All critical security tokens now use SecureRandomHashGenerators.generate(...) to improve randomness and security. This includes the Admin password reset token, the User forgot password token, and the account activation key generated during user registration.

The Scheduler now provides isStarted() to check whether it has started and onStarted(Runnable listener) to register logic that runs immediately after the Scheduler starts. In addition, the public overload of scheduleAtFixRate(...) allows developers to explicitly choose whether a scheduled task should run once or repeatedly.

DefaultSettingService.watchLastUpdatedTime(...) no longer executes its callback immediately upon registration. Instead, the callback is triggered only after the Scheduler has started, preventing components that depend on the Scheduler or encryption keys from running too early during application startup.

Introduced SettingService.saveSettingIfNotExists(name, dataType, value), making it easy to create default settings only when they do not already exist. Integration tests have also been added to verify the correctness of this workflow.

Request logs now read the HTTP method directly from HttpServletRequest and record the query string instead of the parameter map. This produces cleaner logs that more accurately reflect the original request URL while continuing to exclude management URIs from logging.

The setting auto_pass_management_uris has been renamed to admin_auto_pass_management_uris for improved clarity and consistency. When upgrading, systems using the previous setting name in the database or configuration files should migrate to the new name to ensure the feature continues to function correctly.

Sha256Uuids.generateUuid(...) no longer includes System.currentTimeMillis() in the hash input when generating UUIDs. Several boolean and long literal values have also been standardized using shared constants such as Boolean.TRUE, Boolean.FALSE, and ZERO_LONG, resulting in cleaner and more maintainable code.