docs(release): document specs 018 and 021 in the 1.4.0 upgrade guide

[herbie-bot]

What this is

docs/releases/upgrade-to-1.4.md covered specs 015, 016 and 017 only. Since then 018 and 021 landed
and the java-parent 1.3.0 bump changed a transitive dependency, so a consumer reading the guide
today would miss three of the five changes in 1.4.0. Documentation only.

Adds an overview table at the top — so the full 1.4.0 scope is visible before reading — plus three
sections. Specs 019 and 020 are deliberately not documented: they are designs, not shipped code.

Spec 018 gets the most space, because it is the one that stays silent

ApplicationInfoService reports nothing unless the consumer wires their build, and that wiring is
neither obvious nor documented anywhere else. The section gives the three POM snippets and, more
importantly, why each is needed:

• build-info with a commit additional property — the fallback Git source for container builds that
  have no .git.
• generateGitPropertiesFile=true in the application, with the reason java-parent disables it
  for libraries: a /git.properties shipped by a library collides on the consumer's classpath, where
  only the first jar's copy is ever read.
• The cyclonedx output redirected into META-INF/sbom — the parent's full-build profile already
  runs makeBom, but with the plugin default (target/bom.json) the file never enters the jar.

Plus the source-precedence table, the autodetection order (Spring Boot SbomEndpoint order), both
properties with defaults, and the guard rails that actually matter:

• An SBOM is a complete dependency inventory with versions. An unauthenticated endpoint hands an
  attacker your patch level. The library ships no endpoint precisely so this stays your decision.
• There is no build timestamp, by design — with project.build.outputTimestamp fixed centrally, a
  "build time" would describe the parent release, not your build. Use git.commitTime.
• The raw SBOM bytes and an Actuator InfoContributor are a separate future module.

Spec 021 documents the cost that is easy to miss

DbHealthService never throws and never caches — so every call borrows a pooled connection, and
against a saturated pool it blocks for up to the pool's connection timeout. An unauthenticated,
unthrottled health endpoint calling it is therefore a way to occupy the pool. Also: it is not an
Actuator HealthIndicator, and it answers reachability only.

Dependency section

swagger-annotations-jakarta moves 2.2.29 → 2.2.47 via the parent's swagger-bom. Nothing to do in
most applications, but consumers who pin Swagger or springdoc themselves must align the whole stack:
a split Swagger stack fails at runtime with NoSuchMethodError, because swagger-core calls
annotation members that only exist in its own release.

A factual error corrected along the way

Spec 018's design, two Javadoc comments (info/package-info.java, GitInfo.java) and one line in
docs/TODO.md all stated that Git metadata comes from META-INF/git.properties.

Spring Boot's default for spring.info.git.location is classpath:git.properties — verified in
ProjectInfoProperties (new ClassPathResource("git.properties")) — and that is also exactly where
git-commit-id-maven-plugin writes by default. A consumer following the old text would have generated
a file Spring never reads, then wondered why GitInfo stayed null. All four occurrences are
corrected; comments and docs only, since the code injects the GitProperties bean and was always
right.

Verification

Full reactor build with tests: BUILD SUCCESS, 134 tests, no failures. (I initially quoted that
count from an earlier run whose output I had suppressed with -q; re-ran it visibly to confirm.)

🤖 Generated with Claude Code