Skip to content

fix(deps): update spring core to v7#595

Open
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/major-spring-core
Open

fix(deps): update spring core to v7#595
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/major-spring-core

Conversation

@renovate

@renovate renovate Bot commented Nov 13, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
org.springframework:spring-web 6.1.13 → 7.0.8 age confidence
org.springframework:spring-test 6.1.13 → 7.0.8 age confidence

Release Notes

spring-projects/spring-framework (org.springframework:spring-web)

v7.0.8

⚠️ Security Fixes

This maintenance release fixes a high number of CVEs. You can learn more about this in the "Spring and Security In The Times Of AI" blog post. Here is the full list of 16 CVEs:

  • CVE-2026-41838 "Spring Framework Predictable Session ID in WebSocket Module"
  • CVE-2026-41839 "Spring Framework Escalation via Session Fixation in WebFlux"
  • CVE-2026-41840 "Spring Framework Denial of Service via Multipart Requests in WebFlux"
  • CVE-2026-41841 "Spring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFlux"
  • CVE-2026-41842 "Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux"
  • CVE-2026-41843 "Spring Framework Path Traversal via Versioned Static Resources in Spring MVC and WebFlux"
  • CVE-2026-41844 "Spring Framework Open Redirect in Spring MVC and WebFlux"
  • CVE-2026-41845 "Spring Framework Cross-site Scripting via JavaScriptUtils"
  • CVE-2026-41846 "Spring Framework Cross-site Scripting via JSP Form Tags"
  • CVE-2026-41848 "Spring Framework Denial of Service via AntPathMatcher"
  • CVE-2026-41850 "Spring Framework Algorithmic Denial of Service via SpEL Expressions"
  • CVE-2026-41851 "Spring Framework Denial of Service via Unbounded Cache in SpEL"
  • CVE-2026-41852 "Spring Framework Arbitrary Method Invocation in SpEL Expressions"
  • CVE-2026-41853 "Spring Framework Multipart Request Smuggling in Spring MVC and WebFlux"
  • CVE-2026-41854 "Spring Framework Server-Side Request Forgery via UriComponentsBuilder"
  • CVE-2026-41855 "Spring Framework Unsafe Deserialization via Jackson JMS Converters"

⭐ New Features

  • Include zone ID in CronTrigger's equals/hashCode implementations #​36871
  • Expose ClassLoader from DefaultDeserializer #​36833
  • Use immutable map for SEPARATORS static field in DefaultPathContainer #​36821
  • Track operations during SpEL expression evaluation #​36801
  • Ensure getters have non-void return types in SpEL #​36800
  • Avoid too many character access attempts in AntPathMatcher #​36799
  • Refine default view name resolution #​36793
  • Refine Jackson JMS converters #​36791
  • Improve ABNF rule checks in RfcUriParser #​36787
  • Restrict SpringVersion.getVersion() to "major.minor.patch" format #​36785
  • Runtime compatibility with JPA 4.0 M4 and corresponding Hibernate 8.0 snapshots #​36784
  • Allow specifying the charset to use in ExchangeFilterFunctions#basicAuthentication #​36777
  • Use CollectionUtils to initialize HashMap in DefaultUriBuilderFactory #​36763
  • Improve error messages in SpEL #​36756
  • Improve pattern caching in SpEL #​36755
  • Avoid ResolvableType#forType contention for implicit cache cleanup #​36745
  • Switch to JdkIdGenerator for WebSocket Sessions #​36740
  • Detect custom deserialized NullValue instances in AbstractValueAdaptingCache #​36727
  • LiteWebJarsResourceResolver does not resolve directories #​36726
  • Warn against unsafe static resource locations in MVC and WebFlux #​36692
  • Consistent compatibility with Woodstox as an alternative to Xerces #​36682
  • Improve principal checks for SockJS session #​36681
  • Set host header consistently in STOMP relay CONNECT frames #​36673
  • Support Micrometer context propagation in Kotlin Flow #​36667
  • Reliable detection of broadcast messages in UserDestinationMessageHandler #​36662

🐞 Bug Fixes

  • Concurrency issue against shared cookie field in CookieLocaleResolver#setLocaleContext #​36869
  • Server Sent Event does not support multi-line comments #​36866
  • CronExpression skips days on midnight DST gap #​36865
  • Regression in 6.2.0+: ConfigurationClassParser incorrectly removes component-scanned bean when the same class is also registered under a different name via XML #​36835
  • Preserve generic type info in awaitEntity() #​36834
  • Bean Background Bootstrap and Lazy Init #​36844
  • Back-off for DefaultMessageListenerContainer with OracleAQ has changed and is very short in SpringBoot 4 #​36809
  • Character outside of permitted range in Content Disposition #​36805
  • Fix JSP tag processing #​36797
  • Fix script processing capabilities #​36795
  • Jaxb2XmlEncoder exclusivity prevents JacksonXmlEncoder usage and hinders POJO serialization #​36776
  • JacksonXmlEncoder.canEncode incorrectly returns true for String body with application/xml #​36775
  • Consistently expose map key quotes in PropertyAccessorUtils #​36765
  • Fix fragment parsing for relative URI in RFC URI parser #​36762
  • Fix race condition in InMemoryWebSessionStore #​36742
  • Parsing failure for MIME type with quoted parameter values #​36730
  • Circular dependency between supplier-created beans is silently ignored on startup #​36725
  • Data is lost for joined DataBuffer in DataBufferUtils #​36714
  • Cache collisions in CachingResourceResolver #​36713
  • Unexpected path element removal when resolving versioned resources #​36698
  • Non-deterministic "Body token not expected" in org.springframework.http.codec.multipart.PartGenerator #​36694
  • Regression on value class parameter handling #​36665
  • Fix inverted logic for boolean last flag in JettyWebSocketSession when sending binary message #​36650
  • Parent traceId is not reused when calling WebClient.awaitExchange function #​36182

📔 Documentation

  • Fix broken links to Selenium documentation #​36875
  • Fix applicability note on setAutoGrowCollectionLimit #​36863
  • Document @Conditional gating of nested @Configuration classes #​36831
  • Javadoc of nestingLevel parameter in MethodParameter constructor is inconsistent with actual implementation #​36826
  • Re-structuring of Data Binding Content in Web Sections of Documentation #​36803
  • Fix typos for validateExistingTransaction #​36767

🔨 Dependency Upgrades

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​0AndWild, @​Dennis-Mircea, @​cookie-meringue, @​daguimu, @​dmitrysulman, @​kilink, @​kzander91, @​leestana01, @​mguiking, @​quaff, @​seonwooj0810, @​sgerke-1L, @​shenjianeng, @​tianhaocui, @​wushiyuanmaimob, and @​zmovo

v7.0.7

⭐ New Features

  • Improve SpringValidatorAdapter and MethodValidationAdapter performance #​36621
  • Support JSON array decoding to Flux in KotlinSerializationJsonDecoder #​36597
  • Deprecate methodIdentification() in CacheAspectSupport for removal #​36575
  • Add MockRestServiceServer#createServer variant for RestClient #​36572
  • Create RestClientXhrTransport variant replacing RestTemplateXhrTransport #​36566
  • Improve error handling in multipart codecs #​36563
  • Make ApplicationListenerMethodAdapter#getTargetMethod() public #​36558
  • ApiVersionConfigurer.setSupportedVersionPredicate() returns void instead of ApiVersionConfigurer #​36551
  • LazyConnectionDataSourceProxy does not work well with Hibernate's multi-tenancy by schema strategy #​36527
  • Add registerManagedResource variant with bean key argument to MBeanExporter #​36520
  • Handle blank Accept-Language header in AcceptHeaderLocaleResolver #​36513
  • Make AbstractStreamingClientHttpRequest and AbstractBufferingClientHttpRequest public #​36501
  • MySQL Error 149 (Galera/WSREP conflict) not translated to ConcurrencyFailureException in Spring JDBC/ORM #​36499
  • Add PreFlightRequestFilter #​36482
  • Support configuration of extension context scope for SpringExtension via Spring or JUnit properties #​36460
  • Lower log level of "Cache miss for REQUEST dispatch" in HandlerMappingIntrospector #​36309

🐞 Bug Fixes

  • WebDataBinder unnecessarily instantiates collections when using the "!" and "_" prefixes #​36625
  • Cache pollution from high-cardinality FieldError default messages in MessageSourceSupport #​36609
  • MergedAnnotation does not use ClassLoader for method or field #​36606
  • @Sql fails if DataSource is wrapped in a TransactionAwareDataSourceProxy #​36611
  • AnnotatedTypeMetadata no longer retains source declaration order on Java 24+ #​36598
  • MergedAnnotation.asMap() fails when an attribute references a non-existent class #​36586
  • FileSystemResource does not strictly follow the Resource#isReadable() contract #​36584
  • Converter overrides in HttpMessageConverters only apply when defaults are registered #​36579
  • Invalid method return type metadata for ClassFile variant on JDK 24+ #​36577
  • Fix Writer lifecycle for AbstractJsonHttpMessageConverter.writeInternal(Object, Type, Writer) #​36565
  • Flushing-related regression in SseServerResponse #​36537
  • LazyConnectionDataSourceProxy does not pass on holdability to target Connection #​36528
  • AnnotationBeanNameGenerator fails when an annotation references a non-existent class #​36524
  • Perserve default API version in RestClientAdapter #​36514
  • Inconsistent codings resolution in resource resolvers #​36507
  • DefaultJmsListenerContainer may hang in an endless loop in doShutdown #​36506
  • Query not hidden in DefaultClientResponse checkpoint #​36502
  • RestClient closes stream for ResponseEntity responses #​36492
  • IllegalStateException when using websocket handshake headers with Tomcat #​36486
  • Invalid nullness information for ParameterizedTypeReference #​36477
  • WebTestClient cannot assert null list elements #​36476
  • Handle Kotlin nullable value class param correctly in CoroutineUtils #​36449
  • Remove RFC 2047 encoding from Content-Disposition filename #​36328

📔 Documentation

  • Clarify semantics of HttpMethod.valueOf() #​36652
  • Document whitespace semantics in SpEL expressions #​36628
  • Document that spring.profiles.active is ignored by @ActiveProfiles #​36600
  • MergedAnnotation.asAnnotationAttributes() Javadoc incorrectly states that it creates an immutable map #​36567
  • Fix incorrect Javadoc in HandlerMethodReturnValueHandlerComposite regarding caching #​36555
  • Fix incorrect method name in TypeDescriptor.array() Javadoc #​36549
  • Introduce Kotlin examples for Bean Overrides (@MockitoBean, etc.) #​36541
  • Fix incorrect cross-reference links in AbstractEnvironment Javadoc #​36516
  • Document RetryTemplate#invoke variants in reference manual #​36452
  • Link observability section to Micrometer Observation Handler docs #​34994

🔨 Dependency Upgrades

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​Mohak-Nagaraju, @​Sineaggi, @​T45K, @​angry-2k, @​bebeis, @​cookie-meringue, @​dmitrysulman, @​elgunshukurov, @​itsmevichu, @​junhyung8795, @​msridhar, @​nameearly, @​tobifasc, and @​xxxxxxjun

v7.0.6

⚠️ Attention Required

  • Log warning when default context configuration is ignored within test class hierarchies #​36390
  • Ignore flush calls on ServletServerHttpResponse body outputstream #​36385

⭐ New Features

  • Leverage ResourceHandlerUtils in ScriptTemplateView #​36458
  • Restore ScriptTemplateViewTests #​36456
  • Fix log message in ConfigurationClassBeanDefinitionReader #​36453
  • DefaultResponseErrorHandler - setMessageConverters() not called via RestClient #​36434
  • Resolve context initializers only once in AbstractTestContextBootstrapper #​36430
  • Invoke resolveContextLoader() only once in AbstractTestContextBootstrapper #​36425
  • Further align synthesized annotation toString() with modern JDKs #​36417
  • Introduce setDefaultCharset() in AbstractResourceBasedMessageSource #​36413
  • Support for JPA 4.0 flush mode "explicit" #​36401
  • Support application-wide defaultHtmlEscape setting in WebFlux RequestContext #​36400
  • Support Predicate<RequestPath>> in path API version resolver #​36398
  • Avoid duplicate flushes in HttpMessageConverter implementations #​36383
  • Add support for non-flushing OutputStream to StreamUtils #​36382
  • Make it easier to get InputStream from RestClient #​36380
  • RuntimeHintsWriter should comply with reachability-metadata-schema-v1.2.0.json #​36379
  • Make it easier to create custom HttpExchangeAdapter #​36374
  • Improve ResourceHttpMessageConverter target type support #​36368
  • org.springframework.test.web.servlet.assertj.AbstractHttpServletResponseAssert#headers case sensitivity #​36349
  • Allow registering serialized lambda metadata through RuntimeHints #​36339
  • Refactor calculateHashCode in RequestMappingInfo #​36325

🐞 Bug Fixes

  • MetadataReader misses enclosing class name for Kotlin nested classes with Java 24+ #​36451
  • Guard against invalid id/event values in Server Sent Events #​36440
  • Component scanning fails against non-loadable annotation type with enum array on Java 25 #​36432
  • Duplicate ServletServerHttpRequest headers #​36418
  • Incomplete debug message in ConfigurationClassBeanDefinitionReader #​36410
  • Inconsistent ApplicationEventMulticaster state after removing ApplicationListener implemented by FactoryBean #​36404
  • Propagate max frame length to WebSocket session #​36370
  • Graceful shutdown of SimpleAsyncTaskExecutor #​36362
  • Duplicate response headers with ResponseEntity<Mono<T>> (or Kotlin suspend function) controller method #​36357
  • HttpServiceProxyFactory returns LinkedHashMap instead of target type for method with generic return type #​36326
  • HttpMediaTypeException thrown when calculating compatible media types #​36300

📔 Documentation

  • Document FullyQualifiedConfigurationBeanNameGenerator in Javadoc and reference docs #​36455
  • Document @Fallback alongside Primary in the reference manual and @Bean Javadoc #​36439
  • Fix links to UriComponentsBuilder and polish examples #​36403
  • Emphasize @Configuration classes over XML and Groovy in testing chapter #​36393
  • Document tips to avoid issues with ignored default context configuration in tests #​36392
  • Polish SpEL operator examples in reference docs #​36367
  • Add programmatic configuration tabs in the transactional refdoc #​36323
  • Document registration recommendations for BeanPostProcessor and BeanFactoryPostProcessor #​34964

🔨 Dependency Upgrades

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​AgilAghamirzayev, @​aavoronin93, @​cetf9h, @​froggy0m0, @​gbouwen, @​husseinvr97, @​jisub-dev, @​ngocnhan-tran1996, @​siom79, and @​xxxxxxjun

v7.0.5

⚠️ Attention Required

  • Optimize request and response header handling in Spring MVC #​36334

⭐ New Features

  • Consistent adaptation of HTTP headers on Servlet responses #​36343
  • Copy methodAnnotations in MethodParameter copy constructor #​36342
  • Improve performance of validation groups determination in WebFlux #​36336
  • Reuse AnnotatedMethod annotation cache in derived instances #​36322
  • Optimize the addition of a charset to the MediaType in AbstractHttpMessageConverter #​36320
  • Optimize MediaType(MediaType, Charset) constructor #​36318
  • Detect all common size exceptions from Tomcat and Commons FileUpload 2.x #​36317
  • Consistently support @Autowired as a meta-annotation #​36315
  • Avoid duplicate required attribute lookup for @Autowired annotations #​36314
  • Cache @ResponseBody presence per controller class in RequestResponseBodyMethodProcessor #​36311

🐞 Bug Fixes

  • ResolvableType#getGenerics() breaks serialization #​36346
  • DefaultHttpMessageConverters not adding provided configurer #​36332
  • Restore early MessageConsumer creation for temporary queue #​36321
  • Multipart upload leak on client abort (ByteBuf.release() not called) #​36262

📔 Documentation

  • Document that SpEL expressions using Optional with null-safe and Elvis operators are not compilable #​36331
  • Improve documentation of baseline API version to emphasize version must be supported #​36316
  • Stop referring to obsolete ListenableFuture in documentation #​36313
  • Stop referring to standard Java features as "Java 8" features in documentation #​36310

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​Niravil and @​TAKETODAY

v7.0.4

⭐ New Features
  • Cache method annotations in MethodParameter and AnnotatedMethod #​36307
  • Consistently support @Lazy as a meta-annotation at arbitrary depths #​36306
  • Consistently support @Validated as a meta-annotation at arbitrary depths #​36305
  • Let developers disable default registrations in HttpMessageConverters #​36303
  • Log which HandlerInterceptor threw the exception #​36281
  • Improve performance of hashcode calculations for request mappings #​36279
  • Improve performance of HandlerMethod bean lookup #​36278
  • Improve performance of version mapping #​36276
  • Improve performance of single pattern request mappings #​36275
  • Improve performance of validation groups determination #​36274
  • Add setPackagesToScan configuration method to LocalEntityManagerFactoryBean #​36270
  • Remove outdated GraalVM substitution #​36257
  • Introduce beforeRetry callback with RetryState argument #​36245
  • Optimize NamedParameterUtils#buildValueArray by lazily fetching SqlParameter #​36230
  • Allow customization of the ProxyFactory in HttpServiceProxyFactory used to create HTTP service proxies #​36225
  • Consistently close streams through try-with-resources in FileCopyUtils #​36223
  • Use Java Files utilities in FileCopyUtils #​36221
  • SqlBinaryValue and SqlCharacterValue should support InputStream content with undetermined length #​36219
  • Support JtaTransactionManager and SpringBeanContainer configuration on HibernateJpaVendorAdapter #​36216
  • Add TaskCallback/Callable/Runnable wrapper for retryable tasks #​36208
  • Refine YamlProcessor to allow different empty values #​36207
  • Anticipate fixing Kotlin 2.3 compilation warning #​36203
  • Allow YAML processors to create a flattened map with nulls included #​36197
  • Use Reader.transferTo in FileCopyUtils #​36196
  • DataBufferUtils.write() with NettyDataBuffer on JDK 25 hangs indefinitely #​36184
  • Make SendToMethodReturnValueHandler and SubscriptionMethodReturnValueHandler customizable, to allow for pass-through of message headers #​36179
  • Introduce RestClient.ResponseSpec#requiredBody #​36173
  • Make scope fully configurable in BeanRegistry/BeanRegistrar #​36171
  • ConcurrencyThrottleSupport and thread interruption #​36167
  • Add overloaded sendAndReceive methods to JmsTemplate to use explicit response queue #​36162
  • WebClient (Reactor) attributes on Netty channel do not clear after connection release #​36158
  • Support HttpEntity on ContentRequestMatchers.multipartData #​36154
  • Reintroduce WebLogicJtaTransactionManager in Spring Framework 6.2.x #​36151
  • Back-off for DefaultMessageListenerContainer is not applied consistently in case of listener setup failure #​36143
  • Early support for JPA 4.0 EntityAgent (autowiring a shared proxy) #​36025
  • Early compatibility with JPA 4.0 and Hibernate ORM 8.0 #​35705
🐞 Bug Fixes
  • Resolved HttpEntity Controller argument does not reflect mutated HTTP headers #​36298
  • Avoid lock congestion in ConcurrentReferenceHashMap #​36293
  • AbstractMessageConverter does not support wildcards in supported MIME types #​36285
  • Make LocalEntityManagerFactoryBean#setDataSource work on Hibernate as well as EclipseLink #​36271
  • StompBrokerRelayMessageHandler fails to restart due to test context pausing #​36266
  • Deadlock might occur when calling System.exit on startup (against multiple shutdown hooks) #​36260
  • Missing resource hint for BeanRegistrar implementing ImportAware #​36242
  • Inconsistent behavior with @Retryable on annotated interfaces #​36233
  • Netty4HeadersAdapter.remove returns empty list instead of null for non-existing key #​36226
  • Generic type in AsyncTaskExecutor.submit(Callable) should be @Nullable #​36191
  • EclipseLinkConnectionHandle can fail against transaction isolation race condition #​36165
📔 Documentation
  • Remove obsolete code in Redirecting to a resource section #​36284
  • Fix formatting in Web MVC HTTP Message Conversion documentation #​36250
  • Remove obsolete doc for spring.context.annotated-bean-reader.create #​36241
  • Document @SpringExtensionConfig in the reference manual #​36240
  • Fix JSON syntax in STOMP overview documentation #​36229
  • Revise documentation on JSR-330 support in the reference manual #​36222
  • Fix links to JUnit User Guide #​36217
  • Corrected the definition of coroutines #​36209
  • Fix LocalContainerEntityManagerFactoryBean#setPersistenceUnitName javadoc #​36205
  • Update documentation on trailing slash handling where type-level @GetMapping("/base") is combined with method level @GetMapping("/") #​36198
  • Update documentation on the MediaType used for ProblemDetail #​36192
  • Extract DispatcherServlet snippets #​36175
  • Replace getErrors() with getBindingResult() in examples #​36170
  • Refine CORS documentation to match latest changes #​36156
🔨 Dependency Upgrades
❤️ Contributors

Thank you to all the contributors who worked on this release:

@​Ivarz, @​catturtle123, @​chschu, @​deejay1, @​dingqianwen, @​dungdm93, @​furaizi, @​izeye, @​kchung1995, @​kilink, @​msridhar, @​ngocnhan-tran1996, @​pgoslatara, @​philwebb, @​pisek, and @​shub-est

v7.0.3

⚠️ Attention Required
  • Introduce Spring property to disable context pausing for tests #​36117
  • Avoid unnecessary pausing of application contexts in the TestContext framework #​36044
⭐ New Features
  • DisconnectedClientHelper should detect presence of RestClientException and WebClientException separately #​36141
  • Deprecate PagedListHolder and PropertyComparator for removal #​36139
  • Add DataAccessException and MessagingException to the excluded outermost exceptions in DisconnectedClientHelper #​36134
  • Support property placeholders in HTTP service registry #​36126
  • Retain original requested bean class for SpringContainedBean #​36116
  • Add task rejection support to SyncTaskExecutor's concurrency throttle #​36114
  • Precompute PropertyDescriptor array in SimpleBeanInfoFactory #​36112
  • Add option for @ConcurrencyLimit to throw rejection exception #​36109
  • Support HttpComponents 5.6 #​36100
  • Fix double encoding in DefaultApiVersionInserter #​36097
  • Optimize single-char wildcard path matching performance #​36095
  • Allow WebFlux ApiVersionResolver to return a Mono #​36084
  • Configure HttpMessageConverters as a list #​36083
  • HTTP Interface with an @RequestBody Object method parameter should use class of actual value #​36078
  • Consistently declare @Nullable on parameter in equals() implementations #​36075
  • Support listener registration for @Transactional triggered method rollbacks #​36073
  • Introduce generalized MethodFailureEvent for use in EventPublicationInterceptor #​36072
  • Avoid duplicate flushes in StringHttpMessageConverter #​36065
  • When no API version is provided, static resources fail to load #​36059
  • When no API version is provided, /error requests also fail. #​36058
  • Declare TaskCallback return value as potentially nullable #​36057
  • Fix case-insensitive semantics for LinkedCaseInsensitiveMap entrySet #​36056
  • Update to NullAway 0.12.15 and fix new warnings #​36054
  • Provide alternative to execute(Retryable) which avoids RetryException in favor of rethrowing the last original RuntimeException #​36052
  • Simplify TransactionalOperator.executeAndAwait by removing Optional #​36039
  • Deprecated MockMvcClientHttpRequestFactory is required for tests with HTTP service interface proxy #​35989
  • Introduce Jackson XML codecs #​35752
  • Support listener registration for @Retryable triggered retry executions #​35382
🐞 Bug Fixes
  • Fix SmartFactoryBean type matching for ResolvableType.NONE #​36123
  • AbstractMessageSendingTemplate ignores headers in convertAndSend() variant #​36120
  • JmsClient.sendAndReceive() fails if headers are included #​36118
  • PropertyDescriptorUtils does not reliably resolve overloaded write methods #​36113
  • Fix context class resolution for nested types in AbstractJacksonHttpMessageConverter #​36111
  • DefaultApiVersionInserter encodes already encoded URI #​36080
  • ConverterFactory nullness mismatch with Converter #​36063
  • WiretapConnector leaks data buffers when response body not consumed #​36050
  • CompilationException should not use -1 for line or column numbers when they are unknown #​36041
  • org.springframework.core.test.tools.TestCompiler.Errors should handle case where warnings are turned into errors #​36037
  • UriComponentsBuilder loses the fragment when it consists of only a single character #​36029
  • Parameter names of the handler method are null in HandlerInterceptor::preHandle during first invocation of an endpoint #​36024
  • PropertyDescriptorUtils does not reliably resolve read/write methods in type hierarchies with generics #​36019
  • Illegal reflection use against Hibernate Validator 9 on module path #​36012
📔 Documentation
  • Clarify unversioned handler matching precedence #​36125
  • Clarify meaning of maxAttempts in FixedBackOff vs. maxRetries in RetryPolicy #​36119
  • Polishing AOT cache documentation #​36108
  • Upgrade Antora dependencies #​36105
  • Modernize the DispatcherServlet Locale documentation #​36099
  • Fix Kotlin example in Multipart Content #​36094
  • Remove @EnableWebFlux from documentation code snippets #​36091
  • Fix Kotlin example in CORS and Functional Endpoints references #​36089
  • Extract remaining WebMVC configuration snippets #​36088
  • Remove the "Other Web Frameworks" documentation #​36086
  • Fix reference links in Configuration page #​36079
  • Document HttpHeaders#toSingleValueMap() case-sensitive behavior #​36070
  • Correct encode Javadoc for UriComponents and UriComponentsBuilder #​36040
  • Fix typos and grammar #​36022
  • Custom @ExceptionHandler silently ignored when spring.mvc.problemdetails.enabled=true without @Order #​35982
  • Document how to discard response body with WebTestClient #​35953
  • Modernize the view technologies section #​35450
  • Remove JavaScript/Kotlin from ScriptEngine documentation #​27919
🔨 Dependency Upgrades
❤️ Contributors

Thank you to all the contributors who worked on this release:

@​JKaplanEmpty-Nes, @​MukjepScarlet, @​TerryTaoYY, @​haydenrear, @​jhan0121, @​jher235, [@​marcphilipp

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the dependencies Pull requests that update a dependency file label Nov 13, 2025
@renovate renovate Bot force-pushed the renovate/major-spring-core branch from f4bb049 to b43e799 Compare November 20, 2025 13:03
@renovate renovate Bot force-pushed the renovate/major-spring-core branch from b43e799 to 95454ba Compare December 11, 2025 21:05
@renovate renovate Bot force-pushed the renovate/major-spring-core branch from 95454ba to 3c93edc Compare January 15, 2026 10:52
@renovate renovate Bot force-pushed the renovate/major-spring-core branch 2 times, most recently from 1b9fdfc to 07f9aff Compare February 18, 2026 13:35
@renovate renovate Bot force-pushed the renovate/major-spring-core branch from 07f9aff to 35b94b0 Compare March 13, 2026 09:55
@sonarqubecloud

sonarqubecloud Bot commented Mar 13, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@renovate renovate Bot force-pushed the renovate/major-spring-core branch from 35b94b0 to 86c56ae Compare April 17, 2026 10:07
@renovate renovate Bot changed the title fix(deps): update spring core to v7 (major) fix(deps): update spring core to v7 May 12, 2026
@renovate renovate Bot force-pushed the renovate/major-spring-core branch from 86c56ae to c7e86ee Compare June 8, 2026 19:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants