Skip to content

Update spring.version [SECURITY] - #33

Open
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/spring.version
Open

Update spring.version [SECURITY]#33
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/spring.version

Conversation

@renovate

@renovate renovate Bot commented Jul 31, 2026 •
edited
Loading

Copy link
Copy Markdown

This PR contains the following updates:

Package Change Age Confidence
org.springframework:spring-webmvc 7.0.7 → 7.0.9 age confidence
org.springframework:spring-web 7.0.7 → 7.0.8 age confidence

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Have a look at your dependency dashboard

Spring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFlux

CVE-2026-41841 / GHSA-mq64-j8f9-9gcj

More information

Details

Spring MVC and WebFlux applications are vulnerable to Information Disclosure attacks when resolving static resources.

Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

Severity

  • CVSS Score: 5.9 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux

CVE-2026-41842 / GHSA-x23c-287f-qqv5

More information

Details

Spring MVC and WebFlux applications are vulnerable to Denial of Service (DoS) attacks when resolving static resources.

Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

Severity

  • CVSS Score: 7.5 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Spring Framework Path Traversal via Versioned Static Resources in Spring MVC and WebFlux

CVE-2026-41843 / GHSA-72pg-x5f8-j25j

More information

Details

Spring MVC and WebFlux applications are vulnerable to Path Traversal attacks when resolving static resources.

Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

Severity

  • CVSS Score: 5.9 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Spring Framework Cross-site Scripting via JavaScriptUtils

CVE-2026-41845 / GHSA-3chg-m5w7-qfv5

More information

Details

Due to incorrect escaping, the use of JavaScriptUtils.javaScriptEscape() may lead to JavaScript code injection in the browser, potentially resulting in a cross-site scripting (XSS) vulnerability.

Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

Severity

  • CVSS Score: 7.1 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Spring Framework Open Redirect in Spring MVC and WebFlux

CVE-2026-41844 / GHSA-h3qp-gqrc-q736

More information

Details

A Spring MVC or Spring WebFlux application which configures a mapping for "/**" where the view name is not explicitly specified allows an attacker to craft a link resulting in a 302 redirect to an arbitrary external host via the redirect: prefix.

Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

Severity

  • CVSS Score: 4.2 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Spring Framework Multipart Request Smuggling in Spring MVC and WebFlux

CVE-2026-41853 / GHSA-cjpg-rgq5-fr37

More information

Details

Spring MVC and WebFlux applications are vulnerable to Multipart request smuggling attacks.

Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

Severity

  • CVSS Score: 5.3 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Spring Framework Cross-site Scripting via JSP Form Tags

CVE-2026-41846 / GHSA-957g-f97v-vppc

More information

Details

Spring MVC applications which accept user-supplied values in the cssClass, cssErrorClass, or cssStyle attributes of JSP form tags allow arbitrary HTML/JavaScript code injection, potentially resulting in a cross-site scripting (XSS) vulnerability.

Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

Severity

  • CVSS Score: 5.9 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Spring MVC controller vulnerable to a DoS attack

CVE-2024-38828 / GHSA-w3c8-7r8f-9jp8

More information

Details

Spring MVC controller methods with an @​RequestBody byte[] method parameter are vulnerable to a DoS attack.

Severity

  • CVSS Score: 5.3 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Spring Framework Improper Path Limitation in XsltView

CVE-2026-47884 / GHSA-pc63-qcmh-9cmg

More information

Details

Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/**" mapping that results in view rendering, and where the view name is not explicitly specified.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.25.RELEASE and earlier

Severity

  • CVSS Score: 9.8 / 10 (Critical)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Spring Framework Server Sent Event stream corruption while rendering fragments

CVE-2026-47890 / GHSA-j9f9-w8pj-32f8

More information

Details

Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19

Severity

  • CVSS Score: 9.8 / 10 (Critical)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Spring Framework Server-Side Request Forgery via UriComponentsBuilder

CVE-2026-41854 / GHSA-7m2p-62gw-p8qq

More information

Details

Due to incorrect host parsing, applications that rely on UriComponentsBuilder to parse and validate an externally provided URL string may be exposed to a server-side request forgery (SSRF) attack.

Affected versions:
Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18.

Severity

  • CVSS Score: 4.2 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Pivotal Spring Framework contains unsafe Java deserialization methods

CVE-2016-1000027 / GHSA-4wrc-f8pq-fpqp

More information

Details

Pivotal Spring Framework before 6.0.0 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required.

Maintainers recommend investigating alternative components or a potential mitigating control. Version 4.2.6 and 3.2.17 contain enhanced documentation advising users to take precautions against unsafe Java deserialization, version 5.3.0 deprecate the impacted classes and version 6.0.0 removed it entirely.

Severity

  • CVSS Score: 9.8 / 10 (Critical)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Spring Web vulnerable to Open Redirect or Server Side Request Forgery

CVE-2024-22243 / GHSA-ccgv-vj62-xf9h

More information

Details

Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect attack or to a SSRF attack if the URL is used after passing validation checks.

Severity

  • CVSS Score: 8.1 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Spring Framework URL Parsing with Host Validation Vulnerability

CVE-2024-22259 / GHSA-hgjh-9rj2-g67j

More information

Details

Applications that use UriComponentsBuilder in Spring Framework to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html  attack or to a SSRF attack if the URL is used after passing validation checks.

This is the same as CVE-2024-22243 https://spring.io/security/cve-2024-22243, but with different input.

Severity

  • CVSS Score: 8.1 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Spring Framework URL Parsing with Host Validation

CVE-2024-22262 / GHSA-2wrp-6fg6-hmc5

More information

Details

Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html  attack or to a SSRF attack if the URL is used after passing validation checks.

This is the same as CVE-2024-22259 https://spring.io/security/cve-2024-22259  and CVE-2024-22243 https://spring.io/security/cve-2024-22243 , but with different input.

Severity

  • CVSS Score: 8.1 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Spring Framework DoS via conditional HTTP request

CVE-2024-38809 / GHSA-2rmj-mq67-h97g

More information

Details

Description

Applications that parse ETags from If-Match or If-None-Match request headers are vulnerable to DoS attack.

Affected Spring Products and Versions

org.springframework:spring-web in versions

6.1.0 through 6.1.11
6.0.0 through 6.0.22
5.3.0 through 5.3.37

Older, unsupported versions are also affected

Mitigation

Users of affected versions should upgrade to the corresponding fixed version.
6.1.x -> 6.1.12
6.0.x -> 6.0.23
5.3.x -> 5.3.38
No other mitigation steps are necessary.

Users of older, unsupported versions could enforce a size limit on If-Match and If-None-Match headers, e.g. through a Filter.

Severity

  • CVSS Score: 5.3 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

spring-projects/spring-framework (org.springframework:spring-webmvc)

v7.0.9

⚠️ Attention Required

  • In Spring Framework 7.0.9, ForwardedHeaderFilter (Spring MVC) and ForwardedHeaderTransformer (WebFlux) each provide a boolean constructor argument whether to use the standard "Forwarded" header or the "X-Forwarded" alternative headers. A separate property turns on and off use of "X-Forwarded-Prefix". While the default constructor preserves the existing behavior, we recommend to use the new constructor to explicitly specify which forwarded headers to use to make the processing more deterministic and aligned with what is expected from the proxy. Please, see the updated Security Considerations section for details. In 7.1 with #​37072 the default constructor is deprecated and marked for removal. #​37090
  • In Spring Framework 7.0.9, SimpleEvaluationContext no longer supports expression compilation by default, regardless of the compiler mode configured via SpelParserConfiguration or the spring.expression.compiler.mode system property or Spring property. Applications that intentionally use SimpleEvaluationContext with trusted expressions and require compilation for performance reasons can opt in by calling withCompilationSupported() on the SimpleEvaluationContext builder. Care should be taken when opting in to compilation, as doing so removes the safety guards applied during interpreted evaluation. #​37035

⭐ New Features

  • Ignore an empty port value in URI parsing #​37117
  • Avoid retaining class files in annotation metadata #​37112
  • Add @Nullable annotations when treating Map.remove() as returning @Nullable #​37067
  • Revisit SSE view fragments handling #​37061
  • Check list index after auto-grow in AbstractNestablePropertyAccessor #​37036
  • Disable SpEL expression compilation by default in SimpleEvaluationContext #​37035
  • Limit result size of BigDecimal/BigInteger power operations in SpEL #​37034
  • Refactor redirect handling in UrlHandlerFilter #​37030
  • Revise stylesheet source handling in XsltView #​37029
  • Revise view name handling in UrlFilenameViewController #​37027
  • Handle pre-flight requests in functional endpoint setup without DispatcherHandler #​37024
  • Improve WebSocket handshake error logging #​37023
  • Fix missing nullability in JdbcTemplate.batchUpdate #​37012
  • Timeout property in RetryPolicy does not have a default constant #​36983
  • Write native configuration files as UTF-8 #​36972
  • DefaultServerRequest.ServletParametersMap.entrySet() does not retain HttpServletRequest.getParameterMap() order #​36966
  • Perform nextKey within synchronization for SQLite as well #​36959
  • Add support for custom ObjectInputFilter on DefaultDeserializer #​36958
  • Revise resource bundle caching for common locales #​36957
  • Improve nullability for getSession(*) in MockHttpServletRequest #​36926
  • Improve fallback logic in ParameterContentNegotiationStrategy and ParameterContentTypeResolver #​36925
  • Improve ambiguous match check on preflight request #​36903
  • Improve Groovy markup template loading #​36902
  • Improve request path handling on a Reactor Netty server #​36893
  • Improve JettyWebSocketSession error handling #​36891

🐞 Bug Fixes

  • EclipseLinkJpaDialect singleton lock in EclipseLinkConnectionHandle.getConnection() serializes all JDBC connection acquisitions under load #​37085
  • MetadataReader fails to read byte[] array from annotation #​37083
  • Ensure parsing/tostring symmetry in ContentDisposition #​37064
  • Character outside of permitted range in Content Disposition #​37062
  • Release Jackson BufferRecycler to its pool in encoders #​37059
  • Ensure consistent error escaping #​37055
  • Refine template name processing #​37054
  • Reset TwoByteMatcher partial match on mismatching byte #​37053
  • Refactor async XML parsing limit checks #​37031
  • Fix part constraint checks in PartEventHttpMessageReader #​37028
  • Fix buffer leak in RSocket SETUP frame handling #​37026
  • Ensure correct Jetty core response cookie handling #​37025
  • Align domainToAscii with current WhatWG spec #​37018
  • Ensure consistent ButtonTag value attribute processing #​37017
  • SpEL's InlineList is cached as a mutable list in compiled mode #​37001
  • Write native configuration file when only lambda hints are present #​36989
  • SpEL Indexer reuses invalid cached PropertyAccessor #​36986
  • SpEL reuses invalid cached ConstructorExecutor #​36985
  • MimeTypeUtils raises StringIndexOutOfBoundsException for some invalid mime types #​36971
  • Ignore DOCTYPE inside a multi-line comment body #​36948
  • Avoid divide-by-zero in ExponentialBackOff jitter #​36932
  • Refactor use or close lock in ConcurrentWebSocketSessionDecorator #​36909
  • Host header initialization breaking change in StompRelayMessageBrokerHandler #​36907
  • Remote address checks for SockJS session #​36681 breaks xhr-polling #​36904
  • LifeCyclePrintWriter does not delegate correctly #​36885
  • IllegalArgumentException when creating named native query via Shared EntityManager with Hibernate 8.0.0-SNAPSHOT / JPA 4.0.0-M4 #​36878

📔 Documentation

  • Document AOP proxy semantics for Bean Overrides in tests #​37121
  • Provide guidance for object model design in SpEL #​37102
  • Fix Javadoc error in ProtobufDecoder #​37079
  • Document security implications of evaluating untrusted SpEL expressions #​36997
  • Document relationships between expressions, evaluation contexts, and accessors in SpEL #​36968
  • Update Javadoc for @ActiveProfiles ordering #​36950
  • Document behavior for 0 delay combined with jitter in backoff policies #​36946
  • Clarify design goal of UrlFilenameViewController in Javadoc #​36906

🔨 Dependency Upgrades

  • Upgrade to Micrometer 1.16.7 and Tracing 1.6.7 #​37104
  • Upgrade to Reactor 2025.0.7 #​37103

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​ZaMan0806, @​alexisgra, @​alshain, @​gianmarcoschifone, @​junhyeong9812, @​msridhar, @​perovic, @​quaff, and @​samueldlightfoot

v7.0.8

⚠️ Security Fixes

This maintenance release fixes a high number of CVEs. You can learn more about this in the "Spring and Security In The Times Of AI" blog post. Here is the full list of 16 CVEs:

  • CVE-2026-41838 "Spring Framework Predictable Session ID in WebSocket Module"
  • CVE-2026-41839 "Spring Framework Escalation via Session Fixation in WebFlux"
  • CVE-2026-41840 "Spring Framework Denial of Service via Multipart Requests in WebFlux"
  • CVE-2026-41841 "Spring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFlux"
  • CVE-2026-41842 "Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux"
  • CVE-2026-41843 "Spring Framework Path Traversal via Versioned Static Resources in Spring MVC and WebFlux"
  • CVE-2026-41844 "Spring Framework Open Redirect in Spring MVC and WebFlux"
  • CVE-2026-41845 "Spring Framework Cross-site Scripting via JavaScriptUtils"
  • CVE-2026-41846 "Spring Framework Cross-site Scripting via JSP Form Tags"
  • CVE-2026-41848 "Spring Framework Denial of Service via AntPathMatcher"
  • CVE-2026-41850 "Spring Framework Algorithmic Denial of Service via SpEL Expressions"
  • CVE-2026-41851 "Spring Framework Denial of Service via Unbounded Cache in SpEL"
  • CVE-2026-41852 "Spring Framework Arbitrary Method Invocation in SpEL Expressions"
  • CVE-2026-41853 "Spring Framework Multipart Request Smuggling in Spring MVC and WebFlux"
  • CVE-2026-41854 "Spring Framework Server-Side Request Forgery via UriComponentsBuilder"
  • CVE-2026-41855 "Spring Framework Unsafe Deserialization via Jackson JMS Converters"

⭐ New Features

  • Include zone ID in CronTrigger's equals/hashCode implementations #​36871
  • Expose ClassLoader from DefaultDeserializer #​36833
  • Use immutable map for SEPARATORS static field in DefaultPathContainer #​36821
  • Track operations during SpEL expression evaluation #​36801
  • Ensure getters have non-void return types in SpEL #​36800
  • Avoid too many character access attempts in AntPathMatcher #​36799
  • Refine default view name resolution #​36793
  • Refine Jackson JMS converters #​36791
  • Improve ABNF rule checks in RfcUriParser #​36787
  • Restrict SpringVersion.getVersion() to "major.minor.patch" format #​36785
  • Runtime compatibility with JPA 4.0 M4 and corresponding Hibernate 8.0 snapshots #​36784
  • Allow specifying the charset to use in ExchangeFilterFunctions#basicAuthentication #​36777
  • Use CollectionUtils to initialize HashMap in DefaultUriBuilderFactory #​36763
  • Improve error messages in SpEL #​36756
  • Improve pattern caching in SpEL #​36755
  • Avoid ResolvableType#forType contention for implicit cache cleanup #​36745
  • Switch to JdkIdGenerator for WebSocket Sessions #​36740
  • Detect custom deserialized NullValue instances in AbstractValueAdaptingCache #​36727
  • LiteWebJarsResourceResolver does not resolve directories #​36726
  • Warn against unsafe static resource locations in MVC and WebFlux #​36692
  • Consistent compatibility with Woodstox as an alternative to Xerces #​36682
  • Improve principal checks for SockJS session #​36681
  • Set host header consistently in STOMP relay CONNECT frames #​36673
  • Support Micrometer context propagation in Kotlin Flow #​36667
  • Reliable detection of broadcast messages in UserDestinationMessageHandler #​36662

🐞 Bug Fixes

  • Concurrency issue against shared cookie field in CookieLocaleResolver#setLocaleContext #​36869
  • Server Sent Event does not support multi-line comments #​36866
  • CronExpression skips days on midnight DST gap #​36865
  • Regression in 6.2.0+: ConfigurationClassParser incorrectly removes component-scanned bean when the same class is also registered under a different name via XML #​36835
  • Preserve generic type info in awaitEntity() #​36834
  • Bean Background Bootstrap and Lazy Init #​36844
  • Back-off for DefaultMessageListenerContainer with OracleAQ has changed and is very short in SpringBoot 4 #​36809
  • Character outside of permitted range in Content Disposition #​36805
  • Fix JSP tag processing #​36797
  • Fix script processing capabilities #​36795
  • Jaxb2XmlEncoder exclusivity prevents JacksonXmlEncoder usage and hinders POJO serialization #​36776
  • JacksonXmlEncoder.canEncode incorrectly returns true for String body with application/xml #​36775
  • Consistently expose map key quotes in PropertyAccessorUtils #​36765
  • Fix fragment parsing for relative URI in RFC URI parser #​36762
  • Fix race condition in InMemoryWebSessionStore #​36742
  • Parsing failure for MIME type with quoted parameter values #​36730
  • Circular dependency between supplier-created beans is silently ignored on startup #​36725
  • Data is lost for joined DataBuffer in DataBufferUtils #​36714
  • Cache collisions in CachingResourceResolver #​36713
  • Unexpected path element removal when resolving versioned resources #​36698
  • Non-deterministic "Body token not expected" in org.springframework.http.codec.multipart.PartGenerator #​36694
  • Regression on value class parameter handling #​36665
  • Fix inverted logic for boolean last flag in JettyWebSocketSession when sending binary message #​36650
  • Parent traceId is not reused when calling WebClient.awaitExchange function #​36182

📔 Documentation

  • Fix broken links to Selenium documentation #​36875
  • Fix applicability note on setAutoGrowCollectionLimit #​36863
  • Document @Conditional gating of nested @Configuration classes #​36831
  • Javadoc of nestingLevel parameter in MethodParameter constructor is inconsistent with actual implementation #​36826
  • Re-structuring of Data Binding Content in Web Sections of Documentation #​36803
  • Fix typos for validateExistingTransaction #​36767

🔨 Dependency Upgrades

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​0AndWild, @​Dennis-Mircea, @​cookie-meringue, @​daguimu, @​dmitrysulman, @​kilink, @​kzander91, @​leestana01, @​mguiking, @​quaff, @​seonwooj0810, @​sgerke-1L, @​shenjianeng, @​tianhaocui, @​wushiyuanmaimob, and @​zmovo

Configuration

📅 Schedule: (in timezone Australia/Sydney)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot changed the title Update dependency org.springframework:spring-webmvc to v7.0.8 [SECURITY] Update spring.version to v7.0.8 [SECURITY] Aug 8, 2026
@renovate
renovate Bot force-pushed the renovate/spring.version branch from 566673d to a82c764 Compare October 23, 2026 00:13
@renovate renovate Bot changed the title Update spring.version to v7.0.8 [SECURITY] Update spring.version [SECURITY] Oct 23, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants