org.springframework.cloud:spring-cloud-config-server
What this package is like to depend on
Last release 4 days ago
20 Aug 2026
Ships fairly regularly
a new release about every 5 weeks
Rarely documented
notes for 10 of 100 stable releases
Nothing withdrawn
no release was ever pulled
11 years old
106 releases · first in 2015
15 releases in the last 12 months
see the full history below
Release timeline
106 releases · Mar 2015 to Aug 2026Releases
latest 60 of 106-
5.0.520 Aug 2026Release notes
Open source →Security
- CVE-2026-47836 — Spring Cloud Config Server Susceptible To TOCTOU Attack When Using SVN
- CVE-2026-47837 — Spring Cloud Config Server Monitor Endpoint Does Not Validate Webhook Requests
- CVE-2026-47894 — Spring Cloud Config Server Native Environment Repository Exposure
- CVE-2026-59315 — Spring Cloud Config Monitor Denial of Service
What's Changed
- docs: document .json alternative format endpoint and add URL pattern table by @won-seoop in #3245
- GH-572: Document Config Server behavior when Git backend is unavailable by @won-seoop in #3251
- docs: expand Config Server security guide by @won-seoop in #3247
- Expand embedded server docs with standalone vs embedded trade-offs (GH-1203) by @won-seoop in #3249
- Document sharing configuration across a subset of applications (GH-618) by @won-seoop in #3250
- Support Git-style searchPaths with wildcards in AWS S3 buckets (#2812) by @tomy8964 in #2958
- Bump antora from 3.2.0-alpha.12 to 3.2.0-rc.2 in /docs by @dependabot[bot] in #3255
- Bump actions/checkout from 6 to 7 by @dependabot[bot] in #3253
- Fix native file monitor relative URI handling by @hutiefang76 in #3258
- Bump actions/setup-java from 5.4.0 to 5.5.0 by @dependabot[bot] in #3259
- Ignore release train workflow files in Dependabot by @ryanjbaxter in #3263
- Bump org.apache.maven.plugins:maven-jar-plugin from 3.5.0 to 3.5.1 by @dependabot[bot] in #3264
- Bump @springio/antora-extensions from 1.14.12 to 1.14.13 in /docs by @dependabot[bot] in #3268
- Use '=' instead in encryption-and-decryption.adoc and server.adoc by @ngocnhan-tran1996 in #3269
New Contributors
- @won-seoop made their first contribution in #3245
- @tomy8964 made their first contribution in #2958
- @hutiefang76 made their first contribution in #3258
Full Changelog: v5.0.4...v5.0.5
-
5.0.411 Jun 2026Release notes
Open source →❤️ Contributors
Thank you to all the contributors who worked on this release:
@dependabot[bot]
What's Changed
- Bump antora from 3.2.0-alpha.11 to 3.2.0-alpha.12 in /docs by @dependabot[bot] in #3228
- Bump antora from 3.2.0-alpha.11 to 3.2.0-alpha.12 in /docs by @dependabot[bot] in #3230
- Add support for switching off profile validation by @dsyer in #3227
- Bump org.bouncycastle:bcpkix-jdk18on from 1.80 to 1.80.2 by @dependabot[bot] in #3231
- Remove the JCE warning since it is part of Java 17 by @jonatan-ivanov in #3236
- Resolve placeholders at map level before YAML/JSON serialization by @gabrielschulhof in #3235
- Handle negated profiles in S3 bucket multi-document YAML files by @ryanjbaxter in #3225
- Bump @springio/antora-extensions from 1.14.11 to 1.14.12 in /docs by @dependabot[bot] in #3240
New Contributors
- @dsyer made their first contribution in #3227
- @jonatan-ivanov made their first contribution in #3236
- @gabrielschulhof made their first contribution in #3235
Full Changelog: v5.0.3...v5.0.4
-
5.0.306 May 2026Release notes
Open source →🔒 Security
Addresses the following CVEs:
📔 Documentation
- Fix 'occured' -> 'occurred' typo in JGitEnvironmentRepository clone-error log #3217
❤️ Contributors
Thank you to all the contributors who worked on this release:
@SAY-5 and @dependabot[bot]
-
5.0.223 Mar 2026Release notes
Open source →🔒 Security
Addresses CVE-2026-22739
❤️ Contributors
Thank you to all the contributors who worked on this release:
@dependabot[bot]
-
5.0.128 Jan 2026Release notes
Open source →⭐ New Features
- Add the full vault path to the PropertySource. #3180
❤️ Contributors
Thank you to all the contributors who worked on this release:
@dependabot[bot] and @tstenner
-
5.0.024 Nov 2025Nothing published for this version
-
5.0.0-RC112 Nov 2025 pre-releaseNothing published for this version
-
5.0.0-M417 Oct 2025 pre-releaseNothing published for this version
-
5.0.0-M301 Oct 2025 pre-releaseNothing published for this version
-
5.0.0-M210 Sep 2025 pre-releaseNothing published for this version
-
5.0.0-M129 Jul 2025 pre-releaseNothing published for this version
-
4.3.411 Jun 2026Release notes
Open source →⭐ New Features
- Check For SPRING_PROFILES_VALIDATE Property In PathUtils.isInvalidProfiles #3226
🐞 Bug Fixes
- Reference to multiline string rendered incorrectly in output #3234
📔 Documentation
- Remove the JCE warning since it is part of Java 17 #3236
❤️ Contributors
Thank you to all the contributors who worked on this release:
@dependabot[bot] and @jonatan-ivanov
-
4.3.306 May 2026Release notes
Open source →🔒 Security
Addresses the following CVEs:
📔 Documentation
- Add documentation for Google Secrets Manager backend #3218
❤️ Contributors
Thank you to all the contributors who worked on this release:
@dependabot[bot] and @ryanjbaxter
-
4.3.223 Mar 2026Release notes
Open source →🔒 Security
Addresses CVE-2026-22739
⭐ New Features
- JDBC Config Server is unhealthy if accept-empty: false #3190
🐞 Bug Fixes
- Vault authentication uses non-existing token instead of spring.cloud.config.server.vault.authentication #3172
❤️ Contributors
Thank you to all the contributors who worked on this release:
@dependabot[bot]
-
4.3.116 Dec 2025Release notes
Open source →What's Changed
- Bump jgit.version from 6.10.0.202406032230-r to 6.10.1.202505221210-r by @dependabot[bot] in #2869
- Bump software.amazon.awssdk:bom from 2.31.51 to 2.31.53 by @dependabot[bot] in #2877
- Bump software.amazon.awssdk:bom from 2.31.53 to 2.31.54 by @dependabot[bot] in #2878
- Bump software.amazon.awssdk:bom from 2.31.54 to 2.31.55 by @dependabot[bot] in #2879
- Bump software.amazon.awssdk:bom from 2.31.55 to 2.31.56 by @dependabot[bot] in #2880
- Bump software.amazon.awssdk:bom from 2.31.56 to 2.31.57 by @dependabot[bot] in #2882
- Bump software.amazon.awssdk:bom from 2.31.57 to 2.31.58 by @dependabot[bot] in #2885
- Bump software.amazon.awssdk:bom from 2.31.58 to 2.31.59 by @dependabot[bot] in #2893
- Bump software.amazon.awssdk:bom from 2.31.59 to 2.31.60 by @dependabot[bot] in #2895
- Bump software.amazon.awssdk:bom from 2.31.60 to 2.31.61 by @dependabot[bot] in #2899
- Bump software.amazon.awssdk:bom from 2.31.61 to 2.31.62 by @dependabot[bot] in #2905
- Bump software.amazon.awssdk:bom from 2.31.62 to 2.31.63 by @dependabot[bot] in #2909
- Correct antora attribute by @ngocnhan-tran1996 in #2907
- Bump software.amazon.awssdk:bom from 2.31.63 to 2.31.64 by @dependabot[bot] in #2913
- Fix health indicator property names in docs by @cselagea in #2915
- Bump software.amazon.awssdk:bom from 2.31.64 to 2.31.65 by @dependabot[bot] in #2917
- Bump software.amazon.awssdk:bom from 2.31.65 to 2.31.66 by @dependabot[bot] in #2920
- Bump software.amazon.awssdk:bom from 2.31.66 to 2.31.67 by @dependabot[bot] in #2922
- Bump software.amazon.awssdk:bom from 2.31.67 to 2.31.68 by @dependabot[bot] in #2924
- Bump software.amazon.awssdk:bom from 2.31.68 to 2.31.69 by @dependabot[bot] in #2929
- Bump software.amazon.awssdk:bom from 2.31.69 to 2.31.70 by @dependabot[bot] in #2931
- Bump software.amazon.awssdk:bom from 2.31.70 to 2.31.71 by @dependabot[bot] in #2935
- Bump software.amazon.awssdk:bom from 2.31.71 to 2.31.72 by @dependabot[bot] in #2940
- Bump @springio/antora-extensions from 1.14.4 to 1.14.6 in /docs by @dependabot[bot] in #2966
- Bump @springio/antora-extensions from 1.14.4 to 1.14.6 in /docs by @dependabot[bot] in #2964
- Bump software.amazon.awssdk:bom from 2.31.72 to 2.31.78 by @dependabot[bot] in #2960
- Bump @springio/antora-extensions from 1.14.6 to 1.14.7 in /docs by @dependabot[bot] in #2983
- Bump @springio/antora-extensions from 1.14.6 to 1.14.7 in /docs by @dependabot[bot] in #2982
- Bump actions/checkout from 4 to 5 by @dependabot[bot] in #3007
- Bump @antora/collector-extension from 1.0.1 to 1.0.2 in /docs by @dependabot[bot] in #3014
- Bump actions/checkout from 4 to 5 by @dependabot[bot] in #3013
- Bump antora from 3.2.0-alpha.8 to 3.2.0-alpha.9 in /docs by @dependabot[bot] in #3017
- Bump antora from 3.2.0-alpha.8 to 3.2.0-alpha.9 in /docs by @dependabot[bot] in #3015
- Do not return profile-specific property sources by @ryanjbaxter in #3023
- Bump actions/setup-java from 4 to 5 by @dependabot[bot] in #3030
- Bump actions/setup-java from 4 to 5 by @dependabot[bot] in #3029
- Bump @antora/atlas-extension from 1.0.0-alpha.2 to 1.0.0-alpha.5 in /docs by @dependabot[bot] in #3054
- Bump @antora/atlas-extension from 1.0.0-alpha.2 to 1.0.0-alpha.5 in /docs by @dependabot[bot] in #3049
- Bump antora from 3.2.0-alpha.9 to 3.2.0-alpha.10 in /docs by @dependabot[bot] in #3079
- Bump antora from 3.2.0-alpha.9 to 3.2.0-alpha.10 in /docs by @dependabot[bot] in #3078
- Bump actions/upload-artifact from 4 to 5 by @dependabot[bot] in #3109
- Bump actions/upload-artifact from 4 to 5 by @dependabot[bot] in #3108
- File monitor should skip repository uris with placeholders by @ryanjbaxter in #3112
- Bump mikepenz/action-junit-report from 5 to 6 by @dependabot[bot] in #3118
- Bump mikepenz/action-junit-report from 5 to 6 by @dependabot[bot] in #3117
- Allow file based repos to continue on error when fetching multiple labels by @ryanjbaxter in #3130
- Bump com.google.apis:google-api-services-cloudresourcemanager from v1-rev20200210-1.30.9 to v1-rev20251103-2.0.0 by @dependabot[bot] in #3137
- Bump actions/checkout from 5 to 6 by @dependabot[bot] in #3150
- Bump actions/checkout from 5 to 6 by @dependabot[bot] in #3149
- Bump antora from 3.2.0-alpha.10 to 3.2.0-alpha.11 in /docs by @dependabot[bot] in #3160
- Bump antora from 3.2.0-alpha.10 to 3.2.0-alpha.11 in /docs by @dependabot[bot] in #3157
- Bump actions/cache from 4 to 5 by @dependabot[bot] in #3169
- Bump actions/upload-artifact from 5 to 6 by @dependabot[bot] in #3168
- Bump actions/cache from 4 to 5 by @dependabot[bot] in #3166
- Bump actions/upload-artifact from 5 to 6 by @dependabot[bot] in #3165
Full Changelog: v4.3.0...v4.3.1
-
4.3.029 May 2025Nothing published for this version
-
4.2.411 Dec 2025Release notes
Open source →⭐ New Features
- RefNotFoundException thrown when using spring.cloud.config.send-all-labels=true with invalid commit ID #3126
🐞 Bug Fixes
- Placeholder in Git URI doesn't work when used with local filesystem #3095
❤️ Contributors
Thank you to all the contributors who worked on this release:
@dependabot[bot]
-
4.2.309 Jul 2025Nothing published for this version
-
4.2.204 Apr 2025Nothing published for this version
-
4.2.118 Mar 2025Nothing published for this version
-
4.2.003 Dec 2024Nothing published for this version
-
4.1.724 Jun 2025Nothing published for this version
-
4.1.604 Apr 2025Nothing published for this version
-
4.1.510 Jan 2025Nothing published for this version
-
4.1.427 Nov 2024Nothing published for this version
-
4.1.310 Jul 2024Nothing published for this version
-
4.1.230 May 2024Nothing published for this version
-
4.1.127 Mar 2024Nothing published for this version
-
4.1.006 Dec 2023Nothing published for this version
-
4.0.526 Jan 2024Nothing published for this version
-
4.0.427 Jul 2023Nothing published for this version
-
4.0.324 May 2023Nothing published for this version
-
4.0.228 Mar 2023Nothing published for this version
-
4.0.125 Jan 2023Nothing published for this version
-
4.0.015 Dec 2022Nothing published for this version
-
3.1.1003 Apr 2025Nothing published for this version
-
3.1.918 Dec 2023Nothing published for this version
-
3.1.829 Jun 2023Nothing published for this version
-
3.1.727 Apr 2023Nothing published for this version
-
3.1.623 Feb 2023Nothing published for this version
-
3.1.503 Nov 2022Nothing published for this version
-
3.1.406 Sep 2022Nothing published for this version
-
3.1.326 May 2022Nothing published for this version
-
3.1.227 Apr 2022Nothing published for this version
-
3.1.117 Feb 2022Nothing published for this version
-
3.1.001 Dec 2021Nothing published for this version
-
3.0.729 Jun 2022Nothing published for this version
-
3.0.615 Dec 2021Nothing published for this version
-
3.0.521 Sep 2021Nothing published for this version
-
3.0.427 May 2021Nothing published for this version
-
3.0.317 Mar 2021Nothing published for this version
-
3.0.227 Jan 2021Nothing published for this version
-
3.0.108 Jan 2021Nothing published for this version
-
3.0.021 Dec 2020Nothing published for this version
-
2.2.8.RELEASE21 Apr 2021Nothing published for this version
-
2.2.7.RELEASE11 Feb 2021Nothing published for this version
-
2.2.6.RELEASE09 Nov 2020Nothing published for this version
-
2.2.5.RELEASE28 Aug 2020Nothing published for this version
-
2.2.4.RELEASE31 Jul 2020Nothing published for this version
-
2.2.3.RELEASE28 May 2020Nothing published for this version