanged; the breaking parts are the renames and three STRICT-mode promotions (below).

Release date: 2026-06-10 Previous release: 00.72.00 Maven coordinates (parent): com.svenruppert.jsentinel:jSentinel-parent:00.73.00 Full changelog: GitHub release v00.73.00

Part 1 — Fluent-bootstrap completion

00.73 closes the two carve-outs V00.72 documented as “staged for V00.73” and finishes the typed fluent bootstrap for production use:

Sub-builder wiring — the five recorded-only sub-builders (.audit, .sessions, .policies, .roles, .credentials) leave the placeholder state and become real typed surfaces, wired through the JSentinelServiceResolver setters and adapter/DX state.
Wrapper-index writer — jSentinel-processor now emits META-INF/jsentinel/generated-wrappers.idx, completing the V00.72 reader path. JSentinelDiagnostics.inspect() lists every compile-time wrapper.
SecuredUi.requiresPolicy(...) — a build-time UnsupportedOperationException in V00.72; now evaluates the registered policy through PolicyRegistry.
@SecureRoute(policy = "…") — deny-by-default in V00.72; now evaluates the policy and maps Allowed / Denied / StepUpRequired to an AuthorizationDecision.
SecureRouteDiscovery SPI (opt-in) — enables deterministic STRICT cross-validation of @SecureRoute(policy="…") against the names registered via .policies(...). Off by default; V00.72 runtime behaviour is preserved for non-opt-in consumers.

All five sub-builders are now available across the Vaadin, REST and Standalone adapters (with adapter-appropriate INFO diagnostics where a capability doesn’t apply, e.g. sessions on Standalone).

Part 2 — The jSentinel rebrand (breaking)

Every binary coordinate and Java package owned by the project moves to the jSentinel namespace.

Aspect	00.72.00 and earlier	00.73.00
Maven groupId (our artifacts)	`com.svenruppert`	`com.svenruppert.jsentinel`
Parent artifact	`security-for-flow-parent`	`jSentinel-parent`
Modules (17)	`security-core`, `security-vaadin`, …	`jSentinel-core`, `jSentinel-vaadin`, …
Java package root	`com.svenruppert.vaadin.security.*`	`com.svenruppert.jsentinel.*`
Service types (29)	`SecurityServiceResolver`, `SecurityAuditService`, `SecurityRuntime`, `SecurityBootstrapMode`, …	`JSentinelServiceResolver`, `JSentinelAuditService`, `JSentinelRuntime`, `JSentinelBootstrapMode`, …
Annotations	`@SecurityAutoService`, `@ExperimentalSecurityApi`	`@JSentinelAutoService`, `@ExperimentalJSentinelApi`
Wrapper index	`META-INF/security-for-flow/generated-wrappers.idx`	`META-INF/jsentinel/generated-wrappers.idx`

Kept as-is on purpose — suffix classes carry no Security prefix and are not renamed: SecuredProxy, @Secured, @SecureRoute, VaadinSecurity / RestSecurity / StandaloneSecurity, SecuredButton / SecuredRouterLink / SecuredMenuItem / SecuredVisibility, SecuredUi, SecureRouteEvaluator / SecureRouteDiscovery. The annotations (@RequiresRole / @RequiresPermission / @RequiresPolicy) and the decision types (AuthorizationDecision, PolicyDecision) are unchanged. demo-* modules keep their names. External com.svenruppert:* libraries (dependencies, core, functional-reactive, proxybuilder) keep their coordinates — only project-owned artifacts move.

Migration in one minute

<!-- before V00.73 -->
<dependency>
  <groupId>com.svenruppert</groupId>
  <artifactId>security-vaadin</artifactId>
  <version>00.72.00</version>
</dependency>

<!-- V00.73 -->
<dependency>
  <groupId>com.svenruppert.jsentinel</groupId>
  <artifactId>jSentinel-vaadin</artifactId>
  <version>00.73.00</version>
</dependency>

IDE recipe:
1. Rename package  com.svenruppert.vaadin.security → com.svenruppert.jsentinel
2. Find-usages on each Security* type that has a JSentinel* replacement
   (29 classes; derived setters like setSecurityAuditService move too)
3. Bump the version to 00.73.00

Part 3 — Breaking: STRICT-mode promotions

Three diagnostics that were warnings in V00.72 now throw JSentinelBootstrapException in mode(STRICT). A STRICT app upgrading to 00.73 must resolve these first:

Code	V00.72	V00.73 STRICT
`secure-route/unknown-policy`	warning + Forbidden	exception (deterministic with an active `SecureRouteDiscovery` hook; otherwise the runtime warning remains + INFO `secure-route/discovery-disabled`)
`session-management-view-without-session-store`	warning	exception
`security-version-without-subject-id-resolver`	warning	exception

Non-STRICT modes (COMMUNITY_DEFAULTS / DEVELOPMENT / PRODUCTION) keep the V00.72 behaviour.

Branded Javadoc in every artifact

From 00.73 the published -javadoc.jar is theme-skinned out of the box — the jSentinel palette, a Light / Dark / System toggle, and a link back to the site, baked in via the build. The API Reference serves exactly those artifacts.

AI-assisted upgrade

The jSentinel Claude Code skills target the 00.73 surface and wire a fresh Vaadin, REST or Standalone integration from a single prompt.

00.72.00 00.74.00