Skip to content

fix(deps): update dependency org.springframework:spring-webmvc to v6.2.19 [security] - #32

Open
alaudaa-renovate[bot] wants to merge 1 commit into
alauda-2025.1.0from
renovate/patch-springversion
Open

fix(deps): update dependency org.springframework:spring-webmvc to v6.2.19 [security]#32
alaudaa-renovate[bot] wants to merge 1 commit into
alauda-2025.1.0from
renovate/patch-springversion

Conversation

@alaudaa-renovate

@alaudaa-renovate alaudaa-renovate Bot commented Nov 21, 2025 •
edited
Loading

Copy link
Copy Markdown

This PR contains the following updates:

Package Change Age Confidence
org.springframework:spring-webmvc 6.2.7 -> 6.2.19 age confidence

Spring Framework MVC Applications Path Traversal Vulnerability

CVE-2025-41242 / GHSA-r936-gwx5-v52f

More information

Details

Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant Servlet container.

An application can be vulnerable when all the following are true:

We have verified that applications deployed on Apache Tomcat or Eclipse Jetty are not vulnerable, as long as default security features are not disabled in the configuration. Because we cannot check exploits against all Servlet containers and configuration variants, we strongly recommend upgrading your application.

Severity

  • CVSS Score: 5.9 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Spring MVC and WebFlux has Server Sent Event stream corruption

CVE-2026-22735 / GHSA-6hcq-hmm3-jj3c

More information

Details

Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE). This issue affects Spring Foundation: from 7.0.0 through 7.0.5, from 6.2.0 through 6.2.16, from 6.1.0 through 6.1.25, from 5.3.0 through 5.3.46.

Severity

  • CVSS Score: 2.6 / 10 (Low)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Spring Framework Improper Path Limitation with Script View Templates

CVE-2026-22737 / GHSA-4773-3jfm-qmx3

More information

Details

Use of Java scripting engine enabled (e.g. JRuby, Jython) template views in Spring MVC and Spring WebFlux applications can result in disclosure of content from files outside the configured locations for script template views. This issue affects Spring Framework: from 7.0.0 through 7.0.5, from 6.2.0 through 6.2.16, from 6.1.0 through 6.1.25, from 5.3.0 through 5.3.46.

Severity

  • CVSS Score: 5.9 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources

CVE-2026-22745 / GHSA-6p4f-wcwh-5vvm

More information

Details

Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources.

More precisely, an application can be vulnerable when all the following are true:

  • the application is using Spring MVC or Spring WebFlux
  • the application is serving static resources from the file system
  • the application is running on a Windows platform

When all the conditions above are met, the attacker can send malicious requests that are slow to resolve and that can keep HTTP connections in use. This can cause a Denial of Service on the application.

Severity

  • CVSS Score: 5.3 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources.

CVE-2026-22741 / GHSA-wg35-8jpf-2xv3

More information

Details

Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources.

More precisely, an application can be vulnerable when all the following are true:

When all the conditions above are met, the attacker can send malicious requests and poison the resource cache with resources using the wrong encoding. This can cause a denial of service by breaking the front-end application for clients.

Severity

  • CVSS Score: 3.1 / 10 (Low)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Spring Framework Multipart Request Smuggling in Spring MVC and WebFlux

CVE-2026-41853 / GHSA-cjpg-rgq5-fr37

More information

Details

Spring MVC and WebFlux applications are vulnerable to Multipart request smuggling attacks.

Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

Severity

  • CVSS Score: 5.3 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux

CVE-2026-41842 / GHSA-x23c-287f-qqv5

More information

Details

Spring MVC and WebFlux applications are vulnerable to Denial of Service (DoS) attacks when resolving static resources.

Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

Severity

  • CVSS Score: 7.5 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Spring Framework Open Redirect in Spring MVC and WebFlux

CVE-2026-41844 / GHSA-h3qp-gqrc-q736

More information

Details

A Spring MVC or Spring WebFlux application which configures a mapping for "/**" where the view name is not explicitly specified allows an attacker to craft a link resulting in a 302 redirect to an arbitrary external host via the redirect: prefix.

Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

Severity

  • CVSS Score: 4.2 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Spring Framework Cross-site Scripting via JSP Form Tags

CVE-2026-41846 / GHSA-957g-f97v-vppc

More information

Details

Spring MVC applications which accept user-supplied values in the cssClass, cssErrorClass, or cssStyle attributes of JSP form tags allow arbitrary HTML/JavaScript code injection, potentially resulting in a cross-site scripting (XSS) vulnerability.

Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

Severity

  • CVSS Score: 5.9 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Spring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFlux

CVE-2026-41841 / GHSA-mq64-j8f9-9gcj

More information

Details

Spring MVC and WebFlux applications are vulnerable to Information Disclosure attacks when resolving static resources.

Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

Severity

  • CVSS Score: 5.9 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Spring Framework Cross-site Scripting via JavaScriptUtils

CVE-2026-41845 / GHSA-3chg-m5w7-qfv5

More information

Details

Due to incorrect escaping, the use of JavaScriptUtils.javaScriptEscape() may lead to JavaScript code injection in the browser, potentially resulting in a cross-site scripting (XSS) vulnerability.

Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

Severity

  • CVSS Score: 7.1 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Spring Framework Path Traversal via Versioned Static Resources in Spring MVC and WebFlux

CVE-2026-41843 / GHSA-72pg-x5f8-j25j

More information

Details

Spring MVC and WebFlux applications are vulnerable to Path Traversal attacks when resolving static resources.

Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

Severity

  • CVSS Score: 5.9 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Release Notes

spring-projects/spring-framework (org.springframework:spring-webmvc)

v6.2.19

⚠️ Security Fixes

This maintenance release fixes a high number of CVEs. You can learn more about this in the "Spring and Security In The Times Of AI" blog post. Here is the full list of 16 CVEs:

  • CVE-2026-41838 "Spring Framework Predictable Session ID in WebSocket Module"
  • CVE-2026-41839 "Spring Framework Escalation via Session Fixation in WebFlux"
  • CVE-2026-41840 "Spring Framework Denial of Service via Multipart Requests in WebFlux"
  • CVE-2026-41841 "Spring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFlux"
  • CVE-2026-41842 "Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux"
  • CVE-2026-41843 "Spring Framework Path Traversal via Versioned Static Resources in Spring MVC and WebFlux"
  • CVE-2026-41844 "Spring Framework Open Redirect in Spring MVC and WebFlux"
  • CVE-2026-41845 "Spring Framework Cross-site Scripting via JavaScriptUtils"
  • CVE-2026-41846 "Spring Framework Cross-site Scripting via JSP Form Tags"
  • CVE-2026-41848 "Spring Framework Denial of Service via AntPathMatcher"
  • CVE-2026-41850 "Spring Framework Algorithmic Denial of Service via SpEL Expressions"
  • CVE-2026-41851 "Spring Framework Denial of Service via Unbounded Cache in SpEL"
  • CVE-2026-41852 "Spring Framework Arbitrary Method Invocation in SpEL Expressions"
  • CVE-2026-41853 "Spring Framework Multipart Request Smuggling in Spring MVC and WebFlux"
  • CVE-2026-41854 "Spring Framework Server-Side Request Forgery via UriComponentsBuilder"
  • CVE-2026-41855 "Spring Framework Unsafe Deserialization via Jackson JMS Converters"

⭐ New Features

  • Avoid too many character access attempts in AntPathMatcher #​36886
  • Track operations during SpEL expression evaluation #​36887
  • Ensure getters have non-void return types in SpEL #​36888
  • Expose ClassLoader from DefaultDeserializer #​36839
  • Refine default view name resolution #​36794
  • Refine Jackson JMS converters #​36792
  • Improve ABNF rule checks in RfcUriParser #​36788
  • Detect custom deserialized NullValue instances in AbstractValueAdaptingCache #​36728
  • Warn against unsafe static resource locations in MVC and WebFlux #​36693
  • Consistent compatibility with Woodstox as an alternative to Xerces #​36683

🐞 Bug Fixes

  • Data is lost for joined DataBuffer in DataBufferUtils #​36874
  • CronExpression skips days on midnight DST gap #​36873
  • Concurrency issue against shared cookie field in CookieLocaleResolver#setLocaleContext #​36870
  • Server Sent Event does not support multi-line comments #​36867
  • Regression in 6.2.0+: ConfigurationClassParser incorrectly removes component-scanned bean when the same class is also registered under a different name via XML #​36849
  • Bean Background Bootstrap and Lazy Init #​36847
  • Fix JSP tag processing #​36798
  • Fix script processing capabilities #​36796
  • Parsing failure for MIME type with quoted parameter values #​36734
  • Circular dependency between supplier-created beans is silently ignored on startup #​36732
  • Non-deterministic "Body token not expected" in org.springframework.http.codec.multipart.PartGenerator #​36722
  • Regression on value class parameter handling #​36720
  • Cache collisions in CachingResourceResolver #​36718
  • Unexpected path element removal when resolving versioned resources #​36699

📔 Documentation

  • Fix broken links to Selenium documentation #​36877
  • Fix applicability note on setAutoGrowCollectionLimit #​36864
  • Javadoc of nestingLevel parameter in MethodParameter constructor is inconsistent with actual implementation #​36848

🔨 Dependency Upgrades

v6.2.18

⭐ New Features

  • Improve SpringValidatorAdapter and MethodValidationAdapter performance #​36624
  • Add missing @Deprecated(forRemoval = true) for deleted in 7.0 #​36591
  • Deprecate methodIdentification() in CacheAspectSupport for removal #​36576
  • Improve error handling in multipart codecs #​36564
  • LazyConnectionDataSourceProxy does not work well with Hibernate's multi-tenancy by schema strategy #​36529
  • MySQL Error 149 (Galera/WSREP conflict) not translated to ConcurrencyFailureException in Spring JDBC/ORM #​36510

🐞 Bug Fixes

  • Handle Kotlin nullable value class param correctly in CoroutineUtils #​36643
  • NullPointerException in ServerSentEvent when trying to set id or event properties #​36634
  • @Sql fails if DataSource is wrapped in a TransactionAwareDataSourceProxy #​36630
  • WebDataBinder unnecessarily instantiates collections when using the "!" and "_" prefixes #​36627
  • Cache pollution from high-cardinality FieldError default messages in MessageSourceSupport #​36623
  • ContentCachingRequestWrapper does not allow unlimited content caching #​36620
  • MergedAnnotation does not use ClassLoader for method or field #​36614
  • AnnotationBeanNameGenerator fails when an annotation references a non-existent class #​36588
  • FileSystemResource does not strictly follow the Resource#isReadable() contract #​36585
  • Query not hidden in DefaultClientResponse checkpoint #​36571
  • LazyConnectionDataSourceProxy does not pass on holdability to target Connection #​36530
  • DefaultJmsListenerContainer may hang in an endless loop in doShutdown #​36511
  • Inconsistent codings resolution in resource resolvers #​36508

📔 Documentation

  • Clarify semantics of HttpMethod.valueOf() #​36653
  • Document that spring.profiles.active is ignored by @ActiveProfiles #​36636
  • Document whitespace semantics in SpEL expressions #​36629
  • MergedAnnotation.asAnnotationAttributes() Javadoc incorrectly states that it creates an immutable map #​36568
  • Introduce Kotlin examples for Bean Overrides (@MockitoBean, etc.) #​36542
  • Fix incorrect cross-reference links in AbstractEnvironment Javadoc #​36517

🔨 Dependency Upgrades

v6.2.17

⭐ New Features

  • Leverage ResourceHandlerUtils in ScriptTemplateView #​36459
  • Restore ScriptTemplateViewTests #​36457
  • Fix log message in ConfigurationClassBeanDefinitionReader #​36454
  • Resolve context initializers only once in AbstractTestContextBootstrapper #​36431
  • Exclude legacy @javax.validation.Constraint from convention-based annotation attribute override check #​36412
  • Optimize MediaType(MediaType, Charset) constructor #​36351
  • Optimize the addition of a charset to the MediaType in AbstractHttpMessageConverter #​36350
  • Consistent adaptation of HTTP headers on Servlet responses #​36345
  • Improve performance of validation groups determination in WebFlux #​36337
  • Detect all common size exceptions from Tomcat and Commons FileUpload 2.x #​36324

🐞 Bug Fixes

  • Guard against invalid id/event values in Server Sent Events #​36442
  • Incomplete debug message in ConfigurationClassBeanDefinitionReader #​36411
  • Inconsistent ApplicationEventMulticaster state after removing ApplicationListener implemented by FactoryBean #​36405
  • Graceful shutdown of SimpleAsyncTaskExecutor #​36384
  • HttpMediaTypeException thrown when calculating compatible media types #​36363
  • ResolvableType#getGenerics() breaks serialization #​36347
  • Multipart upload leak on client abort (ByteBuf.release() not called) #​36327

📔 Documentation

  • Document @Fallback alongside Primary in the reference manual and @Bean Javadoc #​36441
  • Document registration recommendations for BeanPostProcessor and BeanFactoryPostProcessor #​36436
  • Fix links to UriComponentsBuilder and polish examples #​36406
  • Emphasize @Configuration classes over XML and Groovy in testing chapter #​36394
  • Polish SpEL operator examples in reference docs #​36375

🔨 Dependency Upgrades

v6.2.16

⭐ New Features

  • Improve performance of hashcode calculations for request mappings #​36297
  • Improve performance of HandlerMethod bean lookup #​36296
  • Improve performance of validation groups determination #​36295
  • Improve performance of single pattern request mappings #​36294
  • Optimize NamedParameterUtils#buildValueArray by lazily fetching SqlParameter #​36232
  • Consistently close streams through try-with-resources in FileCopyUtils #​36224
  • SqlBinaryValue and SqlCharacterValue should support InputStream content with undetermined length #​36220
  • DataBufferUtils.write() with NettyDataBuffer on JDK 25 hangs indefinitely #​36189
  • WebClient (Reactor) attributes on Netty channel do not clear after connection release #​36163
  • Reintroduce WebLogicJtaTransactionManager in Spring Framework 6.2.x #​36152
  • DisconnectedClientHelper should detect presence of RestClientException and WebClientException separately #​36150
  • Add DataAccessException and MessagingException to the excluded outermost exceptions in DisconnectedClientHelper #​36135
  • Improve user check in TransportHandlingSockJsService #​36129

🐞 Bug Fixes

  • Avoid lock congestion in ConcurrentReferenceHashMap #​36308
  • Resolved HttpEntity Controller argument does not reflect mutated HTTP headers #​36301
  • AbstractMessageConverter does not support wildcards in supported MIME types #​36286
  • Make LocalEntityManagerFactoryBean#setDataSource work on Hibernate as well as EclipseLink #​36272
  • Deadlock might occur when calling System.exit on startup (against multiple shutdown hooks) #​36268
  • Netty4HeadersAdapter.remove returns empty list instead of null for non-existing key #​36227
  • EclipseLinkConnectionHandle can fail against transaction isolation race condition #​36166
  • WiretapConnector leaks data buffers when response body not consumed #​36051
  • UriComponentsBuilder loses the fragment when it consists of only a single character #​36035
  • SimpleBeanInfoFactory fails to reliably resolve read/write methods in type hierarchies with unresolved generics #​36026

📔 Documentation

  • Fix links to JUnit User Guide #​36218
  • Fix LocalContainerEntityManagerFactoryBean#setPersistenceUnitName javadoc #​36206
  • Update documentation on trailing slash handling where type-level @GetMapping("/base") is combined with method level @GetMapping("/") #​36200
  • Update documentation on the MediaType used for ProblemDetail #​36193
  • Replace getErrors() with getBindingResult() in examples #​36172
  • Upgrade Antora dependencies #​36106
  • Fix typos and grammar #​36023

🔨 Dependency Upgrades

  • Bump fast-xml-parser from 4.5.2 to 5.3.4 in /framework-docs #​36239
  • Upgrade to ASM 9.9.1 and Objenesis 3.5 #​36244
  • Upgrade to JUnit 5.14.2 #​36148
  • Upgrade to Micrometer 1.15.9 #​36290
  • Upgrade to Reactor 2024.0.15 #​36289

v6.2.15

⭐ New Features

  • Avoid package cycle caused by use of UriComponentsBuilder in ServletServerHttpRequest #​35954
  • DefaultHandshakeHandler should not log client faults on error level #​35948
  • Use concurrent set behind reactive TransactionSynchronizationManager#registerSynchronization #​35922
  • Expose Collection on FragmentsRendering to facilitate Unit Tests #​35912
  • Different ReactorNettyWebSocketSession call getId() may return the same value #​35911
  • Enhance handleTypeMismatch error message in ResponseEntityExceptionHandler #​35878

🐞 Bug Fixes

  • NullPointerException thrown from JdkClientHttpRequestFactory for null request header value #​35998
  • State inconsistency in LazyConnectionDataSourceProxy when connection settings fail #​35981
  • SubscriberInputStream#resume misuses parked thread reference #​35979
  • PathMatchingResourcePatternResolver fails with URI in JAR manifest Class-Path entries #​35967
  • Strong locking in ConcurrentReferenceHashMap#computeIfAbsent may cause context initialisation deadlock #​35945
  • BridgeMethodResolver change in 6.2.13 breaks Spring Data entity introspection #​35941
  • DefaultMessageListenerContainer does not clear Session and MessageConsumer for paused invokers #​35935
  • Tighten cacheable decision behind @Lazy injection point #​35918
  • Use provided ReactiveAdapterRegistry in BindingContext constructor #​35914
  • Accidental fallback match for Collection-type beans due to @Bean-level qualifier annotation #​35909
  • SortedResourcesFactoryBean does not accept non-existent resources anymore #​35896

📔 Documentation

  • Document that annotations are ignored if attributes reference types not present in the classpath #​35973
  • Fix broken Javadoc links to methods #​35904
  • Refer to "Spring Tools" instead of "Spring Tools for Eclipse" in reference manual #​35902
  • Clarify JMS sessionTransacted flag for local versus global transaction #​35898
  • Reference docs should not use obsolete "junit5" links #​35893
  • Testing chapter references nonexistent Dependency Management documentation #​35891

🔨 Dependency Upgrades

v6.2.14

⭐ New Features

  • Add resetCaches() method to Caffeine/ConcurrentMapCacheManager #​35841
  • Fix single-check idiom in UnmodifiableMultiValueMap #​35831
  • Fix Spliterator characteristics in ConcurrentReferenceHashMap #​35828

🐞 Bug Fixes

  • MissingPathVariableException produces wrong status code in ProblemDetail #​35856
  • Fix getCacheNames() concurrent access in NoOpCacheManager #​35844
  • Annotation discovery regression for interfaces extending BeanNameAware and co. #​35838
  • Fix HtmlUtils unescape for supplementary chars #​35832

📔 Documentation

  • Fix cross-reference links in HtmlUnit sections #​35857
  • Remove @see Javadoc references to deprecated PropertiesBeanDefinitionReader #​35854

v6.2.13

⭐ New Features

  • Support response encoding in select and options JSP form tags #​35783
  • Preserve Connection readOnly state for DataSource with defaultReadOnly configuration #​35743
  • Optimize resource URL resolution in SortedResourcesFactoryBean #​35687
  • Relax multiple segment matching constraints in PathPattern #​35686
  • Support wildcard path elements at the start of path patterns #​35679
  • Validating byte[]s may produce OutOfMemoryError #​35675
  • Update in FragmentsRendering to names of static methods #​33974

🐞 Bug Fixes

  • ConcurrentReferenceHashMap misses dedicated computeIfAbsent, computeIfPresent, compute, merge implementations #​35794
  • Avoid unnecessary bridge method resolution around getMostSpecificMethod #​35780
  • Fix multi-release JAR issue with VirtualThreadDelegate #​35773
  • ContentNegotiationManager not finding media type when request includes quality parameter #​35754
  • Race condition in BufferingClientHttpResponseWrapper.getBody() #​35745
  • Deprecate setConnectTimeout on HttpComponentsClientHttpRequestFactory #​35748
  • Fix PathMatchingResourcePatternResolver to handle absolute paths in JAR manifests #​35732
  • BeanDefinitionBuilder.addAutowiredProperty causes error during AOT processing #​35731
  • Improve HttpServiceMethod support for Kotlin suspending functions returning Flow #​35718
  • Exception translation does not expose original BatchUpdateException anymore #​35717
  • Add hints for entities package-private methods #​35711
  • Fix concurrency permit leak causing deadlock in SimpleAsyncTaskExecutor #​35708
  • Remove jibx-marshaller element from spring-oxm.xsd #​35699
  • NullPointerException When Handling 407 with JdkClientHttpConnector in WebClient #​35692
  • Method-based Map injection fails against target Map with incomplete generics despite bean name or qualifier match #​35690
  • JUnit Jupiter TEST_METHOD ExtensionContextScope is not fully supported #​35680
  • Introduce isAutowirableConstructor(Executable, PropertyProvider) in TestConstructorUtils and deprecate existing variants #​35676
  • Reflection on java.sql.Types without runtime hints #​35674
  • getPubliclyAccessibleMethodIfPossible() returns hidden static method #​35667
  • RestClient hangs during upload with ReactorClientHttpRequestFactory #​34707

📔 Documentation

  • Correct formatting for Mono type #​35786
  • Improve Java Bean Validation documentation for controller methods #​35759
  • Fix typo in @NumberFormat Javadoc #​35742
  • Javadoc of AsyncConfigurer does not match runtime behavior #​35736
  • Document PathPattern behavior difference between */{name} and **/{*path} #​35727
  • Fix minor typo in RestClient documentation #​35723
  • Document test-method scoped TestContext semantics #​35716
  • Improve docs on AbstractStreamingClientHttpRequest for streaming vs buffering mode #​35700
  • Fix minor typo in JDBC Core Classes documentation #​35684
  • Fix typos #​35656
  • Improve spring-web filter documentation #​30454

🔨 Dependency Upgrades

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​Anxton, @​Artur-, @​HJC96, @​MoadElfatihi, @​NYgomets, @​cbsingh1, @​dmitrysulman, @​ekcom, and @​scordio

v6.2.12

⭐ New Features

  • Add "forEachByte" variant to DataBuffer for efficient traversing #​35623
  • Nested transaction support via savepoints is broken in HSQLDB database [followup] #​35618
  • Improve exception handling in ConfigurationClassBeanDefinitionReader #​35631
  • Add MySQL/MariaDB to TableMetaDataProviderFactory for correct generated-keys support #​35593
  • Optimize state management in StompSubProtocolHandler #​35591
  • ServletServerHttpRequest.getRemoteAddress() may perform DNS lookup #​35589
  • Emit log message when multiple primary beans are detected #​35550
  • Duplicate key error is mapped to TransientDataAccessException by SQLStateSQLExceptionTranslator for BatchUpdateException #​35547
  • Remove redundant object allocation in cglib proxy method calls #​35543
  • Remove deprecation on CandidateComponentsIndex and CandidateComponentsIndexLoader #​35472
  • Processing response with no Content-Length header and no body raises EOFException #​35361

🐞 Bug Fixes

Configuration

📅 Schedule: Branch creation - "" in timezone Asia/Shanghai, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

@alaudabot

alaudabot commented Jan 19, 2026

Copy link
Copy Markdown

🚨 Stale Pull Request Warning

This pull request has been inactive for 58 days.

Automated Actions Schedule:

  • ⚠️ Warning: After 30 days (now)
  • 🔒 Auto-close: After 60 days
  • 🗑️ Branch deletion: After 90 days (if not protected)

To keep this PR active:

  • Add new commits
  • Reply to this comment
  • Request reviews

Protected branches (won't be deleted): main,release-*,alauda-*

This is an automated message. Reply to this comment to reset the inactivity timer.

@alaudabot

alaudabot commented Feb 23, 2026

Copy link
Copy Markdown

🚨 Stale Pull Request Warning

This pull request has been inactive for 35 days.

Automated Actions Schedule:

  • ⚠️ Warning: After 30 days (now)
  • 🔒 Auto-close: After 60 days
  • 🗑️ Branch deletion: After 90 days (if not protected)

To keep this PR active:

  • Add new commits
  • Reply to this comment
  • Request reviews

Protected branches (won't be deleted): main,release-*,alauda-*

This is an automated message. Reply to this comment to reset the inactivity timer.

1 similar comment
@alaudabot

alaudabot commented Mar 30, 2026

Copy link
Copy Markdown

🚨 Stale Pull Request Warning

This pull request has been inactive for 35 days.

Automated Actions Schedule:

  • ⚠️ Warning: After 30 days (now)
  • 🔒 Auto-close: After 60 days
  • 🗑️ Branch deletion: After 90 days (if not protected)

To keep this PR active:

  • Add new commits
  • Reply to this comment
  • Request reviews

Protected branches (won't be deleted): main,release-*,alauda-*

This is an automated message. Reply to this comment to reset the inactivity timer.

@alaudaa-renovate
alaudaa-renovate Bot force-pushed the renovate/patch-springversion branch from 10cd2bf to e604867 Compare April 9, 2026 18:36
@alaudaa-renovate alaudaa-renovate Bot changed the title fix(deps): update dependency org.springframework:spring-webmvc to v6.2.10 [security] fix(deps): update dependency org.springframework:spring-webmvc to v6.2.17 [security] Apr 9, 2026
@alaudabot

alaudabot commented Apr 9, 2026 •
edited
Loading

Copy link
Copy Markdown

🤖 AI Code Review

Property Value
Model opencode/minimax-m2.5-free
Style strict
Issues Found 1
Config Source centralized
Profile ❌ Not Found
Personalized Prompt ❌ No
Prompt Path .github/review/profiles/alaudadevops/docker-sonarqube/pr-review.md
Alauda Skills ✅ base-acp-operator-list, base-acp-operator-release, base-authoring, base-m365, base-ocp-operator-list, base-skill-setup, builders-alauda-component-e2e-release, builders-alauda-component-upgrade, builders-alauda-pipeline, builders-claudetask-submit, builders-component-knowledge, builders-confluence, builders-dev-mesh-qa, builders-edge-ci-trace, builders-gitlab-ops, builders-helm-operator-generator, builders-install-cluster-plugin, builders-jira, builders-notify-wecom, builders-olm-operator-lifecycle, builders-prd-to-testcase, builders-publish-errata, builders-roadmap-studio, builders-story-split, builders-violet, builders-webapp-testing, cross-repo-add-mirror, cross-repo-publish, devops-add-bug-release-notes, devops-autodns, devops-bundle-csv-baseline-diff, devops-candidate-version-supervisor, devops-connectors-acceptance-test, devops-connectors-explore, devops-connectors-poc-case, devops-connectors-review, devops-connectors-unit-test, devops-connectors-upgrade-test, devops-connectors-write-user-docs, devops-creating-tekton-pipelines, devops-fix-go-vulns, devops-fork-alauda-binary-release, devops-gen-advanced-form-descriptors, devops-jira-rfd-acceptance, devops-knowledge-adoption, devops-pr-review, devops-refresh-containerfile-digests, devops-refresh-containerfile-tags, devops-replace-strings, devops-scan-docker-keywords, devops-sync-alauda-github-releases, devops-tekton-dynamic-form-optimizer, devops-tekton-operator-task-e2e, devops-tekton-pipeline-delivery, devops-tekton-refresh-results-tag, devops-tekton-task-delivery, devops-tekton-task-overview-template, devops-tekton-task-version-upgrade, devops-tekton-upgrade-notes, devops-tool-report-troubleshoot, devops-ui-e2e-code-audit, devops-ui-e2e-fix-base-on-report, devops-ui-e2e-regression-and-fix, devops-ui-generate-e2e-from-feature, devops-ui-pre-setup, devops-upgrade-go, devops-upstream-backport-cve, devops-upstream-upgrade
Reviewed at 2026-05-20 00:37:45 UTC

Summary

This PR updates the Spring Framework version from 6.2.7 to 6.2.18 to address a Path Traversal Vulnerability (CVE-2025-41242). The change is a straightforward version bump that affects spring-webmvc, spring-context, and spring-test dependencies. However, the sonarqube-build pipeline has failed and requires investigation before merging.

Review Statistics

Category Count
Critical Issues 1
Warnings 0
Suggestions 1
Files Reviewed 1

Critical Issues

  • [source/build.gradle:233] (test/build-failure): The sonarqube-build pipeline has failed (41m15s duration). This must be investigated to determine if it's related to the Spring version upgrade or a pre-existing issue. The PR cannot be merged until the build passes.

Warnings

No warnings identified.

Suggestions

  • [source/build.gradle:233] (docs/release-notes): Consider documenting this security update in release notes, especially since it addresses CVE-2025-41242 (CVSS 5.9/10 Medium severity path traversal vulnerability).

Positive Feedback

  • The dependency update is correctly structured using a centralized springVersion variable, ensuring all Spring dependencies (spring-webmvc, spring-context, spring-test) are updated consistently.
  • The PR correctly targets the security vulnerability (CVE-2025-41242) in Spring Framework MVC applications.
  • The change follows the project's established pattern for dependency management.
  • The renovate bot provided detailed CVE information in the PR description, which is helpful for reviewers.

Note: The failing sonarqube-build pipeline needs to be investigated. If the failure is unrelated to this dependency update (e.g., a pre-existing flaky test or infrastructure issue), this PR can proceed after confirming the root cause.

ℹ️ About this review

This review was automatically generated using the run-actions workflow.

  • Shared prompt: .github/prompts/code-review.md
  • Config source: centralized
  • Profile path: Not Found
  • Profile ref: e75e733e9aa1b417a8b3c6441e53495dbcb418ad
  • No repository-specific prompt configured
  • Alauda skills: base-acp-operator-list, base-acp-operator-release, base-authoring, base-m365, base-ocp-operator-list, base-skill-setup, builders-alauda-component-e2e-release, builders-alauda-component-upgrade, builders-alauda-pipeline, builders-claudetask-submit, builders-component-knowledge, builders-confluence, builders-dev-mesh-qa, builders-edge-ci-trace, builders-gitlab-ops, builders-helm-operator-generator, builders-install-cluster-plugin, builders-jira, builders-notify-wecom, builders-olm-operator-lifecycle, builders-prd-to-testcase, builders-publish-errata, builders-roadmap-studio, builders-story-split, builders-violet, builders-webapp-testing, cross-repo-add-mirror, cross-repo-publish, devops-add-bug-release-notes, devops-autodns, devops-bundle-csv-baseline-diff, devops-candidate-version-supervisor, devops-connectors-acceptance-test, devops-connectors-explore, devops-connectors-poc-case, devops-connectors-review, devops-connectors-unit-test, devops-connectors-upgrade-test, devops-connectors-write-user-docs, devops-creating-tekton-pipelines, devops-fix-go-vulns, devops-fork-alauda-binary-release, devops-gen-advanced-form-descriptors, devops-jira-rfd-acceptance, devops-knowledge-adoption, devops-pr-review, devops-refresh-containerfile-digests, devops-refresh-containerfile-tags, devops-replace-strings, devops-scan-docker-keywords, devops-sync-alauda-github-releases, devops-tekton-dynamic-form-optimizer, devops-tekton-operator-task-e2e, devops-tekton-pipeline-delivery, devops-tekton-refresh-results-tag, devops-tekton-task-delivery, devops-tekton-task-overview-template, devops-tekton-task-version-upgrade, devops-tekton-upgrade-notes, devops-tool-report-troubleshoot, devops-ui-e2e-code-audit, devops-ui-e2e-fix-base-on-report, devops-ui-e2e-regression-and-fix, devops-ui-generate-e2e-from-feature, devops-ui-pre-setup, devops-upgrade-go, devops-upstream-backport-cve, devops-upstream-upgrade

@danielfbm

danielfbm commented Apr 16, 2026

Copy link
Copy Markdown

PR Assist Bot — Owner Approval Needed

This PR targets release branch alauda-2025.1.0. Per policy, release-branch merges require explicit owner approval before the bot proceeds.

PR: AlaudaDevops/docker-sonarqube#32
Branch: alauda-2025.1.0
Type: Security / Dependency update (Renovate)

Please reply with /approve-merge or provide explicit approval for the bot to merge this PR on the next sweep.

@alaudabot

alaudabot commented Apr 20, 2026

Copy link
Copy Markdown

[pr-assist-bot] Release Branch Security PR — Owner Approval Needed

This PR targets release branch alauda-2025.1.0. Per policy, release-branch dependency merges require explicit owner approval before the bot proceeds.

PR: #32 — fix(deps): update dependency org.springframework:spring-webmvc to v6.2.17 [security]
Branch: alauda-2025.1.0
Type: Security / Dependency update (Renovate)

Please reply with /approve-merge or provide explicit approval for the bot to merge this PR on the next sweep.

@alaudabot

alaudabot commented Apr 21, 2026

Copy link
Copy Markdown

PR Assist Bot Analysis

Status: All CI checks passing, owner approval received (/approve-merge).
Blocked by: Branch protection policy requires a GitHub approving review (not just a PR comment).
Action needed: A maintainer with write access must submit an approving review via GitHub's review UI for auto-merge to proceed.

@danielfbm danielfbm mentioned this pull request Apr 22, 2026
Open
1 task
alaudabot
alaudabot approved these changes Apr 29, 2026
View reviewed changes

@alaudabot alaudabot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Review Summary

This PR updates the Spring Framework dependency from version 6.2.7 to 6.2.17 to address security vulnerabilities (CVE-2026-22735 and CVE-2026-22737). The change is minimal and follows the existing dependency management pattern.

Review Statistics:

  • Critical Issues: 0
  • Warnings: 0
  • Suggestions: 1

Suggestion: Consider verifying the build succeeds after the version upgrade.

Positive Feedback:

  • Correctly marks as security update
  • Minimal, focused change (+1/-1)
  • Follows existing dependency pattern

Status: Approved - This PR is good to merge.

@alaudaa-renovate
alaudaa-renovate Bot force-pushed the renovate/patch-springversion branch from e604867 to ad4908a Compare May 10, 2026 10:18
@alaudaa-renovate alaudaa-renovate Bot changed the title fix(deps): update dependency org.springframework:spring-webmvc to v6.2.17 [security] fix(deps): update dependency org.springframework:spring-webmvc to v6.2.18 [security] May 10, 2026
alaudabot
alaudabot reviewed May 20, 2026
View reviewed changes
Comment thread source/build.gradle Outdated
ext {
protobufVersion = '4.29.0'
springVersion = '6.2.7'
springVersion = '6.2.18'

@alaudabot alaudabot May 20, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Critical (test/build-failure): The sonarqube-build pipeline has failed. Please investigate whether this is related to the Spring version upgrade before merging.

@alaudaa-renovate
alaudaa-renovate Bot force-pushed the renovate/patch-springversion branch from ad4908a to d83c60f Compare August 1, 2026 11:04
@alaudaa-renovate alaudaa-renovate Bot changed the title fix(deps): update dependency org.springframework:spring-webmvc to v6.2.18 [security] fix(deps): update dependency org.springframework:spring-webmvc to v6.2.19 [security] Aug 1, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@alaudabot alaudabot alaudabot approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@alaudabot @danielfbm