Play Framework

chore: replace EhCache 2.x with Caffeine and XStream with Jackson XML (release 1.12.16)

Bundles two modernization-by-replacement tickets that ship together
because they cleanly remove two end-of-life / CVE-prone libraries from
the framework's runtime classpath in one go.

PF-25 (EhCache 2.x → Caffeine 3.2.3):
- New backend framework/src/play/cache/CaffeineImpl.java implements
  CacheImpl using Caffeine.newBuilder().expireAfter(Expiry) with a
  per-entry value+ttl wrapper record. Each insertion carries its own
  TTL, read by the Expiry callback on create/update; reads do not
  extend expiration. expiration <= 0 maps to Long.MAX_VALUE nanos
  (eternal), matching EhCache 2.x's setTimeToLive(0) semantics.
- Atomic operations: add → cache.asMap().putIfAbsent (preserves M26
  audit invariant); replace → cache.asMap().replace; incr/decr →
  cache.asMap().computeIfPresent. The incr/decr path closes a
  pre-existing read-modify-write race in EhCacheImpl.incr/decr that
  could lose increments under concurrent writers.
- Cache.java:228-244 wired to CaffeineImpl.newInstance() in both
  default and memcached-fallback paths. Class Javadoc updated.
- Removed EhCacheImpl.java (172 lines), EhCacheImplTest.java,
  ehcache-2.10.9.2.jar, ezmorph-1.0.6.jar, jsr107cache-1.1.jar.
  ezmorph and jsr107cache were zero-reference orphan transitives.
- Added caffeine-3.2.3.jar (1 MB) with SHA-256 verified against
  Maven Central.
- New regression test CaffeineImplTest ports the historical
  TTL-survives-incr/decr scenario verbatim.

PF-26 (XStream → Jackson XML 2.21.3):
- RenderXml(Object o) now serializes via a static final shared
  XmlMapper instead of a fresh-per-call XStream — Jackson's
  thread-safe-singleton pattern, also a soft perf win.
- Removed RenderXml(Object o, XStream xstream) constructor and
  Controller.renderXml(Object o, XStream xstream) overload (the
  XStream-customization API). Apps that customized XStream output
  must migrate to Jackson annotations (@JacksonXmlProperty etc.).
  Plain renderXml(Object o) callers continue to work; output is
  Jackson XML instead of XStream XML, mostly tag-compatible for
  POJOs.
- Removed xstream-1.4.21.jar, xmlpull-1.1.3.4d_b4_min.jar.
- Added six jars, all SHA-256-verified against Maven Central:
  jackson-core 2.21.3 (594 KB), jackson-annotations 2.21 (82 KB,
  pinned at 2.21 by Jackson's BOM), jackson-databind 2.21.3
  (1.7 MB), jackson-dataformat-xml 2.21.3 (135 KB), woodstox-core
  7.1.1 (1.6 MB; Jackson 2.12+ requires a non-default StAX
  provider), stax2-api 4.3.0 (194 KB).
- Updated documentation/manual/controllers.textile to point at
  Jackson XML / XmlMapper instead of XStream serialiser.
- New regression test RenderXmlTest.serializesPojoViaJacksonXml
  exercises the POJO → XML path end-to-end.

Verification: ant compile clean, full ant unittest BUILD SUCCESSFUL.
Residue grep across src, test-src, modules, docs returns zero
matches for ehcache, jsr107cache, ezmorph, XStream, com.thoughtworks,
xmlpull. Net jar weight roughly even (-2.5 MB EhCache stack,
+5 MB Jackson stack, +1 MB Caffeine, -700 KB XStream stack).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>