Skip to content

chore(deps): bump the spring group across 3 directories with 7 updates - #1622

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/maven/spring-445fcd7c58
Open

chore(deps): bump the spring group across 3 directories with 7 updates#1622
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/maven/spring-445fcd7c58

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 21, 2026

Copy link
Copy Markdown
Contributor

Bumps the spring group with 6 updates in the / directory:

Package From To
org.springframework:spring-webmvc 7.0.0 7.0.9
org.springframework:spring-test 7.0.0 7.0.9
org.springframework:spring-test 7.0.0 7.0.9
org.springframework:spring-framework-bom 7.0.1 7.0.9
org.springframework:spring-webflux 7.0.1 7.0.9
org.springframework:spring-core 7.0.1 7.0.9
org.springframework:spring-context 7.0.1 7.0.9
org.springframework:spring-webmvc 7.0.0 7.0.9
org.springframework:spring-test 7.0.0 7.0.9
org.springframework:spring-webmvc 7.0.0 7.0.9
org.springframework:spring-context 7.0.1 7.0.9

Bumps the spring group with 2 updates in the /aws-serverless-java-container-spring directory: org.springframework:spring-webmvc and org.springframework:spring-test.
Bumps the spring group with 3 updates in the /samples/spring/pet-store directory: org.springframework:spring-webmvc, org.springframework:spring-context and org.springframework:spring-context-indexer.

Updates org.springframework:spring-webmvc from 7.0.0 to 7.0.9

Release notes

Sourced from org.springframework:spring-webmvc's releases.

v7.0.9

⚠️ Attention Required

  • In Spring Framework 7.0.9, ForwardedHeaderFilter (Spring MVC) and ForwardedHeaderTransformer (WebFlux) each provide a boolean constructor argument whether to use the standard "Forwarded" header or the "X-Forwarded" alternative headers. A separate property turns on and off use of "X-Forwarded-Prefix". While the default constructor preserves the existing behavior, we recommend to use the new constructor to explicitly specify which forwarded headers to use to make the processing more deterministic and aligned with what is expected from the proxy. Please, see the updated Security Considerations section for details. In 7.1 with #37072 the default constructor is deprecated and marked for removal. #37090
  • In Spring Framework 7.0.9, SimpleEvaluationContext no longer supports expression compilation by default, regardless of the compiler mode configured via SpelParserConfiguration or the spring.expression.compiler.mode system property or Spring property. Applications that intentionally use SimpleEvaluationContext with trusted expressions and require compilation for performance reasons can opt in by calling withCompilationSupported() on the SimpleEvaluationContext builder. Care should be taken when opting in to compilation, as doing so removes the safety guards applied during interpreted evaluation. #37035

⭐ New Features

  • Ignore an empty port value in URI parsing #37117
  • Avoid retaining class files in annotation metadata #37112
  • Add @Nullable annotations when treating Map.remove() as returning @Nullable #37067
  • Revisit SSE view fragments handling #37061
  • Check list index after auto-grow in AbstractNestablePropertyAccessor #37036
  • Disable SpEL expression compilation by default in SimpleEvaluationContext #37035
  • Limit result size of BigDecimal/BigInteger power operations in SpEL #37034
  • Refactor redirect handling in UrlHandlerFilter #37030
  • Revise stylesheet source handling in XsltView #37029
  • Revise view name handling in UrlFilenameViewController #37027
  • Handle pre-flight requests in functional endpoint setup without DispatcherHandler #37024
  • Improve WebSocket handshake error logging #37023
  • Fix missing nullability in JdbcTemplate.batchUpdate #37012
  • Timeout property in RetryPolicy does not have a default constant #36983
  • Write native configuration files as UTF-8 #36972
  • DefaultServerRequest.ServletParametersMap.entrySet() does not retain HttpServletRequest.getParameterMap() order #36966
  • Perform nextKey within synchronization for SQLite as well #36959
  • Add support for custom ObjectInputFilter on DefaultDeserializer #36958
  • Revise resource bundle caching for common locales #36957
  • Improve nullability for getSession(*) in MockHttpServletRequest #36926
  • Improve fallback logic in ParameterContentNegotiationStrategy and ParameterContentTypeResolver #36925
  • Improve ambiguous match check on preflight request #36903
  • Improve Groovy markup template loading #36902
  • Improve request path handling on a Reactor Netty server #36893
  • Improve JettyWebSocketSession error handling #36891

🐞 Bug Fixes

  • EclipseLinkJpaDialect singleton lock in EclipseLinkConnectionHandle.getConnection() serializes all JDBC connection acquisitions under load #37085
  • MetadataReader fails to read byte[] array from annotation #37083
  • Ensure parsing/tostring symmetry in ContentDisposition #37064
  • Character outside of permitted range in Content Disposition #37062
  • Release Jackson BufferRecycler to its pool in encoders #37059
  • Ensure consistent error escaping #37055
  • Refine template name processing #37054
  • Reset TwoByteMatcher partial match on mismatching byte #37053
  • Refactor async XML parsing limit checks #37031
  • Fix part constraint checks in PartEventHttpMessageReader #37028
  • Fix buffer leak in RSocket SETUP frame handling #37026
  • Ensure correct Jetty core response cookie handling #37025
  • Align domainToAscii with current WhatWG spec #37018
  • Ensure consistent ButtonTag value attribute processing #37017

... (truncated)

Commits
  • 82a6b40 Release Spring Framework 7.0.9
  • a7b1b59 Upgrade to Reactor 2025.0.7
  • 996e3d3 Upgrade to Micrometer 1.16.7
  • 73f5ddd Refactor maxInMemory limit handling for async XML parsing
  • 675f25d Leading slash handling in UrlHandlerFilter
  • 692dbc9 Apply ResourceHandlerUtils checks in XsltView
  • 8647e90 Consistent maxPartSize check in PartEventHttpMessageReader
  • b9379e3 Check viewName for special prefixes in UrlFilenameViewController
  • a784dbe Ensure Payload release on early error in createHeaders
  • 3b492f3 Return sameSite cookie value in Jetty response
  • Additional commits viewable in compare view

Updates org.springframework:spring-test from 7.0.0 to 7.0.9

Release notes

Sourced from org.springframework:spring-test's releases.

v7.0.9

⚠️ Attention Required

  • In Spring Framework 7.0.9, ForwardedHeaderFilter (Spring MVC) and ForwardedHeaderTransformer (WebFlux) each provide a boolean constructor argument whether to use the standard "Forwarded" header or the "X-Forwarded" alternative headers. A separate property turns on and off use of "X-Forwarded-Prefix". While the default constructor preserves the existing behavior, we recommend to use the new constructor to explicitly specify which forwarded headers to use to make the processing more deterministic and aligned with what is expected from the proxy. Please, see the updated Security Considerations section for details. In 7.1 with #37072 the default constructor is deprecated and marked for removal. #37090
  • In Spring Framework 7.0.9, SimpleEvaluationContext no longer supports expression compilation by default, regardless of the compiler mode configured via SpelParserConfiguration or the spring.expression.compiler.mode system property or Spring property. Applications that intentionally use SimpleEvaluationContext with trusted expressions and require compilation for performance reasons can opt in by calling withCompilationSupported() on the SimpleEvaluationContext builder. Care should be taken when opting in to compilation, as doing so removes the safety guards applied during interpreted evaluation. #37035

⭐ New Features

  • Ignore an empty port value in URI parsing #37117
  • Avoid retaining class files in annotation metadata #37112
  • Add @Nullable annotations when treating Map.remove() as returning @Nullable #37067
  • Revisit SSE view fragments handling #37061
  • Check list index after auto-grow in AbstractNestablePropertyAccessor #37036
  • Disable SpEL expression compilation by default in SimpleEvaluationContext #37035
  • Limit result size of BigDecimal/BigInteger power operations in SpEL #37034
  • Refactor redirect handling in UrlHandlerFilter #37030
  • Revise stylesheet source handling in XsltView #37029
  • Revise view name handling in UrlFilenameViewController #37027
  • Handle pre-flight requests in functional endpoint setup without DispatcherHandler #37024
  • Improve WebSocket handshake error logging #37023
  • Fix missing nullability in JdbcTemplate.batchUpdate #37012
  • Timeout property in RetryPolicy does not have a default constant #36983
  • Write native configuration files as UTF-8 #36972
  • DefaultServerRequest.ServletParametersMap.entrySet() does not retain HttpServletRequest.getParameterMap() order #36966
  • Perform nextKey within synchronization for SQLite as well #36959
  • Add support for custom ObjectInputFilter on DefaultDeserializer #36958
  • Revise resource bundle caching for common locales #36957
  • Improve nullability for getSession(*) in MockHttpServletRequest #36926
  • Improve fallback logic in ParameterContentNegotiationStrategy and ParameterContentTypeResolver #36925
  • Improve ambiguous match check on preflight request #36903
  • Improve Groovy markup template loading #36902
  • Improve request path handling on a Reactor Netty server #36893
  • Improve JettyWebSocketSession error handling #36891

🐞 Bug Fixes

  • EclipseLinkJpaDialect singleton lock in EclipseLinkConnectionHandle.getConnection() serializes all JDBC connection acquisitions under load #37085
  • MetadataReader fails to read byte[] array from annotation #37083
  • Ensure parsing/tostring symmetry in ContentDisposition #37064
  • Character outside of permitted range in Content Disposition #37062
  • Release Jackson BufferRecycler to its pool in encoders #37059
  • Ensure consistent error escaping #37055
  • Refine template name processing #37054
  • Reset TwoByteMatcher partial match on mismatching byte #37053
  • Refactor async XML parsing limit checks #37031
  • Fix part constraint checks in PartEventHttpMessageReader #37028
  • Fix buffer leak in RSocket SETUP frame handling #37026
  • Ensure correct Jetty core response cookie handling #37025
  • Align domainToAscii with current WhatWG spec #37018
  • Ensure consistent ButtonTag value attribute processing #37017

... (truncated)

Commits
  • 82a6b40 Release Spring Framework 7.0.9
  • a7b1b59 Upgrade to Reactor 2025.0.7
  • 996e3d3 Upgrade to Micrometer 1.16.7
  • 73f5ddd Refactor maxInMemory limit handling for async XML parsing
  • 675f25d Leading slash handling in UrlHandlerFilter
  • 692dbc9 Apply ResourceHandlerUtils checks in XsltView
  • 8647e90 Consistent maxPartSize check in PartEventHttpMessageReader
  • b9379e3 Check viewName for special prefixes in UrlFilenameViewController
  • a784dbe Ensure Payload release on early error in createHeaders
  • 3b492f3 Return sameSite cookie value in Jetty response
  • Additional commits viewable in compare view

Updates org.springframework:spring-test from 7.0.0 to 7.0.9

Release notes

Sourced from org.springframework:spring-test's releases.

v7.0.9

⚠️ Attention Required

  • In Spring Framework 7.0.9, ForwardedHeaderFilter (Spring MVC) and ForwardedHeaderTransformer (WebFlux) each provide a boolean constructor argument whether to use the standard "Forwarded" header or the "X-Forwarded" alternative headers. A separate property turns on and off use of "X-Forwarded-Prefix". While the default constructor preserves the existing behavior, we recommend to use the new constructor to explicitly specify which forwarded headers to use to make the processing more deterministic and aligned with what is expected from the proxy. Please, see the updated Security Considerations section for details. In 7.1 with #37072 the default constructor is deprecated and marked for removal. #37090
  • In Spring Framework 7.0.9, SimpleEvaluationContext no longer supports expression compilation by default, regardless of the compiler mode configured via SpelParserConfiguration or the spring.expression.compiler.mode system property or Spring property. Applications that intentionally use SimpleEvaluationContext with trusted expressions and require compilation for performance reasons can opt in by calling withCompilationSupported() on the SimpleEvaluationContext builder. Care should be taken when opting in to compilation, as doing so removes the safety guards applied during interpreted evaluation. #37035

⭐ New Features

  • Ignore an empty port value in URI parsing #37117
  • Avoid retaining class files in annotation metadata #37112
  • Add @Nullable annotations when treating Map.remove() as returning @Nullable #37067
  • Revisit SSE view fragments handling #37061
  • Check list index after auto-grow in AbstractNestablePropertyAccessor #37036
  • Disable SpEL expression compilation by default in SimpleEvaluationContext #37035
  • Limit result size of BigDecimal/BigInteger power operations in SpEL #37034
  • Refactor redirect handling in UrlHandlerFilter #37030
  • Revise stylesheet source handling in XsltView #37029
  • Revise view name handling in UrlFilenameViewController #37027
  • Handle pre-flight requests in functional endpoint setup without DispatcherHandler #37024
  • Improve WebSocket handshake error logging #37023
  • Fix missing nullability in JdbcTemplate.batchUpdate #37012
  • Timeout property in RetryPolicy does not have a default constant #36983
  • Write native configuration files as UTF-8 #36972
  • DefaultServerRequest.ServletParametersMap.entrySet() does not retain HttpServletRequest.getParameterMap() order #36966
  • Perform nextKey within synchronization for SQLite as well #36959
  • Add support for custom ObjectInputFilter on DefaultDeserializer #36958
  • Revise resource bundle caching for common locales #36957
  • Improve nullability for getSession(*) in MockHttpServletRequest #36926
  • Improve fallback logic in ParameterContentNegotiationStrategy and ParameterContentTypeResolver #36925
  • Improve ambiguous match check on preflight request #36903
  • Improve Groovy markup template loading #36902
  • Improve request path handling on a Reactor Netty server #36893
  • Improve JettyWebSocketSession error handling #36891

🐞 Bug Fixes

  • EclipseLinkJpaDialect singleton lock in EclipseLinkConnectionHandle.getConnection() serializes all JDBC connection acquisitions under load #37085
  • MetadataReader fails to read byte[] array from annotation #37083
  • Ensure parsing/tostring symmetry in ContentDisposition #37064
  • Character outside of permitted range in Content Disposition #37062
  • Release Jackson BufferRecycler to its pool in encoders #37059
  • Ensure consistent error escaping #37055
  • Refine template name processing #37054
  • Reset TwoByteMatcher partial match on mismatching byte #37053
  • Refactor async XML parsing limit checks #37031
  • Fix part constraint checks in PartEventHttpMessageReader #37028
  • Fix buffer leak in RSocket SETUP frame handling #37026
  • Ensure correct Jetty core response cookie handling #37025
  • Align domainToAscii with current WhatWG spec #37018
  • Ensure consistent ButtonTag value attribute processing #37017

... (truncated)

Commits
  • 82a6b40 Release Spring Framework 7.0.9
  • a7b1b59 Upgrade to Reactor 2025.0.7
  • 996e3d3 Upgrade to Micrometer 1.16.7
  • 73f5ddd Refactor maxInMemory limit handling for async XML parsing
  • 675f25d Leading slash handling in UrlHandlerFilter
  • 692dbc9 Apply ResourceHandlerUtils checks in XsltView
  • 8647e90 Consistent maxPartSize check in PartEventHttpMessageReader
  • b9379e3 Check viewName for special prefixes in UrlFilenameViewController
  • a784dbe Ensure Payload release on early error in createHeaders
  • 3b492f3 Return sameSite cookie value in Jetty response
  • Additional commits viewable in compare view

Updates org.springframework:spring-framework-bom from 7.0.1 to 7.0.9

Release notes

Sourced from org.springframework:spring-framework-bom's releases.

v7.0.9

⚠️ Attention Required

  • In Spring Framework 7.0.9, ForwardedHeaderFilter (Spring MVC) and ForwardedHeaderTransformer (WebFlux) each provide a boolean constructor argument whether to use the standard "Forwarded" header or the "X-Forwarded" alternative headers. A separate property turns on and off use of "X-Forwarded-Prefix". While the default constructor preserves the existing behavior, we recommend to use the new constructor to explicitly specify which forwarded headers to use to make the processing more deterministic and aligned with what is expected from the proxy. Please, see the updated Security Considerations section for details. In 7.1 with #37072 the default constructor is deprecated and marked for removal. #37090
  • In Spring Framework 7.0.9, SimpleEvaluationContext no longer supports expression compilation by default, regardless of the compiler mode configured via SpelParserConfiguration or the spring.expression.compiler.mode system property or Spring property. Applications that intentionally use SimpleEvaluationContext with trusted expressions and require compilation for performance reasons can opt in by calling withCompilationSupported() on the SimpleEvaluationContext builder. Care should be taken when opting in to compilation, as doing so removes the safety guards applied during interpreted evaluation. #37035

⭐ New Features

  • Ignore an empty port value in URI parsing #37117
  • Avoid retaining class files in annotation metadata #37112
  • Add @Nullable annotations when treating Map.remove() as returning @Nullable #37067
  • Revisit SSE view fragments handling #37061
  • Check list index after auto-grow in AbstractNestablePropertyAccessor #37036
  • Disable SpEL expression compilation by default in SimpleEvaluationContext #37035
  • Limit result size of BigDecimal/BigInteger power operations in SpEL #37034
  • Refactor redirect handling in UrlHandlerFilter #37030
  • Revise stylesheet source handling in XsltView #37029
  • Revise view name handling in UrlFilenameViewController #37027
  • Handle pre-flight requests in functional endpoint setup without DispatcherHandler #37024
  • Improve WebSocket handshake error logging #37023
  • Fix missing nullability in JdbcTemplate.batchUpdate #37012
  • Timeout property in RetryPolicy does not have a default constant #36983
  • Write native configuration files as UTF-8 #36972
  • DefaultServerRequest.ServletParametersMap.entrySet() does not retain HttpServletRequest.getParameterMap() order #36966
  • Perform nextKey within synchronization for SQLite as well #36959
  • Add support for custom ObjectInputFilter on DefaultDeserializer #36958
  • Revise resource bundle caching for common locales #36957
  • Improve nullability for getSession(*) in MockHttpServletRequest #36926
  • Improve fallback logic in ParameterContentNegotiationStrategy and ParameterContentTypeResolver #36925
  • Improve ambiguous match check on preflight request #36903
  • Improve Groovy markup template loading #36902
  • Improve request path handling on a Reactor Netty server #36893
  • Improve JettyWebSocketSession error handling #36891

🐞 Bug Fixes

  • EclipseLinkJpaDialect singleton lock in EclipseLinkConnectionHandle.getConnection() serializes all JDBC connection acquisitions under load #37085
  • MetadataReader fails to read byte[] array from annotation #37083
  • Ensure parsing/tostring symmetry in ContentDisposition #37064
  • Character outside of permitted range in Content Disposition #37062
  • Release Jackson BufferRecycler to its pool in encoders #37059
  • Ensure consistent error escaping #37055
  • Refine template name processing #37054
  • Reset TwoByteMatcher partial match on mismatching byte #37053
  • Refactor async XML parsing limit checks #37031
  • Fix part constraint checks in PartEventHttpMessageReader #37028
  • Fix buffer leak in RSocket SETUP frame handling #37026
  • Ensure correct Jetty core response cookie handling #37025
  • Align domainToAscii with current WhatWG spec #37018
  • Ensure consistent ButtonTag value attribute processing #37017

... (truncated)

Commits
  • 82a6b40 Release Spring Framework 7.0.9
  • a7b1b59 Upgrade to Reactor 2025.0.7
  • 996e3d3 Upgrade to Micrometer 1.16.7
  • 73f5ddd Refactor maxInMemory limit handling for async XML parsing
  • 675f25d Leading slash handling in UrlHandlerFilter
  • 692dbc9 Apply ResourceHandlerUtils checks in XsltView
  • 8647e90 Consistent maxPartSize check in PartEventHttpMessageReader
  • b9379e3 Check viewName for special prefixes in UrlFilenameViewController
  • a784dbe Ensure Payload release on early error in createHeaders
  • 3b492f3 Return sameSite cookie value in Jetty response
  • Additional commits viewable in compare view

Updates org.springframework:spring-webflux from 7.0.1 to 7.0.9

Release notes

Sourced from org.springframework:spring-webflux's releases.

v7.0.9

⚠️ Attention Required

  • In Spring Framework 7.0.9, ForwardedHeaderFilter (Spring MVC) and ForwardedHeaderTransformer (WebFlux) each provide a boolean constructor argument whether to use the standard "Forwarded" header or the "X-Forwarded" alternative headers. A separate property turns on and off use of "X-Forwarded-Prefix". While the default constructor preserves the existing behavior, we recommend to use the new constructor to explicitly specify which forwarded headers to use to make the processing more deterministic and aligned with what is expected from the proxy. Please, see the updated Security Considerations section for details. In 7.1 with #37072 the default constructor is deprecated and marked for removal. #37090
  • In Spring Framework 7.0.9, SimpleEvaluationContext no longer supports expression compilation by default, regardless of the compiler mode configured via SpelParserConfiguration or the spring.expression.compiler.mode system property or Spring property. Applications that intentionally use SimpleEvaluationContext with trusted expressions and require compilation for performance reasons can opt in by calling withCompilationSupported() on the SimpleEvaluationContext builder. Care should be taken when opting in to compilation, as doing so removes the safety guards applied during interpreted evaluation. #37035

⭐ New Features

  • Ignore an empty port value in URI parsing #37117
  • Avoid retaining class files in annotation metadata #37112
  • Add @Nullable annotations when treating Map.remove() as returning @Nullable #37067
  • Revisit SSE view fragments handling #37061
  • Check list index after auto-grow in AbstractNestablePropertyAccessor #37036
  • Disable SpEL expression compilation by default in SimpleEvaluationContext #37035
  • Limit result size of BigDecimal/BigInteger power operations in SpEL #37034
  • Refactor redirect handling in UrlHandlerFilter #37030
  • Revise stylesheet source handling in XsltView #37029
  • Revise view name handling in UrlFilenameViewController #37027
  • Handle pre-flight requests in functional endpoint setup without DispatcherHandler #37024
  • Improve WebSocket handshake error logging #37023
  • Fix missing nullability in JdbcTemplate.batchUpdate #37012
  • Timeout property in RetryPolicy does not have a default constant #36983
  • Write native configuration files as UTF-8 #36972
  • DefaultServerRequest.ServletParametersMap.entrySet() does not retain HttpServletRequest.getParameterMap() order #36966
  • Perform nextKey within synchronization for SQLite as well #36959
  • Add support for custom ObjectInputFilter on DefaultDeserializer #36958
  • Revise resource bundle caching for common locales #36957
  • Improve nullability for getSession(*) in MockHttpServletRequest #36926
  • Improve fallback logic in ParameterContentNegotiationStrategy and ParameterContentTypeResolver #36925
  • Improve ambiguous match check on preflight request #36903
  • Improve Groovy markup template loading #36902
  • Improve request path handling on a Reactor Netty server #36893
  • Improve JettyWebSocketSession error handling #36891

🐞 Bug Fixes

  • EclipseLinkJpaDialect singleton lock in EclipseLinkConnectionHandle.getConnection() serializes all JDBC connection acquisitions under load #37085
  • MetadataReader fails to read byte[] array from annotation #37083
  • Ensure parsing/tostring symmetry in ContentDisposition #37064
  • Character outside of permitted range in Content Disposition #37062
  • Release Jackson BufferRecycler to its pool in encoders #37059
  • Ensure consistent error escaping #37055
  • Refine template name processing #37054
  • Reset TwoByteMatcher partial match on mismatching byte #37053
  • Refactor async XML parsing limit checks #37031
  • Fix part constraint checks in PartEventHttpMessageReader #37028
  • Fix buffer leak in RSocket SETUP frame handling #37026
  • Ensure correct Jetty core response cookie handling #37025
  • Align domainToAscii with current WhatWG spec #37018
  • Ensure consistent ButtonTag value attribute processing #37017

... (truncated)

Commits
  • 82a6b40 Release Spring Framework 7.0.9
  • a7b1b59 Upgrade to Reactor 2025.0.7
  • 996e3d3 Upgrade to Micrometer 1.16.7
  • 73f5ddd Refactor maxInMemory limit handling for async XML parsing
  • 675f25d Leading slash handling in UrlHandlerFilter
  • 692dbc9 Apply ResourceHandlerUtils checks in XsltView
  • 8647e90 Consistent maxPartSize check in PartEventHttpMessageReader
  • b9379e3 Check viewName for special prefixes in UrlFilenameViewController
  • a784dbe Ensure Payload release on early error in createHeaders
  • 3b492f3 Return sameSite cookie value in Jetty response
  • Additional commits viewable in compare view

Updates org.springframework:spring-core from 7.0.1 to 7.0.9

Release notes

Sourced from org.springframework:spring-core's releases.

v7.0.9

⚠️ Attention Required

  • In Spring Framework 7.0.9, ForwardedHeaderFilter (Spring MVC) and ForwardedHeaderTransformer (WebFlux) each provide a boolean constructor argument whether to use the standard "Forwarded" header or the "X-Forwarded" alternative headers. A separate property turns on and off use of "X-Forwarded-Prefix". While the default constructor preserves the existing behavior, we recommend to use the new constructor to explicitly specify which forwarded headers to use to make the processing more deterministic and aligned with what is expected from the proxy. Please, see the updated Security Considerations section for details. In 7.1 with #37072 the default constructor is deprecated and marked for removal. #37090
  • In Spring Framework 7.0.9, SimpleEvaluationContext no longer supports expression compilation by default, regardless of the compiler mode configured via SpelParserConfiguration or the spring.expression.compiler.mode system property or Spring property. Applications that intentionally use SimpleEvaluationContext with trusted expressions and require compilation for performance reasons can opt in by calling withCompilationSupported() on the SimpleEvaluationContext builder. Care should be taken when opting in to compilation, as doing so removes the safety guards applied during interpreted evaluation. #37035

⭐ New Features

  • Ignore an empty port value in URI parsing #37117
  • Avoid retaining class files in annotation metadata #37112
  • Add @Nullable annotations when treating Map.remove() as returning @Nullable #37067
  • Revisit SSE view fragments handling #37061
  • Check list index after auto-grow in AbstractNestablePropertyAccessor #37036
  • Disable SpEL expression compilation by default in SimpleEvaluationContext #37035
  • Limit result size of BigDecimal/BigInteger power operations in SpEL #37034
  • Refactor redirect handling in UrlHandlerFilter #37030
  • Revise stylesheet source handling in XsltView #37029
  • Revise view name handling in UrlFilenameViewController #37027
  • Handle pre-flight requests in functional endpoint setup without DispatcherHandler #37024
  • Improve WebSocket handshake error logging #37023
  • Fix missing nullability in JdbcTemplate.batchUpdate #37012
  • Timeout property in RetryPolicy does not have a default constant #36983
  • Write native configuration files as UTF-8 #36972
  • DefaultServerRequest.ServletParametersMap.entrySet() does not retain HttpServletRequest.getParameterMap() order #36966
  • Perform nextKey within synchronization for SQLite as well #36959
  • Add support for custom ObjectInputFilter on DefaultDeserializer #36958
  • Revise resource bundle caching for common locales #36957
  • Improve nullability for getSession(*) in MockHttpServletRequest #36926
  • Improve fallback logic in ParameterContentNegotiationStrategy and ParameterContentTypeResolver #36925
  • Improve ambiguous match check on preflight request #36903
  • Improve Groovy markup template loading #36902
  • Improve request path handling on a Reactor Netty server #36893
  • Improve JettyWebSocketSession error handling #36891

🐞 Bug Fixes

  • EclipseLinkJpaDialect singleton lock in EclipseLinkConnectionHandle.getConnection() serializes all JDBC connection acquisitions under load #37085
  • MetadataReader fails to read byte[] array from annotation #37083
  • Ensure parsing/tostring symmetry in ContentDisposition #37064
  • Character outside of permitted range in Content Disposition #37062
  • Release Jackson BufferRecycler to its pool in encoders #37059
  • Ensure consistent error escaping #37055
  • Refine template name processing #37054
  • Reset TwoByteMatcher partial match on mismatching byte #37053
  • Refactor async XML parsing limit checks #37031
  • Fix part constraint checks in PartEventHttpMessageReader #37028
  • Fix buffer leak in RSocket SETUP frame handling #37026
  • Ensure correct Jetty core response cookie handling #37025
  • Align domainToAscii with current WhatWG spec #37018
  • Ensure consistent ButtonTag value attribute processing #37017

... (truncated)

Commits

@dependabot
chore(deps): bump the spring group across 3 directories with 7 updates
c45b3c2 
Bumps the spring group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [org.springframework:spring-webmvc](https://github.com/spring-projects/spring-framework) | `7.0.0` | `7.0.9` |
| [org.springframework:spring-test](https://github.com/spring-projects/spring-framework) | `7.0.0` | `7.0.9` |
| [org.springframework:spring-test](https://github.com/spring-projects/spring-framework) | `7.0.0` | `7.0.9` |
| [org.springframework:spring-framework-bom](https://github.com/spring-projects/spring-framework) | `7.0.1` | `7.0.9` |
| [org.springframework:spring-webflux](https://github.com/spring-projects/spring-framework) | `7.0.1` | `7.0.9` |
| [org.springframework:spring-core](https://github.com/spring-projects/spring-framework) | `7.0.1` | `7.0.9` |
| [org.springframework:spring-context](https://github.com/spring-projects/spring-framework) | `7.0.1` | `7.0.9` |
| [org.springframework:spring-webmvc](https://github.com/spring-projects/spring-framework) | `7.0.0` | `7.0.9` |
| [org.springframework:spring-test](https://github.com/spring-projects/spring-framework) | `7.0.0` | `7.0.9` |
| [org.springframework:spring-webmvc](https://github.com/spring-projects/spring-framework) | `7.0.0` | `7.0.9` |
| [org.springframework:spring-context](https://github.com/spring-projects/spring-framework) | `7.0.1` | `7.0.9` |

Bumps the spring group with 2 updates in the /aws-serverless-java-container-spring directory: [org.springframework:spring-webmvc](https://github.com/spring-projects/spring-framework) and [org.springframework:spring-test](https://github.com/spring-projects/spring-framework).
Bumps the spring group with 3 updates in the /samples/spring/pet-store directory: [org.springframework:spring-webmvc](https://github.com/spring-projects/spring-framework), [org.springframework:spring-context](https://github.com/spring-projects/spring-framework) and [org.springframework:spring-context-indexer](https://github.com/spring-projects/spring-framework).


Updates `org.springframework:spring-webmvc` from 7.0.0 to 7.0.9
- [Release notes](https://github.com/spring-projects/spring-framework/releases)
- [Commits](spring-projects/spring-framework@v7.0.0...v7.0.9)

Updates `org.springframework:spring-test` from 7.0.0 to 7.0.9
- [Release notes](https://github.com/spring-projects/spring-framework/releases)
- [Commits](spring-projects/spring-framework@v7.0.0...v7.0.9)

Updates `org.springframework:spring-test` from 7.0.0 to 7.0.9
- [Release notes](https://github.com/spring-projects/spring-framework/releases)
- [Commits](spring-projects/spring-framework@v7.0.0...v7.0.9)

Updates `org.springframework:spring-framework-bom` from 7.0.1 to 7.0.9
- [Release notes](https://github.com/spring-projects/spring-framework/releases)
- [Commits](spring-projects/spring-framework@v7.0.1...v7.0.9)

Updates `org.springframework:spring-webflux` from 7.0.1 to 7.0.9
- [Release notes](https://github.com/spring-projects/spring-framework/releases)
- [Commits](spring-projects/spring-framework@v7.0.1...v7.0.9)

Updates `org.springframework:spring-core` from 7.0.1 to 7.0.9
- [Release notes](https://github.com/spring-projects/spring-framework/releases)
- [Commits](spring-projects/spring-framework@v7.0.1...v7.0.9)

Updates `org.springframework:spring-context` from 7.0.1 to 7.0.9
- [Release notes](https://github.com/spring-projects/spring-framework/releases)
- [Commits](spring-projects/spring-framework@v7.0.1...v7.0.9)

Updates `org.springframework:spring-webmvc` from 7.0.0 to 7.0.9
- [Release notes](https://github.com/spring-projects/spring-framework/releases)
- [Commits](spring-projects/spring-framework@v7.0.0...v7.0.9)

Updates `org.springframework:spring-test` from 7.0.0 to 7.0.9
- [Release notes](https://github.com/spring-projects/spring-framework/releases)
- [Commits](spring-projects/spring-framework@v7.0.0...v7.0.9)

Updates `org.springframework:spring-webmvc` from 7.0.0 to 7.0.9
- [Release notes](https://github.com/spring-projects/spring-framework/releases)
- [Commits](spring-projects/spring-framework@v7.0.0...v7.0.9)

Updates `org.springframework:spring-context` from 7.0.1 to 7.0.9
- [Release notes](https://github.com/spring-projects/spring-framework/releases)
- [Commits](spring-projects/spring-framework@v7.0.1...v7.0.9)

Updates `org.springframework:spring-webmvc` from 7.0.0 to 7.0.9
- [Release notes](https://github.com/spring-projects/spring-framework/releases)
- [Commits](spring-projects/spring-framework@v7.0.0...v7.0.9)

Updates `org.springframework:spring-test` from 7.0.0 to 7.0.9
- [Release notes](https://github.com/spring-projects/spring-framework/releases)
- [Commits](spring-projects/spring-framework@v7.0.0...v7.0.9)

Updates `org.springframework:spring-webmvc` from 7.0.0 to 7.0.9
- [Release notes](https://github.com/spring-projects/spring-framework/releases)
- [Commits](spring-projects/spring-framework@v7.0.0...v7.0.9)

Updates `org.springframework:spring-test` from 7.0.0 to 7.0.9
- [Release notes](https://github.com/spring-projects/spring-framework/releases)
- [Commits](spring-projects/spring-framework@v7.0.0...v7.0.9)

Updates `org.springframework:spring-webmvc` from 7.0.0 to 7.0.9
- [Release notes](https://github.com/spring-projects/spring-framework/releases)
- [Commits](spring-projects/spring-framework@v7.0.0...v7.0.9)

Updates `org.springframework:spring-webmvc` from 6.2.10 to 7.0.9
- [Release notes](https://github.com/spring-projects/spring-framework/releases)
- [Commits](spring-projects/spring-framework@v7.0.0...v7.0.9)

Updates `org.springframework:spring-context` from 6.2.10 to 7.0.9
- [Release notes](https://github.com/spring-projects/spring-framework/releases)
- [Commits](spring-projects/spring-framework@v7.0.1...v7.0.9)

Updates `org.springframework:spring-context-indexer` from 6.2.10 to 7.0.9
- [Release notes](https://github.com/spring-projects/spring-framework/releases)
- [Commits](spring-projects/spring-framework@v6.2.10...v7.0.9)

Updates `org.springframework:spring-context` from 6.2.10 to 7.0.9
- [Release notes](https://github.com/spring-projects/spring-framework/releases)
- [Commits](spring-projects/spring-framework@v7.0.1...v7.0.9)

Updates `org.springframework:spring-webmvc` from 6.2.10 to 7.0.9
- [Release notes](https://github.com/spring-projects/spring-framework/releases)
- [Commits](spring-projects/spring-framework@v7.0.0...v7.0.9)

Updates `org.springframework:spring-webmvc` from 6.2.10 to 7.0.9
- [Release notes](https://github.com/spring-projects/spring-framework/releases)
- [Commits](spring-projects/spring-framework@v7.0.0...v7.0.9)

Updates `org.springframework:spring-context` from 6.2.10 to 7.0.9
- [Release notes](https://github.com/spring-projects/spring-framework/releases)
- [Commits](spring-projects/spring-framework@v7.0.1...v7.0.9)

Updates `org.springframework:spring-context-indexer` from 6.2.10 to 7.0.9
- [Release notes](https://github.com/spring-projects/spring-framework/releases)
- [Commits](spring-projects/spring-framework@v6.2.10...v7.0.9)

---
updated-dependencies:
- dependency-name: org.springframework:spring-webmvc
  dependency-version: 7.0.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: spring
- dependency-name: org.springframework:spring-test
  dependency-version: 7.0.9
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: spring
- dependency-name: org.springframework:spring-test
  dependency-version: 7.0.9
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: spring
- dependency-name: org.springframework:spring-framework-bom
  dependency-version: 7.0.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: spring
- dependency-name: org.springframework:spring-webflux
  dependency-version: 7.0.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: spring
- dependency-name: org.springframework:spring-core
  dependency-version: 7.0.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: spring
- dependency-name: org.springframework:spring-context
  dependency-version: 7.0.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: spring
- dependency-name: org.springframework:spring-webmvc
  dependency-version: 7.0.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: spring
- dependency-name: org.springframework:spring-test
  dependency-version: 7.0.9
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: spring
- dependency-name: org.springframework:spring-webmvc
  dependency-version: 7.0.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: spring
- dependency-name: org.springframework:spring-context
  dependency-version: 7.0.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: spring
- dependency-name: org.springframework:spring-webmvc
  dependency-version: 7.0.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: spring
- dependency-name: org.springframework:spring-test
  dependency-version: 7.0.9
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: spring
- dependency-name: org.springframework:spring-webmvc
  dependency-version: 7.0.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: spring
- dependency-name: org.springframework:spring-test
  dependency-version: 7.0.9
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: spring
- dependency-name: org.springframework:spring-webmvc
  dependency-version: 7.0.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: spring
- dependency-name: org.springframework:spring-webmvc
  dependency-version: 7.0.9
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: spring
- dependency-name: org.springframework:spring-context
  dependency-version: 7.0.9
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: spring
- dependency-name: org.springframework:spring-context-indexer
  dependency-version: 7.0.9
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: spring
- dependency-name: org.springframework:spring-context
  dependency-version: 7.0.9
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: spring
- dependency-name: org.springframework:spring-webmvc
  dependency-version: 7.0.9
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: spring
- dependency-name: org.springframework:spring-webmvc
  dependency-version: 7.0.9
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: spring
- dependency-name: org.springframework:spring-context
  dependency-version: 7.0.9
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: spring
- dependency-name: org.springframework:spring-context-indexer
  dependency-version: 7.0.9
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: spring
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update Java code labels Sep 21, 2026
@dependabot dependabot Bot mentioned this pull request Sep 21, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file java Pull requests that update Java code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants