org.springframework.cloud:spring-cloud-starter-config

Security

• CVE-2026-47836 — Spring Cloud Config Server Susceptible To TOCTOU Attack When Using SVN
• CVE-2026-47837 — Spring Cloud Config Server Monitor Endpoint Does Not Validate Webhook Requests
• CVE-2026-47894 — Spring Cloud Config Server Native Environment Repository Exposure
• CVE-2026-59315 — Spring Cloud Config Monitor Denial of Service

What's Changed

• docs: document .json alternative format endpoint and add URL pattern table by @won-seoop in #3245
• GH-572: Document Config Server behavior when Git backend is unavailable by @won-seoop in #3251
• docs: expand Config Server security guide by @won-seoop in #3247
• Expand embedded server docs with standalone vs embedded trade-offs (GH-1203) by @won-seoop in #3249
• Document sharing configuration across a subset of applications (GH-618) by @won-seoop in #3250
• Support Git-style searchPaths with wildcards in AWS S3 buckets (#2812) by @tomy8964 in #2958
• Bump antora from 3.2.0-alpha.12 to 3.2.0-rc.2 in /docs by @dependabot[bot] in #3255
• Bump actions/checkout from 6 to 7 by @dependabot[bot] in #3253
• Fix native file monitor relative URI handling by @hutiefang76 in #3258
• Bump actions/setup-java from 5.4.0 to 5.5.0 by @dependabot[bot] in #3259
• Ignore release train workflow files in Dependabot by @ryanjbaxter in #3263
• Bump org.apache.maven.plugins:maven-jar-plugin from 3.5.0 to 3.5.1 by @dependabot[bot] in #3264
• Bump @springio/antora-extensions from 1.14.12 to 1.14.13 in /docs by @dependabot[bot] in #3268
• Use '=' instead in encryption-and-decryption.adoc and server.adoc by @ngocnhan-tran1996 in #3269

New Contributors

• @won-seoop made their first contribution in #3245
• @tomy8964 made their first contribution in #2958
• @hutiefang76 made their first contribution in #3258

Full Changelog: v5.0.4...v5.0.5

❤️ Contributors

Thank you to all the contributors who worked on this release:

@dependabot[bot]

What's Changed

• Bump antora from 3.2.0-alpha.11 to 3.2.0-alpha.12 in /docs by @dependabot[bot] in #3228
• Bump antora from 3.2.0-alpha.11 to 3.2.0-alpha.12 in /docs by @dependabot[bot] in #3230
• Add support for switching off profile validation by @dsyer in #3227
• Bump org.bouncycastle:bcpkix-jdk18on from 1.80 to 1.80.2 by @dependabot[bot] in #3231
• Remove the JCE warning since it is part of Java 17 by @jonatan-ivanov in #3236
• Resolve placeholders at map level before YAML/JSON serialization by @gabrielschulhof in #3235
• Handle negated profiles in S3 bucket multi-document YAML files by @ryanjbaxter in #3225
• Bump @springio/antora-extensions from 1.14.11 to 1.14.12 in /docs by @dependabot[bot] in #3240

New Contributors

• @dsyer made their first contribution in #3227
• @jonatan-ivanov made their first contribution in #3236
• @gabrielschulhof made their first contribution in #3235

Full Changelog: v5.0.3...v5.0.4

🔒 Security

Addresses the following CVEs:

• CVE-2026-40982
• CVE-2026-40981
• CVE-2026-41002
• CVE-2026-41004

📔 Documentation

• Fix 'occured' -> 'occurred' typo in JGitEnvironmentRepository clone-error log #3217

❤️ Contributors

Thank you to all the contributors who worked on this release:

@SAY-5 and @dependabot[bot]

🔒 Security

Addresses CVE-2026-22739

❤️ Contributors

Thank you to all the contributors who worked on this release:

@dependabot[bot]

⭐ New Features

• Add the full vault path to the PropertySource. #3180

❤️ Contributors

Thank you to all the contributors who worked on this release:

@dependabot[bot] and @tstenner

⭐ New Features

• Check For SPRING_PROFILES_VALIDATE Property In PathUtils.isInvalidProfiles #3226

🐞 Bug Fixes

• Reference to multiline string rendered incorrectly in output #3234

📔 Documentation

• Remove the JCE warning since it is part of Java 17 #3236

❤️ Contributors

Thank you to all the contributors who worked on this release:

@dependabot[bot] and @jonatan-ivanov

🔒 Security

Addresses the following CVEs:

• CVE-2026-40982
• CVE-2026-40981
• CVE-2026-41002
• CVE-2026-41004

📔 Documentation

• Add documentation for Google Secrets Manager backend #3218

❤️ Contributors

Thank you to all the contributors who worked on this release:

@dependabot[bot] and @ryanjbaxter

🔒 Security

Addresses CVE-2026-22739

⭐ New Features

• JDBC Config Server is unhealthy if accept-empty: false #3190

🐞 Bug Fixes

• Vault authentication uses non-existing token instead of spring.cloud.config.server.vault.authentication #3172

❤️ Contributors

Thank you to all the contributors who worked on this release:

@dependabot[bot]

What's Changed

• Bump jgit.version from 6.10.0.202406032230-r to 6.10.1.202505221210-r by @dependabot[bot] in #2869
• Bump software.amazon.awssdk:bom from 2.31.51 to 2.31.53 by @dependabot[bot] in #2877
• Bump software.amazon.awssdk:bom from 2.31.53 to 2.31.54 by @dependabot[bot] in #2878
• Bump software.amazon.awssdk:bom from 2.31.54 to 2.31.55 by @dependabot[bot] in #2879
• Bump software.amazon.awssdk:bom from 2.31.55 to 2.31.56 by @dependabot[bot] in #2880
• Bump software.amazon.awssdk:bom from 2.31.56 to 2.31.57 by @dependabot[bot] in #2882
• Bump software.amazon.awssdk:bom from 2.31.57 to 2.31.58 by @dependabot[bot] in #2885
• Bump software.amazon.awssdk:bom from 2.31.58 to 2.31.59 by @dependabot[bot] in #2893
• Bump software.amazon.awssdk:bom from 2.31.59 to 2.31.60 by @dependabot[bot] in #2895
• Bump software.amazon.awssdk:bom from 2.31.60 to 2.31.61 by @dependabot[bot] in #2899
• Bump software.amazon.awssdk:bom from 2.31.61 to 2.31.62 by @dependabot[bot] in #2905
• Bump software.amazon.awssdk:bom from 2.31.62 to 2.31.63 by @dependabot[bot] in #2909
• Correct antora attribute by @ngocnhan-tran1996 in #2907
• Bump software.amazon.awssdk:bom from 2.31.63 to 2.31.64 by @dependabot[bot] in #2913
• Fix health indicator property names in docs by @cselagea in #2915
• Bump software.amazon.awssdk:bom from 2.31.64 to 2.31.65 by @dependabot[bot] in #2917
• Bump software.amazon.awssdk:bom from 2.31.65 to 2.31.66 by @dependabot[bot] in #2920
• Bump software.amazon.awssdk:bom from 2.31.66 to 2.31.67 by @dependabot[bot] in #2922
• Bump software.amazon.awssdk:bom from 2.31.67 to 2.31.68 by @dependabot[bot] in #2924
• Bump software.amazon.awssdk:bom from 2.31.68 to 2.31.69 by @dependabot[bot] in #2929
• Bump software.amazon.awssdk:bom from 2.31.69 to 2.31.70 by @dependabot[bot] in #2931
• Bump software.amazon.awssdk:bom from 2.31.70 to 2.31.71 by @dependabot[bot] in #2935
• Bump software.amazon.awssdk:bom from 2.31.71 to 2.31.72 by @dependabot[bot] in #2940
• Bump @springio/antora-extensions from 1.14.4 to 1.14.6 in /docs by @dependabot[bot] in #2966
• Bump @springio/antora-extensions from 1.14.4 to 1.14.6 in /docs by @dependabot[bot] in #2964
• Bump software.amazon.awssdk:bom from 2.31.72 to 2.31.78 by @dependabot[bot] in #2960
• Bump @springio/antora-extensions from 1.14.6 to 1.14.7 in /docs by @dependabot[bot] in #2983
• Bump @springio/antora-extensions from 1.14.6 to 1.14.7 in /docs by @dependabot[bot] in #2982
• Bump actions/checkout from 4 to 5 by @dependabot[bot] in #3007
• Bump @antora/collector-extension from 1.0.1 to 1.0.2 in /docs by @dependabot[bot] in #3014
• Bump actions/checkout from 4 to 5 by @dependabot[bot] in #3013
• Bump antora from 3.2.0-alpha.8 to 3.2.0-alpha.9 in /docs by @dependabot[bot] in #3017
• Bump antora from 3.2.0-alpha.8 to 3.2.0-alpha.9 in /docs by @dependabot[bot] in #3015
• Do not return profile-specific property sources by @ryanjbaxter in #3023
• Bump actions/setup-java from 4 to 5 by @dependabot[bot] in #3030
• Bump actions/setup-java from 4 to 5 by @dependabot[bot] in #3029
• Bump @antora/atlas-extension from 1.0.0-alpha.2 to 1.0.0-alpha.5 in /docs by @dependabot[bot] in #3054
• Bump @antora/atlas-extension from 1.0.0-alpha.2 to 1.0.0-alpha.5 in /docs by @dependabot[bot] in #3049
• Bump antora from 3.2.0-alpha.9 to 3.2.0-alpha.10 in /docs by @dependabot[bot] in #3079
• Bump antora from 3.2.0-alpha.9 to 3.2.0-alpha.10 in /docs by @dependabot[bot] in #3078
• Bump actions/upload-artifact from 4 to 5 by @dependabot[bot] in #3109
• Bump actions/upload-artifact from 4 to 5 by @dependabot[bot] in #3108
• File monitor should skip repository uris with placeholders by @ryanjbaxter in #3112
• Bump mikepenz/action-junit-report from 5 to 6 by @dependabot[bot] in #3118
• Bump mikepenz/action-junit-report from 5 to 6 by @dependabot[bot] in #3117
• Allow file based repos to continue on error when fetching multiple labels by @ryanjbaxter in #3130
• Bump com.google.apis:google-api-services-cloudresourcemanager from v1-rev20200210-1.30.9 to v1-rev20251103-2.0.0 by @dependabot[bot] in #3137
• Bump actions/checkout from 5 to 6 by @dependabot[bot] in #3150
• Bump actions/checkout from 5 to 6 by @dependabot[bot] in #3149
• Bump antora from 3.2.0-alpha.10 to 3.2.0-alpha.11 in /docs by @dependabot[bot] in #3160
• Bump antora from 3.2.0-alpha.10 to 3.2.0-alpha.11 in /docs by @dependabot[bot] in #3157
• Bump actions/cache from 4 to 5 by @dependabot[bot] in #3169
• Bump actions/upload-artifact from 5 to 6 by @dependabot[bot] in #3168
• Bump actions/cache from 4 to 5 by @dependabot[bot] in #3166
• Bump actions/upload-artifact from 5 to 6 by @dependabot[bot] in #3165

Full Changelog: v4.3.0...v4.3.1

⭐ New Features

• RefNotFoundException thrown when using spring.cloud.config.send-all-labels=true with invalid commit ID #3126

🐞 Bug Fixes

• Placeholder in Git URI doesn't work when used with local filesystem #3095

❤️ Contributors

Thank you to all the contributors who worked on this release:

@dependabot[bot]