org.springframework:spring-jcl

⚠️ Security Fixes

This maintenance release fixes a high number of CVEs. You can learn more about this in the "Spring and Security In The Times Of AI" blog post. Here is the full list of 16 CVEs:

• CVE-2026-41838 "Spring Framework Predictable Session ID in WebSocket Module"
• CVE-2026-41839 "Spring Framework Escalation via Session Fixation in WebFlux"
• CVE-2026-41840 "Spring Framework Denial of Service via Multipart Requests in WebFlux"
• CVE-2026-41841 "Spring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFlux"
• CVE-2026-41842 "Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux"
• CVE-2026-41843 "Spring Framework Path Traversal via Versioned Static Resources in Spring MVC and WebFlux"
• CVE-2026-41844 "Spring Framework Open Redirect in Spring MVC and WebFlux"
• CVE-2026-41845 "Spring Framework Cross-site Scripting via JavaScriptUtils"
• CVE-2026-41846 "Spring Framework Cross-site Scripting via JSP Form Tags"
• CVE-2026-41848 "Spring Framework Denial of Service via AntPathMatcher"
• CVE-2026-41850 "Spring Framework Algorithmic Denial of Service via SpEL Expressions"
• CVE-2026-41851 "Spring Framework Denial of Service via Unbounded Cache in SpEL"
• CVE-2026-41852 "Spring Framework Arbitrary Method Invocation in SpEL Expressions"
• CVE-2026-41853 "Spring Framework Multipart Request Smuggling in Spring MVC and WebFlux"
• CVE-2026-41854 "Spring Framework Server-Side Request Forgery via UriComponentsBuilder"
• CVE-2026-41855 "Spring Framework Unsafe Deserialization via Jackson JMS Converters"

⭐ New Features

• Avoid too many character access attempts in AntPathMatcher #36886
• Track operations during SpEL expression evaluation #36887
• Ensure getters have non-void return types in SpEL #36888
• Expose ClassLoader from DefaultDeserializer #36839
• Refine default view name resolution #36794
• Refine Jackson JMS converters #36792
• Improve ABNF rule checks in RfcUriParser #36788
• Detect custom deserialized NullValue instances in AbstractValueAdaptingCache #36728
• Warn against unsafe static resource locations in MVC and WebFlux #36693
• Consistent compatibility with Woodstox as an alternative to Xerces #36683

🐞 Bug Fixes

• Data is lost for joined DataBuffer in DataBufferUtils #36874
• CronExpression skips days on midnight DST gap #36873
• Concurrency issue against shared cookie field in CookieLocaleResolver#setLocaleContext #36870
• Server Sent Event does not support multi-line comments #36867
• Regression in 6.2.0+: ConfigurationClassParser incorrectly removes component-scanned bean when the same class is also registered under a different name via XML #36849
• Bean Background Bootstrap and Lazy Init #36847
• Fix JSP tag processing #36798
• Fix script processing capabilities #36796
• Parsing failure for MIME type with quoted parameter values #36734
• Circular dependency between supplier-created beans is silently ignored on startup #36732
• Non-deterministic "Body token not expected" in org.springframework.http.codec.multipart.PartGenerator #36722
• Regression on value class parameter handling #36720
• Cache collisions in CachingResourceResolver #36718
• Unexpected path element removal when resolving versioned resources #36699

📔 Documentation

• Fix broken links to Selenium documentation #36877
• Fix applicability note on setAutoGrowCollectionLimit #36864
• Javadoc of nestingLevel parameter in MethodParameter constructor is inconsistent with actual implementation #36848

🔨 Dependency Upgrades

• Upgrade to JUnit 5.14.4 #36707
• Upgrade to Micrometer 1.15.12 #36881
• Upgrade to Reactor 2024.0.18 #36882

⭐ New Features

• Improve SpringValidatorAdapter and MethodValidationAdapter performance #36624
• Add missing @Deprecated(forRemoval = true) for deleted in 7.0 #36591
• Deprecate methodIdentification() in CacheAspectSupport for removal #36576
• Improve error handling in multipart codecs #36564
• LazyConnectionDataSourceProxy does not work well with Hibernate's multi-tenancy by schema strategy #36529
• MySQL Error 149 (Galera/WSREP conflict) not translated to ConcurrencyFailureException in Spring JDBC/ORM #36510

🐞 Bug Fixes

• Handle Kotlin nullable value class param correctly in CoroutineUtils #36643
• NullPointerException in ServerSentEvent when trying to set id or event properties #36634
• @Sql fails if DataSource is wrapped in a TransactionAwareDataSourceProxy #36630
• WebDataBinder unnecessarily instantiates collections when using the "!" and "_" prefixes #36627
• Cache pollution from high-cardinality FieldError default messages in MessageSourceSupport #36623
• ContentCachingRequestWrapper does not allow unlimited content caching #36620
• MergedAnnotation does not use ClassLoader for method or field #36614
• AnnotationBeanNameGenerator fails when an annotation references a non-existent class #36588
• FileSystemResource does not strictly follow the Resource#isReadable() contract #36585
• Query not hidden in DefaultClientResponse checkpoint #36571
• LazyConnectionDataSourceProxy does not pass on holdability to target Connection #36530
• DefaultJmsListenerContainer may hang in an endless loop in doShutdown #36511
• Inconsistent codings resolution in resource resolvers #36508

📔 Documentation

• Clarify semantics of HttpMethod.valueOf() #36653
• Document that spring.profiles.active is ignored by @ActiveProfiles #36636
• Document whitespace semantics in SpEL expressions #36629
• MergedAnnotation.asAnnotationAttributes() Javadoc incorrectly states that it creates an immutable map #36568
• Introduce Kotlin examples for Bean Overrides (@MockitoBean, etc.) #36542
• Fix incorrect cross-reference links in AbstractEnvironment Javadoc #36517

🔨 Dependency Upgrades

• Upgrade to Micrometer 1.15.11 #36661
• Upgrade to Reactor 2024.0.17 #36660

⭐ New Features

• Leverage ResourceHandlerUtils in ScriptTemplateView #36459
• Restore ScriptTemplateViewTests #36457
• Fix log message in ConfigurationClassBeanDefinitionReader #36454
• Resolve context initializers only once in AbstractTestContextBootstrapper #36431
• Exclude legacy @javax.validation.Constraint from convention-based annotation attribute override check #36412
• Optimize MediaType(MediaType, Charset) constructor #36351
• Optimize the addition of a charset to the MediaType in AbstractHttpMessageConverter #36350
• Consistent adaptation of HTTP headers on Servlet responses #36345
• Improve performance of validation groups determination in WebFlux #36337
• Detect all common size exceptions from Tomcat and Commons FileUpload 2.x #36324

🐞 Bug Fixes

• Guard against invalid id/event values in Server Sent Events #36442
• Incomplete debug message in ConfigurationClassBeanDefinitionReader #36411
• Inconsistent ApplicationEventMulticaster state after removing ApplicationListener implemented by FactoryBean #36405
• Graceful shutdown of SimpleAsyncTaskExecutor #36384
• HttpMediaTypeException thrown when calculating compatible media types #36363
• ResolvableType#getGenerics() breaks serialization #36347
• Multipart upload leak on client abort (ByteBuf.release() not called) #36327

📔 Documentation

• Document @Fallback alongside Primary in the reference manual and @Bean Javadoc #36441
• Document registration recommendations for BeanPostProcessor and BeanFactoryPostProcessor #36436
• Fix links to UriComponentsBuilder and polish examples #36406
• Emphasize @Configuration classes over XML and Groovy in testing chapter #36394
• Polish SpEL operator examples in reference docs #36375

🔨 Dependency Upgrades

• Upgrade to JUnit 5.14.3 #36388
• Upgrade to Micrometer 1.15.10 #36446
• Upgrade to Reactor 2024.0.16 #36445