[JingkaiTang]

Fixes #152.

When a consumer imports Spring Boot's BOM before tRPC's BOM, Jetty 12 core artifacts are combined with the old Jetty 11 Servlet and HTTP/2 artifacts, causing HTTP server initialization to fail. Migrate the transport to Jetty 12 EE10 Servlet and renamed HTTP/2 artifacts, manage Jetty through its core and EE10 BOMs, and update the gateway WebApp dependency. The HttpExecutor contract, sessions and asynchronous Servlet responses are preserved.

The tRPC BOM now defaults to Jetty 12.0.36, matching Spring Boot 3.5.16. The framework's Spring Boot baseline remains 3.5.0. On the TLS connector, HTTP/2 and HTTP/1.1 now share the same HTTPS configuration, including Jetty's default Host/certificate check.

The JDK 17 and 21 CI jobs run the external HTTP transport regression with the Spring Boot 3.5.16 BOM imported before the tRPC BOM, reproducing the dependency order from #152.

Validation on Corretto 21.0.5

• The default HTTP transport suite and the Boot 3.5.16 consumer suite each passed all 14 tests with no skips. Both dependency trees resolved Jetty 12.0.36.
• The TLS fallback regression negotiates HTTP/1.1 on the HTTP/2 connector, checks that the servlet sees HTTPS and a secure request, and verifies a 400 response for a Host outside the test certificate.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 85.78352%. Comparing base (221d755) to head (3fcf823).

Additional details and impacted files

@@                      Coverage Diff                      @@
##             JDK17/Springboot3        #154         +/-   ##
=============================================================
- Coverage             85.78765%   85.78352%   -0.00414%     
- Complexity                 450         451          +1     
=============================================================
  Files                      558         558                 
  Lines                    17330       17332          +2     
  Branches                  1509        1509                 
=============================================================
+ Hits                     14867       14868          +1     
- Misses                    2463        2464          +1     

Flag	Coverage Δ
Merge	?
pull-request	85.78352% <100.00000%> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
...transport/http/support/jetty/JettyHttp2Server.java	100.00000% <ø> (ø)
.../transport/http/support/jetty/JettyHttpServer.java	92.30769% <100.00000%> (+0.30768%)	⬆️

... and 4 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[wardseptember]

SpringBoot 3.5 实际管理的 12.0.x，jetty是不是用12.0.x。SpringBoot 4.x应该有下一个trpc版本兼容，trpc2.x不用兼容这个

[JingkaiTang]

已在 3fcf823 把默认 Jetty 调整为 12.0.36，与 Spring Boot 3.5.16 管理的版本一致。这个 PR 的兼容范围收回到 Boot 3，Boot 4 留给后续版本处理。

[wardseptember]

这两个问题帮改一下？

[JingkaiTang]

HTTP/1.1 回退已改用 httpsConfig，与同一端口上的 HTTP/2 共用 HTTPS 配置。补了实际协商到 HTTP/1.1 的测试，确认 Servlet 读到的 scheme 是 https，isSecure() 为 true。

Host 校验这边保留了 Jetty 默认行为。确认过 setSniRequired(false) 不会关闭证书与请求 Host 的匹配检查，Jetty 11 也已有这项检查。这次补了证书与 Host 不匹配时返回 400 的用例。考虑到默认关闭会放宽现有校验，建议后续有明确的 IP 直连兼容需求时，再单独讨论配置开关。

[wardseptember]

用jetty 12.0.x这些测试是不是不需要了，trpc2.x版本不用考虑springboot4.x的问题

[JingkaiTang]

已移除跨 Boot 版本的测试矩阵。这里保留了 Boot 3.5.16 BOM 优先的消费方回归，因为 #152 就是在应用先导入 Boot BOM、再导入 tRPC BOM 时触发的，仓库默认依赖顺序覆盖不到。JDK 17 下这组 14 项测试已全部通过。

[wardseptember]

用jetty 12.0.x这些测试是不是不需要了，trpc2.x版本不用考虑springboot4.x的问题

[JingkaiTang]

JDK 21 这边也已同步调整，只跑 Boot 3.5.16 BOM 优先这一组，14 项测试全部通过。