[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
org.springframework:spring-context	7.0.8 → 7.0.10

---

Release Notes

spring-projects/spring-framework (org.springframework:spring-context)

v7.0.10

Compare Source

⭐ New Features

• Align DelegatingMessageSource fallback implementation with AbstractMessageSource #​37383
• HttpEntity(T, MultiValueMap) stores an HttpHeaders unchecked, causing IncompatibleClassChangeError inside RestTemplate #​37358
• Recognize relocated Mockito MockAccess interface in ProxyProcessorSupport #​37342
• Runtime compatibility with JPA 4.0 M7 and corresponding Hibernate 8.0 snapshots #​37315
• Avoid Kotlin reflection in MethodParameter for non-suspending functions #​37300
• Revise underscore naming fallback in SimplePropertyRowMapper #​37297
• Avoid useless queue ops in ConcurrentLruCache.clear() #​37292
• PathMatchingResourcePatternResolver misses jars on java.class.path whose path contains % #​37280
• Remove redundant whitespace in exception messages #​37277
• OpenInView does no longer work with HibernateTransactionManager #​37273
• Lazily handle setClientInfo/setNetworkTimeout in LazyConnectionDataSourceProxy #​37261
• Avoid redundant filtering in FilteredMap.size() #​37256
• Support NaN and inifinite float values in toString() for synthesized annotations #​37244
• Use ArrayList instead of LinkedList in CompositeRetryListener #​37231
• redirectedUrl() argument in MockMvcResultMatchers should be @Nullable #​37230
• Published Gradle module file is missing javadocElements and sourcesElements #​37209
• Introduce a builder for SpelParserConfiguration #​37187
• Protobuf support classes all implement getMessageBuilder() #​37147
• Allow null contextPath in ServerHttpRequest.Builder #​37099
• Log broker availability events as String messages #​36856

🐞 Bug Fixes

• Avoid unnecessary dependent-bean registration for autowire-by-type #​37424
• Handle zero readTimeout in JdkClientHttpConnector #​37412
• Race condition in PartGenerator.CreateFileState can lose the completion signal #​37409
• Paused executor with late shutdown leaks its worker thread (and the closed context) after close #​37406
• Fix hanging retries for Flux-returning methods with caching #​37403
• Avoid serving stale values after failed refill in AbstractIdentityColumnMaxValueIncrementer #​37402
• Copy cookies in RenderingResponse.from() #​37378
• Avoid phantom keys in LinkedCaseInsensitiveMap.computeIfAbsent #​37351
• Fix single-value adaptation for primitive array types in TypeMappedAnnotation #​37349
• CssLinkResourceTransformer fails for invalid CSS links #​37336
• Fix cached ID reuse after commit failure in MySQLMaxValueIncrementer #​37322
• Fix connection leak in MySQLMaxValueIncrementer #​37321
• @CacheEvict truncates Flux results to the first element #​37309
• ConcurrentLruCache.clear() can miss entries added while it's running #​37287
• Enforce disk usage limit when spilling part to disk #​37285
• Prevent double size decrement in ConcurrentLruCache #​37268
• LogAccessor.debug(CharSequence) eagerly renders LogMessage since spring-core 7 switched from spring-jcl to commons-logging #​37266
• WebFlux loses empty multipart file when the file part is not last. #​37264
• Complete empty Uni instances from the Mutiny reactive adapter #​37259
• DefaultAsyncServerResponse.writeAsync() discards previously configured AsyncWebRequest timeout #​37257
• Provide missing native image hints for proxied hibernate 8 query types #​37251
• Provide missing native image hint for StatelessSession proxy created by SharedEntityManagerCreator. #​37249
• Provide missing native image reflection hint for hibernate PersistenceUnitInfoDescriptor. #​37247
• Sort duplicate key codes in SQLErrorCodes #​37235
• Handle zero readTimeout in JdkClientHttpRequestFactory #​37234
• Wrong reconnection attempt count in ReactorNettyTcpClient #​37223
• Stored procedure OUT parameter values are lost outside a transaction as of 7.0.9 #​37221
• Avoid int overflow in expiration time calculations in MockMvc and FlashMap #​37208
• ScheduledAnnotationBeanPostProcessor doesn't correctly support bean destruction #​37207
• Normalize function return parameter lookup in CallMetaDataContext #​37206
• Fix out-of-bounds read for truncated percent-escape in opaque host #​37203
• ClassFileTransformerAdapter deadlocks between two persistence units under load-time weaving #​37199
• Fix Kotlin value class handling for suspending AOP methods #​37191
• Update to NullAway 0.14.0 and fix new warnings #​37188
• ProtobufJsonEncoder emits JSON array when media type is ndjson #​37158
• streamingMediaTypes in ProtobufJsonEncoder not a subset of encodableMimeTypes #​37154
• Align DataBufferUtils$WriteCompletionHandler exception handling with the read() side #​37145
• DataBufferUtils.read() with NettyDataBuffer on JDK 25 hangs indefinitely #​37143
• Release queued body token buffers on multipart cancel #​37115
• Preserve async API version resolver order #​37096
• ClientResponse.mutate() builder can modify originalResponse headers. #​37086
• Custom reason is overwritten by i18n message in ResponseStatusException.updateAndGetBody() #​36984
• Generate compilable code for non-finite floating-point values #​36965
• Render parameter type names in ClassFileMethodMetadata #​36919
• Honor sourceStart offset in AbstractXMLStreamReader#getTextCharacters #​36914
• Fix reserveMethodNames to reserve each supplied name #​36912
• Replace thread-unsafe SimpleDateFormat with DateTimeFormatter in AbstractMockHttpServletRequestBuilder #​36772
• MockHttpServletRequest.isRequestedSessionIdValid() does not follow Servlet 6.1 Javadoc #​36631
• Map version from @HttpExchange to RequestMappingInfo #​36602
• Ensure that ConversionService.canConvert(Enum) no longer throws an exception #​34532

📔 Documentation

• Fix incorrect class names in WebFlux and MVC docs #​37467
• Document the XXE threat model of SourceHttpMessageConverter #​37407
• Update instructions for importing projects into Eclipse IDE #​37397
• Fix syntax errors in the reference manual #​37392
• Fix Kotlin example in Spring MVC test docs #​37388
• Document usage of type attribute in JSP <form:input> tag #​37376
• Make CONTRIBUTING.md self-contained and add AGENTS.md #​37372
• Clarify ConcurrentReferenceHashMap reference semantics #​37357
• Add missing enclosing single quotes in Javadoc #​37338
• Fix MockMvc async requests example in documentation #​37318
• Add closing braces to examples #​37305
• Fix typos in Javadoc #​37229
• Further updates to Data Binding Content in Web Sections of Documentation #​37228
• Add missing closing parenthesis in WebFlux config reference example #​37163
• Use <<id,text>> instead of xref: for local links in reference docs #​37161
• Fix broken internal xref links in reference docs #​37152
• Fix Kotlin examples in the reference manual #​37101
• Document combining @Retryable with proxy-based features #​37005
• Update recommendations for web data binding #​36789

🔨 Dependency Upgrades

• Upgrade to Micrometer 1.16.8 #​37440
• Upgrade to Reactor 2025.0.8 #​37374

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​Gabriel-Gerhardt, @​Gimini-3, @​SebTardif, @​a-kogun, @​cj848, @​cookie-meringue, @​dmitrysulman, @​garvit-joshi, @​geonheeryu, @​guanchengang, @​hunseonglee, @​jhan0121, @​junhyeong9812, @​kodacme, @​lejuho, @​moonfruit, @​msridhar, @​ngocnhan-tran1996, @​noojung, @​renatomameli, @​rene-schakmann, @​shaggyinsomniac, @​timtebeek, and @​xoruddl

v7.0.9

⚠️ Attention Required

• In Spring Framework 7.0.9, ForwardedHeaderFilter (Spring MVC) and ForwardedHeaderTransformer (WebFlux) each provide a boolean constructor argument whether to use the standard "Forwarded" header or the "X-Forwarded" alternative headers. A separate property turns on and off use of "X-Forwarded-Prefix". While the default constructor preserves the existing behavior, we recommend to use the new constructor to explicitly specify which forwarded headers to use to make the processing more deterministic and aligned with what is expected from the proxy. Please, see the updated Security Considerations section for details. In 7.1 with #​37072 the default constructor is deprecated and marked for removal. #​37090
• In Spring Framework 7.0.9, SimpleEvaluationContext no longer supports expression compilation by default, regardless of the compiler mode configured via SpelParserConfiguration or the spring.expression.compiler.mode system property or Spring property. Applications that intentionally use SimpleEvaluationContext with trusted expressions and require compilation for performance reasons can opt in by calling withCompilationSupported() on the SimpleEvaluationContext builder. Care should be taken when opting in to compilation, as doing so removes the safety guards applied during interpreted evaluation. #​37035

⭐ New Features

• Ignore an empty port value in URI parsing #​37117
• Avoid retaining class files in annotation metadata #​37112
• Add @Nullable annotations when treating Map.remove() as returning @Nullable #​37067
• Revisit SSE view fragments handling #​37061
• Check list index after auto-grow in AbstractNestablePropertyAccessor #​37036
• Disable SpEL expression compilation by default in SimpleEvaluationContext #​37035
• Limit result size of BigDecimal/BigInteger power operations in SpEL #​37034
• Refactor redirect handling in UrlHandlerFilter #​37030
• Revise stylesheet source handling in XsltView #​37029
• Revise view name handling in UrlFilenameViewController #​37027
• Handle pre-flight requests in functional endpoint setup without DispatcherHandler #​37024
• Improve WebSocket handshake error logging #​37023
• Fix missing nullability in JdbcTemplate.batchUpdate #​37012
• Timeout property in RetryPolicy does not have a default constant #​36983
• Write native configuration files as UTF-8 #​36972
• DefaultServerRequest.ServletParametersMap.entrySet() does not retain HttpServletRequest.getParameterMap() order #​36966
• Perform nextKey within synchronization for SQLite as well #​36959
• Add support for custom ObjectInputFilter on DefaultDeserializer #​36958
• Revise resource bundle caching for common locales #​36957
• Improve nullability for getSession(*) in MockHttpServletRequest #​36926
• Improve fallback logic in ParameterContentNegotiationStrategy and ParameterContentTypeResolver #​36925
• Improve ambiguous match check on preflight request #​36903
• Improve Groovy markup template loading #​36902
• Improve request path handling on a Reactor Netty server #​36893
• Improve JettyWebSocketSession error handling #​36891

🐞 Bug Fixes

• EclipseLinkJpaDialect singleton lock in EclipseLinkConnectionHandle.getConnection() serializes all JDBC connection acquisitions under load #​37085
• MetadataReader fails to read byte[] array from annotation #​37083
• Ensure parsing/tostring symmetry in ContentDisposition #​37064
• Character outside of permitted range in Content Disposition #​37062
• Release Jackson BufferRecycler to its pool in encoders #​37059
• Ensure consistent error escaping #​37055
• Refine template name processing #​37054
• Reset TwoByteMatcher partial match on mismatching byte #​37053
• Refactor async XML parsing limit checks #​37031
• Fix part constraint checks in PartEventHttpMessageReader #​37028
• Fix buffer leak in RSocket SETUP frame handling #​37026
• Ensure correct Jetty core response cookie handling #​37025
• Align domainToAscii with current WhatWG spec #​37018
• Ensure consistent ButtonTag value attribute processing #​37017
• SpEL's InlineList is cached as a mutable list in compiled mode #​37001
• Write native configuration file when only lambda hints are present #​36989
• SpEL Indexer reuses invalid cached PropertyAccessor #​36986
• SpEL reuses invalid cached ConstructorExecutor #​36985
• MimeTypeUtils raises StringIndexOutOfBoundsException for some invalid mime types #​36971
• Ignore DOCTYPE inside a multi-line comment body #​36948
• Avoid divide-by-zero in ExponentialBackOff jitter #​36932
• Refactor use or close lock in ConcurrentWebSocketSessionDecorator #​36909
• Host header initialization breaking change in StompRelayMessageBrokerHandler #​36907
• Remote address checks for SockJS session #​36681 breaks xhr-polling #​36904
• LifeCyclePrintWriter does not delegate correctly #​36885
• IllegalArgumentException when creating named native query via Shared EntityManager with Hibernate 8.0.0-SNAPSHOT / JPA 4.0.0-M4 #​36878

📔 Documentation

• Document AOP proxy semantics for Bean Overrides in tests #​37121
• Provide guidance for object model design in SpEL #​37102
• Fix Javadoc error in ProtobufDecoder #​37079
• Document security implications of evaluating untrusted SpEL expressions #​36997
• Document relationships between expressions, evaluation contexts, and accessors in SpEL #​36968
• Update Javadoc for @ActiveProfiles ordering #​36950
• Document behavior for 0 delay combined with jitter in backoff policies #​36946
• Clarify design goal of UrlFilenameViewController in Javadoc #​36906

🔨 Dependency Upgrades

• Upgrade to Micrometer 1.16.7 and Tracing 1.6.7 #​37104
• Upgrade to Reactor 2025.0.7 #​37103

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​ZaMan0806, @​alexisgra, @​alshain, @​gianmarcoschifone, @​junhyeong9812, @​msridhar, @​perovic, @​quaff, and @​samueldlightfoot

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.