Skip to content

build(deps): bump the maven-dependencies group across 1 directory with 18 updates - #4884

Open
dependabot[bot] wants to merge 2 commits into
masterfrom
dependabot/maven/maven-dependencies-bc8cbc3b7d
Open

build(deps): bump the maven-dependencies group across 1 directory with 18 updates#4884
dependabot[bot] wants to merge 2 commits into
masterfrom
dependabot/maven/maven-dependencies-bc8cbc3b7d

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 24, 2026

Copy link
Copy Markdown
Contributor

Bumps the maven-dependencies group with 18 updates in the / directory:

Package From To
software.amazon.awssdk:sts 2.53.1 2.54.1
software.amazon.awssdk:auth 2.53.1 2.54.1
software.amazon.awssdk:http-auth-aws 2.53.1 2.54.1
software.amazon.awssdk:http-auth-spi 2.53.1 2.54.1
software.amazon.awssdk:http-client-spi 2.53.1 2.54.1
software.amazon.awssdk:utils 2.53.1 2.54.1
com.google.protobuf:protobuf-java 4.35.1 4.36.0
org.springframework.boot:spring-boot 4.1.0 4.1.1
org.springframework.boot:spring-boot-autoconfigure 4.1.0 4.1.1
org.springframework.boot:spring-boot-actuator 4.1.0 4.1.1
org.springframework.boot:spring-boot-test 4.1.0 4.1.1
org.springframework:spring-core 7.0.8 7.0.9
org.springframework:spring-aop 7.0.8 7.0.9
org.springframework:spring-beans 7.0.8 7.0.9
org.springframework:spring-context 7.0.8 7.0.9
org.springframework:spring-expression 7.0.8 7.0.9
org.springframework:spring-test 7.0.8 7.0.9
com.diffplug.spotless:spotless-maven-plugin 3.9.0 3.10.0

Updates software.amazon.awssdk:sts from 2.53.1 to 2.54.1

Updates software.amazon.awssdk:auth from 2.53.1 to 2.54.1

Updates software.amazon.awssdk:http-auth-aws from 2.53.1 to 2.54.1

Updates software.amazon.awssdk:http-auth-spi from 2.53.1 to 2.54.1

Updates software.amazon.awssdk:http-client-spi from 2.53.1 to 2.54.1

Updates software.amazon.awssdk:utils from 2.53.1 to 2.54.1

Updates software.amazon.awssdk:auth from 2.53.1 to 2.54.1

Updates software.amazon.awssdk:http-auth-aws from 2.53.1 to 2.54.1

Updates software.amazon.awssdk:http-auth-spi from 2.53.1 to 2.54.1

Updates software.amazon.awssdk:http-client-spi from 2.53.1 to 2.54.1

Updates software.amazon.awssdk:utils from 2.53.1 to 2.54.1

Updates com.google.protobuf:protobuf-java from 4.35.1 to 4.36.0

Commits

Updates org.springframework.boot:spring-boot from 4.1.0 to 4.1.1

Release notes

Sourced from org.springframework.boot:spring-boot's releases.

v4.1.1

⚠️ Attention Required

  • Spring Boot's Gradle plugin no longer automatically configures gRPC when the Protobuf plugin is applied. This behavior caused problems for those using Protobuf without gRPC. To opt in to the configuration of gRPC, configure the protobuf extension with the grpc plugin using an empty block. The Spring Boot Gradle plugin will then automatically configure the use of protoc-gen-grpc-java as before. #50822

🐞 Bug Fixes

  • Kafka consumer-specific security protocol is not taken into account #51369
  • Structured logging: a failed JSON encode corrupts the next log event written on the same thread #51156
  • Micrometer registries pin the application context #51135
  • Temporary file is not deleted when ExportedImageTar construction fails #51132
  • Metadata annotation processor ignores getter-level @NestedConfigurationProperty for records #51098
  • spring-boot-h2-console pulls servlet-api as transitive dependency #51095
  • PropertiesLauncher does not log nested archive paths #51089
  • Methods that return the result of Map#remove are not declared with a @Nullable return type #51087
  • NativeImageResourceProvider flattens Flyway migration paths in subdirectories #50964
  • Fix ordering of Kotlinx Serialization CodecCustomizer #50961
  • JarFile is not closed when finding main class from archive #50959
  • Application-managed JUL bridge handler should only be removed if installed #50950
  • CloudFoundry reactive auto-configuration should not require a WebClient.Builder bean to be defined #50944
  • Context refresh fails on reactive Cloud Foundry when using Actuator without spring-boot-health #50942
  • Resources are not cleaned up when resolving an image that is not yet present in the builder #50941
  • GraphQlWebMvcAutoConfiguration should apply customizers in order #50914
  • Auto-configured RedisMessageListenerContainer does not use virtual threads when spring.threads.virtual.enabled is true #50884
  • Context refresh fails when using Actuator on Jersey without spring-boot-health #50872
  • Context refresh fails on Cloud Foundry when using Actuator without spring-boot-health #50871
  • IllegalStateException when binding properties to a @Validated class that contains a map whose value type is a wildcard #50856
  • High number of connections due to Mongo health indicator #50852
  • Inconsistent handling of empty string values of spring.security.oauth2.resourceserver.jwt issuer-uri and jwk-set-uri #50849
  • Return type nullability of ApplicationContextAssert's getBean methods does not indicate that bean may be null #50845
  • PropertiesWebClientHttpServiceGroupConfigurer has highest precedence, preventing other configurers from being ordered ahead of it #50843
  • Exposing gRPC test server port should backoff if gRPC is not present #50825
  • JpaBaseConfiguration#entityManagerConfiguration can cause a dependency loop on beans declaring AsyncTaskExecutor #50801
  • spring.grpc.server.health.include-overall-health is not taken into account #50799
  • Setting 'server.servlet.session.cookie.partitioned' to false still emits the 'Partitioned' cookie attribute #50790
  • Managed version of Prometheus Client is not aligned with Micrometer's micrometer-registry-prometheus #50780
  • Map properties bound from empty strings fail with ConverterNotFoundException #50773
  • Protobuf Common Protos should not be a managed dependency #50772
  • An application that depends on spring-boot-security-oauth2-resource-server may fail to start with a ClassNotFoundException when Reactor is on the classpath but WebFlux is not #50764
  • W3CHeaderParser's decoding is not compliant with RFC 3986 #50650

📔 Documentation

  • Description of spring.graphql.websocket.connection-init-timeout does not render correctly in the reference guide #51348
  • spring.profiles.group should have a 'spring-profile-name' hint provider #51284
  • Remove reference to removed InfluxDB auto-configuration #51176
  • Use JacksonJsonSerde in Kafka Streams documentation #51161
  • Document alternatives to HttpMessageConverters #51129
  • Fix stale type reference for OTLP logging transport metadata #51119
  • Metadata for spring.test.mockmvc.htmlunit.url declares the wrong type #51115

... (truncated)

Commits
  • 6fdf67e Release 4.1.1
  • fde599b Upgrade to Spring Pulsar 2.0.7
  • 9daa58f Upgrade to Spring HATEOAS 3.1.2
  • 353993e Upgrade to Spring Data Bom 2026.0.1
  • 24ba596 Upgrade to Spring Session 4.1.1
  • 5cb5c29 Upgrade to Spring Security 7.1.1
  • 4adc8eb Upgrade to Spring LDAP 4.1.1
  • 4d9c19c Upgrade to Spring Kafka 4.1.1
  • f30f612 Upgrade to Spring Integration 7.1.1
  • b930283 Upgrade to Spring gRPC 1.1.1
  • Additional commits viewable in compare view

Updates org.springframework.boot:spring-boot-autoconfigure from 4.1.0 to 4.1.1

Release notes

Sourced from org.springframework.boot:spring-boot-autoconfigure's releases.

v4.1.1

⚠️ Attention Required

  • Spring Boot's Gradle plugin no longer automatically configures gRPC when the Protobuf plugin is applied. This behavior caused problems for those using Protobuf without gRPC. To opt in to the configuration of gRPC, configure the protobuf extension with the grpc plugin using an empty block. The Spring Boot Gradle plugin will then automatically configure the use of protoc-gen-grpc-java as before. #50822

🐞 Bug Fixes

  • Kafka consumer-specific security protocol is not taken into account #51369
  • Structured logging: a failed JSON encode corrupts the next log event written on the same thread #51156
  • Micrometer registries pin the application context #51135
  • Temporary file is not deleted when ExportedImageTar construction fails #51132
  • Metadata annotation processor ignores getter-level @NestedConfigurationProperty for records #51098
  • spring-boot-h2-console pulls servlet-api as transitive dependency #51095
  • PropertiesLauncher does not log nested archive paths #51089
  • Methods that return the result of Map#remove are not declared with a @Nullable return type #51087
  • NativeImageResourceProvider flattens Flyway migration paths in subdirectories #50964
  • Fix ordering of Kotlinx Serialization CodecCustomizer #50961
  • JarFile is not closed when finding main class from archive #50959
  • Application-managed JUL bridge handler should only be removed if installed #50950
  • CloudFoundry reactive auto-configuration should not require a WebClient.Builder bean to be defined #50944
  • Context refresh fails on reactive Cloud Foundry when using Actuator without spring-boot-health #50942
  • Resources are not cleaned up when resolving an image that is not yet present in the builder #50941
  • GraphQlWebMvcAutoConfiguration should apply customizers in order #50914
  • Auto-configured RedisMessageListenerContainer does not use virtual threads when spring.threads.virtual.enabled is true #50884
  • Context refresh fails when using Actuator on Jersey without spring-boot-health #50872
  • Context refresh fails on Cloud Foundry when using Actuator without spring-boot-health #50871
  • IllegalStateException when binding properties to a @Validated class that contains a map whose value type is a wildcard #50856
  • High number of connections due to Mongo health indicator #50852
  • Inconsistent handling of empty string values of spring.security.oauth2.resourceserver.jwt issuer-uri and jwk-set-uri #50849
  • Return type nullability of ApplicationContextAssert's getBean methods does not indicate that bean may be null #50845
  • PropertiesWebClientHttpServiceGroupConfigurer has highest precedence, preventing other configurers from being ordered ahead of it #50843
  • Exposing gRPC test server port should backoff if gRPC is not present #50825
  • JpaBaseConfiguration#entityManagerConfiguration can cause a dependency loop on beans declaring AsyncTaskExecutor #50801
  • spring.grpc.server.health.include-overall-health is not taken into account #50799
  • Setting 'server.servlet.session.cookie.partitioned' to false still emits the 'Partitioned' cookie attribute #50790
  • Managed version of Prometheus Client is not aligned with Micrometer's micrometer-registry-prometheus #50780
  • Map properties bound from empty strings fail with ConverterNotFoundException #50773
  • Protobuf Common Protos should not be a managed dependency #50772
  • An application that depends on spring-boot-security-oauth2-resource-server may fail to start with a ClassNotFoundException when Reactor is on the classpath but WebFlux is not #50764
  • W3CHeaderParser's decoding is not compliant with RFC 3986 #50650

📔 Documentation

  • Description of spring.graphql.websocket.connection-init-timeout does not render correctly in the reference guide #51348
  • spring.profiles.group should have a 'spring-profile-name' hint provider #51284
  • Remove reference to removed InfluxDB auto-configuration #51176
  • Use JacksonJsonSerde in Kafka Streams documentation #51161
  • Document alternatives to HttpMessageConverters #51129
  • Fix stale type reference for OTLP logging transport metadata #51119
  • Metadata for spring.test.mockmvc.htmlunit.url declares the wrong type #51115

... (truncated)

Commits
  • 6fdf67e Release 4.1.1
  • fde599b Upgrade to Spring Pulsar 2.0.7
  • 9daa58f Upgrade to Spring HATEOAS 3.1.2
  • 353993e Upgrade to Spring Data Bom 2026.0.1
  • 24ba596 Upgrade to Spring Session 4.1.1
  • 5cb5c29 Upgrade to Spring Security 7.1.1
  • 4adc8eb Upgrade to Spring LDAP 4.1.1
  • 4d9c19c Upgrade to Spring Kafka 4.1.1
  • f30f612 Upgrade to Spring Integration 7.1.1
  • b930283 Upgrade to Spring gRPC 1.1.1
  • Additional commits viewable in compare view

Updates org.springframework.boot:spring-boot-actuator from 4.1.0 to 4.1.1

Release notes

Sourced from org.springframework.boot:spring-boot-actuator's releases.

v4.1.1

⚠️ Attention Required

  • Spring Boot's Gradle plugin no longer automatically configures gRPC when the Protobuf plugin is applied. This behavior caused problems for those using Protobuf without gRPC. To opt in to the configuration of gRPC, configure the protobuf extension with the grpc plugin using an empty block. The Spring Boot Gradle plugin will then automatically configure the use of protoc-gen-grpc-java as before. #50822

🐞 Bug Fixes

  • Kafka consumer-specific security protocol is not taken into account #51369
  • Structured logging: a failed JSON encode corrupts the next log event written on the same thread #51156
  • Micrometer registries pin the application context #51135
  • Temporary file is not deleted when ExportedImageTar construction fails #51132
  • Metadata annotation processor ignores getter-level @NestedConfigurationProperty for records #51098
  • spring-boot-h2-console pulls servlet-api as transitive dependency #51095
  • PropertiesLauncher does not log nested archive paths #51089
  • Methods that return the result of Map#remove are not declared with a @Nullable return type #51087
  • NativeImageResourceProvider flattens Flyway migration paths in subdirectories #50964
  • Fix ordering of Kotlinx Serialization CodecCustomizer #50961
  • JarFile is not closed when finding main class from archive #50959
  • Application-managed JUL bridge handler should only be removed if installed #50950
  • CloudFoundry reactive auto-configuration should not require a WebClient.Builder bean to be defined #50944
  • Context refresh fails on reactive Cloud Foundry when using Actuator without spring-boot-health #50942
  • Resources are not cleaned up when resolving an image that is not yet present in the builder #50941
  • GraphQlWebMvcAutoConfiguration should apply customizers in order #50914
  • Auto-configured RedisMessageListenerContainer does not use virtual threads when spring.threads.virtual.enabled is true #50884
  • Context refresh fails when using Actuator on Jersey without spring-boot-health #50872
  • Context refresh fails on Cloud Foundry when using Actuator without spring-boot-health #50871
  • IllegalStateException when binding properties to a @Validated class that contains a map whose value type is a wildcard #50856
  • High number of connections due to Mongo health indicator #50852
  • Inconsistent handling of empty string values of spring.security.oauth2.resourceserver.jwt issuer-uri and jwk-set-uri #50849
  • Return type nullability of ApplicationContextAssert's getBean methods does not indicate that bean may be null #50845
  • PropertiesWebClientHttpServiceGroupConfigurer has highest precedence, preventing other configurers from being ordered ahead of it #50843
  • Exposing gRPC test server port should backoff if gRPC is not present #50825
  • JpaBaseConfiguration#entityManagerConfiguration can cause a dependency loop on beans declaring AsyncTaskExecutor #50801
  • spring.grpc.server.health.include-overall-health is not taken into account #50799
  • Setting 'server.servlet.session.cookie.partitioned' to false still emits the 'Partitioned' cookie attribute #50790
  • Managed version of Prometheus Client is not aligned with Micrometer's micrometer-registry-prometheus #50780
  • Map properties bound from empty strings fail with ConverterNotFoundException #50773
  • Protobuf Common Protos should not be a managed dependency #50772
  • An application that depends on spring-boot-security-oauth2-resource-server may fail to start with a ClassNotFoundException when Reactor is on the classpath but WebFlux is not #50764
  • W3CHeaderParser's decoding is not compliant with RFC 3986 #50650

📔 Documentation

  • Description of spring.graphql.websocket.connection-init-timeout does not render correctly in the reference guide #51348
  • spring.profiles.group should have a 'spring-profile-name' hint provider #51284
  • Remove reference to removed InfluxDB auto-configuration #51176
  • Use JacksonJsonSerde in Kafka Streams documentation #51161
  • Document alternatives to HttpMessageConverters #51129
  • Fix stale type reference for OTLP logging transport metadata #51119
  • Metadata for spring.test.mockmvc.htmlunit.url declares the wrong type #51115

... (truncated)

Commits
  • 6fdf67e Release 4.1.1
  • fde599b Upgrade to Spring Pulsar 2.0.7
  • 9daa58f Upgrade to Spring HATEOAS 3.1.2
  • 353993e Upgrade to Spring Data Bom 2026.0.1
  • 24ba596 Upgrade to Spring Session 4.1.1
  • 5cb5c29 Upgrade to Spring Security 7.1.1
  • 4adc8eb Upgrade to Spring LDAP 4.1.1
  • 4d9c19c Upgrade to Spring Kafka 4.1.1
  • f30f612 Upgrade to Spring Integration 7.1.1
  • b930283 Upgrade to Spring gRPC 1.1.1
  • Additional commits viewable in compare view

Updates org.springframework.boot:spring-boot-test from 4.1.0 to 4.1.1

Release notes

Sourced from org.springframework.boot:spring-boot-test's releases.

v4.1.1

⚠️ Attention Required

  • Spring Boot's Gradle plugin no longer automatically configures gRPC when the Protobuf plugin is applied. This behavior caused problems for those using Protobuf without gRPC. To opt in to the configuration of gRPC, configure the protobuf extension with the grpc plugin using an empty block. The Spring Boot Gradle plugin will then automatically configure the use of protoc-gen-grpc-java as before. #50822

🐞 Bug Fixes

  • Kafka consumer-specific security protocol is not taken into account #51369
  • Structured logging: a failed JSON encode corrupts the next log event written on the same thread #51156
  • Micrometer registries pin the application context #51135
  • Temporary file is not deleted when ExportedImageTar construction fails #51132
  • Metadata annotation processor ignores getter-level @NestedConfigurationProperty for records #51098
  • spring-boot-h2-console pulls servlet-api as transitive dependency #51095
  • PropertiesLauncher does not log nested archive paths #51089
  • Methods that return the result of Map#remove are not declared with a @Nullable return type #51087
  • NativeImageResourceProvider flattens Flyway migration paths in subdirectories #50964
  • Fix ordering of Kotlinx Serialization CodecCustomizer #50961
  • JarFile is not closed when finding main class from archive #50959
  • Application-managed JUL bridge handler should only be removed if installed #50950
  • CloudFoundry reactive auto-configuration should not require a WebClient.Builder bean to be defined #50944
  • Context refresh fails on reactive Cloud Foundry when using Actuator without spring-boot-health #50942
  • Resources are not cleaned up when resolving an image that is not yet present in the builder #50941
  • GraphQlWebMvcAutoConfiguration should apply customizers in order #50914
  • Auto-configured RedisMessageListenerContainer does not use virtual threads when spring.threads.virtual.enabled is true #50884
  • Context refresh fails when using Actuator on Jersey without spring-boot-health #50872
  • Context refresh fails on Cloud Foundry when using Actuator without spring-boot-health #50871
  • IllegalStateException when binding properties to a @Validated class that contains a map whose value type is a wildcard #50856
  • High number of connections due to Mongo health indicator #50852
  • Inconsistent handling of empty string values of spring.security.oauth2.resourceserver.jwt issuer-uri and jwk-set-uri #50849
  • Return type nullability of ApplicationContextAssert's getBean methods does not indicate that bean may be null #50845
  • PropertiesWebClientHttpServiceGroupConfigurer has highest precedence, preventing other configurers from being ordered ahead of it #50843
  • Exposing gRPC test server port should backoff if gRPC is not present #50825
  • JpaBaseConfiguration#entityManagerConfiguration can cause a dependency loop on beans declaring AsyncTaskExecutor #50801
  • spring.grpc.server.health.include-overall-health is not taken into account #50799
  • Setting 'server.servlet.session.cookie.partitioned' to false still emits the 'Partitioned' cookie attribute #50790
  • Managed version of Prometheus Client is not aligned with Micrometer's micrometer-registry-prometheus #50780
  • Map properties bound from empty strings fail with ConverterNotFoundException #50773
  • Protobuf Common Protos should not be a managed dependency #50772
  • An application that depends on spring-boot-security-oauth2-resource-server may fail to start with a ClassNotFoundException when Reactor is on the classpath but WebFlux is not #50764
  • W3CHeaderParser's decoding is not compliant with RFC 3986 #50650

📔 Documentation

  • Description of spring.graphql.websocket.connection-init-timeout does not render correctly in the reference guide #51348
  • spring.profiles.group should have a 'spring-profile-name' hint provider #51284
  • Remove reference to removed InfluxDB auto-configuration #51176
  • Use JacksonJsonSerde in Kafka Streams documentation #51161
  • Document alternatives to HttpMessageConverters #51129
  • Fix stale type reference for OTLP logging transport metadata #51119
  • Metadata for spring.test.mockmvc.htmlunit.url declares the wrong type #51115

... (truncated)

Commits
  • 6fdf67e Release 4.1.1
  • fde599b Upgrade to Spring Pulsar 2.0.7
  • 9daa58f Upgrade to Spring HATEOAS 3.1.2
  • 353993e Upgrade to Spring Data Bom 2026.0.1
  • 24ba596 Upgrade to Spring Session 4.1.1
  • 5cb5c29 Upgrade to Spring Security 7.1.1
  • 4adc8eb Upgrade to Spring LDAP 4.1.1
  • 4d9c19c Upgrade to Spring Kafka 4.1.1
  • f30f612 Upgrade to Spring Integration 7.1.1
  • b930283 Upgrade to Spring gRPC 1.1.1
  • Additional commits viewable in compare view

Updates org.springframework:spring-core from 7.0.8 to 7.0.9

Release notes

Sourced from org.springframework:spring-core's releases.

v7.0.9

⚠️ Attention Required

  • In Spring Framework 7.0.9, ForwardedHeaderFilter (Spring MVC) and ForwardedHeaderTransformer (WebFlux) each provide a boolean constructor argument whether to use the standard "Forwarded" header or the "X-Forwarded" alternative headers. A separate property turns on and off use of "X-Forwarded-Prefix". While the default constructor preserves the existing behavior, we recommend to use the new constructor to explicitly specify which forwarded headers to use to make the processing more deterministic and aligned with what is expected from the proxy. Please, see the updated Security Considerations section for details. In 7.1 with #37072 the default constructor is deprecated and marked for removal. #37090
  • In Spring Framework 7.0.9, SimpleEvaluationContext no longer supports expression compilation by default, regardless of the compiler mode configured via SpelParserConfiguration or the spring.expression.compiler.mode system property or Spring property. Applications that intentionally use SimpleEvaluationContext with trusted expressions and require compilation for performance reasons can opt in by calling withCompilationSupported() on the SimpleEvaluationContext builder. Care should be taken when opting in to compilation, as doing so removes the safety guards applied during interpreted evaluation. #37035

⭐ New Features

  • Ignore an empty port value in URI parsing #37117
  • Avoid retaining class files in annotation metadata #37112
  • Add @Nullable annotations when treating Map.remove() as returning @Nullable #37067
  • Revisit SSE view fragments handling #37061
  • Check list index after auto-grow in AbstractNestablePropertyAccessor #37036
  • Disable SpEL expression compilation by default in SimpleEvaluationContext #37035
  • Limit result size of BigDecimal/BigInteger power operations in SpEL #37034
  • Refactor redirect handling in UrlHandlerFilter #37030
  • Revise stylesheet source handling in XsltView #37029
  • Revise view name handling in UrlFilenameViewController #37027
  • Handle pre-flight requests in functional endpoint setup without DispatcherHandler #37024
  • Improve WebSocket handshake error logging #37023
  • Fix missing nullability in JdbcTemplate.batchUpdate #37012
  • Timeout property in RetryPolicy does not have a default constant #36983
  • Write native configuration files as UTF-8 #36972
  • DefaultServerRequest.ServletParametersMap.entrySet() does not retain HttpServletRequest.getParameterMap() order #36966
  • Perform nextKey within synchronization for SQLite as well #36959
  • Add support for custom ObjectInputFilter on DefaultDeserializer #36958
  • Revise resource bundle caching for common locales #36957
  • Improve nullability for getSession(*) in MockHttpServletRequest #36926
  • Improve fallback logic in ParameterContentNegotiationStrategy and ParameterContentTypeResolver #36925
  • Improve ambiguous match check on preflight request #36903
  • Improve Groovy markup template loading #36902
  • Improve request path handling on a Reactor Netty server #36893
  • Improve JettyWebSocketSession error handling #36891

🐞 Bug Fixes

  • EclipseLinkJpaDialect singleton lock in EclipseLinkConnectionHandle.getConnection() serializes all JDBC connection acquisitions under load #37085
  • MetadataReader fails to read byte[] array from annotation #37083
  • Ensure parsing/tostring symmetry in ContentDisposition #37064
  • Character outside of permitted range in Content Disposition #37062
  • Release Jackson BufferRecycler to its pool in encoders #37059
  • Ensure consistent error escaping #37055
  • Refine template name processing #37054
  • Reset TwoByteMatcher partial match on mismatching byte #37053
  • Refactor async XML parsing limit checks #37031
  • Fix part constraint checks in PartEventHttpMessageReader #37028
  • Fix buffer leak in RSocket SETUP frame handling #37026
  • Ensure correct Jetty core response cookie handling #37025
  • Align domainToAscii with current WhatWG spec #37018
  • Ensure consistent ButtonTag value attribute processing #37017

... (truncated)

Commits
  • 82a6b40 Release Spring Framework 7.0.9
  • a7b1b59 Upgrade to Reactor 2025.0.7
  • 996e3d3 Upgrade to Micrometer 1.16.7
  • 73f5ddd Refactor maxInMemory limit handling for async XML parsing
  • 675f25d Leading slash handling in UrlHandlerFilter
  • 692dbc9 Apply ResourceHandlerUtils checks in XsltView
  • 8647e90 Consistent maxPartSize check in PartEventHttpMessageReader
  • b9379e3 Check viewName for special prefixes in UrlFilenameViewController
  • a784dbe Ensure Payload release on early error in createHeaders
  • 3b492f3 Return sameSite cookie value in Jetty response
  • Additional commits viewable in compare view

Updates org.springframework:spring-aop from 7.0.8 to 7.0.9

Release notes

Sourced from org.springframework:spring-aop's releases.

v7.0.9

⚠️ Attention Required

  • In Spring Framework 7.0.9, ForwardedHeaderFilter (Spring MVC) and ForwardedHeaderTransformer (WebFlux) each provide a boolean constructor argument whether to use the standard "Forwarded" header or the "X-Forwarded" alternative headers. A separate property turns on and off use of "X-Forwarded-Prefix". While the default constructor preserves the existing behavior, we recommend to use the new constructor to explicitly specify which forwarded headers to use to make the processing more deterministic and aligned with what is expected from the proxy. Please, see the updated Security Considerations section for details. In 7.1 with #37072 the default constructor is deprecated and marked for removal. #37090
  • In Spring Framework 7.0.9, SimpleEvaluationContext no longer supports expression compilation by default, regardless of the compiler mode configured via SpelParserConfiguration or the spring.expression.compiler.mode system property or Spring property. Applications that intentionally use SimpleEvaluationContext with trusted expressions and require compilation for performance reasons can opt in by calling withCompilationSupported() on the SimpleEvaluationContext builder. Care should be taken when opting in to compilation, as doing so removes the safety guards applied during interpreted evaluation. #37035

⭐ New Features

  • Ignore an empty port value in URI parsing #37117
  • Avoid retaining class files in annotation metadata #37112
  • Add @Nullable annotations when treating Map.remove() as returning @Nullable #37067
  • Revisit SSE view fragments handling #37061
  • Check list index after auto-grow in AbstractNestablePropertyAccessor #37036
  • Disable SpEL expression compilation by default in SimpleEvaluationContext #37035
  • Limit result size of BigDecimal/BigInteger power operations in SpEL #37034
  • Refactor redirect handling in UrlHandlerFilter #37030
  • Revise stylesheet source handling in XsltView #37029
  • Revise view name handling in UrlFilenameViewController #37027
  • Handle pre-flight requests in functional endpoint setup without DispatcherHandler #37024
  • Improve WebSocket handshake error logging #37023
  • Fix missing nullability in JdbcTemplate.batchUpdate #37012
  • Timeout property in RetryPolicy does not have a default constant #36983
  • Write native configuration files as UTF-8 #36972
  • DefaultServerRequest.ServletParametersMap.entrySet() does not retain HttpServletRequest.getParameterMap() order #36966
  • Perform nextKey within synchronization for SQLite as well #36959
  • Add support for custom ObjectInputFilter on DefaultDeserializer #36958
  • Revise resource bundle caching for common locales #36957
  • Improve nullability for getSession(*) in MockHttpServletRequest #36926
  • Improve fallback logic in ParameterContentNegotiationStrategy and ParameterContentTypeResolver #36925
  • Improve ambiguous match check on preflight request #36903
  • Improve Groovy markup template loading #36902
  • Improve request path handling on a Reactor Netty server #36893
  • Improve JettyWebSocketSession error handling #36891

🐞 Bug Fixes

  • EclipseLinkJpaDialect singleton lock in EclipseLinkConnectionHandle.getConnection() serializes all JDBC connection acquisitions under load #37085
  • MetadataReader fails to read byte[] array from annotation #37083
  • Ensure parsing/tostring symmetry in ContentDisposition #37064
  • Character outside of permitted range in Content Disposition #37062
  • Release Jackson BufferRecycler to its pool in encoders #37059
  • Ensure consistent error escaping #37055
  • Refine template name processing #37054
  • Reset TwoByteMatcher partial match on mismatching byte #37053
  • Refactor async XML parsing limit checks #37031
  • Fix part constraint checks in PartEventHttpMessageReader #37028
  • Fix buffer leak in RSocket SETUP frame handling #37026
  • Ensure correct Jetty core response cookie handling #37025
  • Align domainToAscii with current WhatWG spec #37018
  • Ensure consistent ButtonTag value attribute processing #37017

... (truncated)

Commits
  • 82a6b40 Release Spring Framework 7.0.9
  • a7b1b59 Upgrade to Reactor 2025.0.7
  • 996e3d3 Upgrade to Micrometer 1.16.7
  • 73f5ddd Refactor maxInMemory limit handling for async XML parsing
  • 675f25d Leading slash handling in UrlHandlerFilter
  • 692dbc9 Apply ResourceHandlerUtils checks in XsltView
  • 8647e90 Consistent maxPartSize check in PartEventHttpMessageReader
  • b9379e3 Check viewName for special prefixes in UrlFilenameViewController
  • a784dbe Ensure Payload release on early error in createHeaders

@dependabot
build(deps): bump the maven-dependencies group across 1 directory wit…
0d2a68a 
…h 18 updates

Bumps the maven-dependencies group with 18 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| software.amazon.awssdk:sts | `2.53.1` | `2.54.1` |
| software.amazon.awssdk:auth | `2.53.1` | `2.54.1` |
| software.amazon.awssdk:http-auth-aws | `2.53.1` | `2.54.1` |
| software.amazon.awssdk:http-auth-spi | `2.53.1` | `2.54.1` |
| software.amazon.awssdk:http-client-spi | `2.53.1` | `2.54.1` |
| software.amazon.awssdk:utils | `2.53.1` | `2.54.1` |
| [com.google.protobuf:protobuf-java](https://github.com/protocolbuffers/protobuf) | `4.35.1` | `4.36.0` |
| [org.springframework.boot:spring-boot](https://github.com/spring-projects/spring-boot) | `4.1.0` | `4.1.1` |
| [org.springframework.boot:spring-boot-autoconfigure](https://github.com/spring-projects/spring-boot) | `4.1.0` | `4.1.1` |
| [org.springframework.boot:spring-boot-actuator](https://github.com/spring-projects/spring-boot) | `4.1.0` | `4.1.1` |
| [org.springframework.boot:spring-boot-test](https://github.com/spring-projects/spring-boot) | `4.1.0` | `4.1.1` |
| [org.springframework:spring-core](https://github.com/spring-projects/spring-framework) | `7.0.8` | `7.0.9` |
| [org.springframework:spring-aop](https://github.com/spring-projects/spring-framework) | `7.0.8` | `7.0.9` |
| [org.springframework:spring-beans](https://github.com/spring-projects/spring-framework) | `7.0.8` | `7.0.9` |
| [org.springframework:spring-context](https://github.com/spring-projects/spring-framework) | `7.0.8` | `7.0.9` |
| [org.springframework:spring-expression](https://github.com/spring-projects/spring-framework) | `7.0.8` | `7.0.9` |
| [org.springframework:spring-test](https://github.com/spring-projects/spring-framework) | `7.0.8` | `7.0.9` |
| [com.diffplug.spotless:spotless-maven-plugin](https://github.com/diffplug/spotless) | `3.9.0` | `3.10.0` |



Updates `software.amazon.awssdk:sts` from 2.53.1 to 2.54.1

Updates `software.amazon.awssdk:auth` from 2.53.1 to 2.54.1

Updates `software.amazon.awssdk:http-auth-aws` from 2.53.1 to 2.54.1

Updates `software.amazon.awssdk:http-auth-spi` from 2.53.1 to 2.54.1

Updates `software.amazon.awssdk:http-client-spi` from 2.53.1 to 2.54.1

Updates `software.amazon.awssdk:utils` from 2.53.1 to 2.54.1

Updates `software.amazon.awssdk:auth` from 2.53.1 to 2.54.1

Updates `software.amazon.awssdk:http-auth-aws` from 2.53.1 to 2.54.1

Updates `software.amazon.awssdk:http-auth-spi` from 2.53.1 to 2.54.1

Updates `software.amazon.awssdk:http-client-spi` from 2.53.1 to 2.54.1

Updates `software.amazon.awssdk:utils` from 2.53.1 to 2.54.1

Updates `com.google.protobuf:protobuf-java` from 4.35.1 to 4.36.0
- [Release notes](https://github.com/protocolbuffers/protobuf/releases)
- [Commits](https://github.com/protocolbuffers/protobuf/commits)

Updates `org.springframework.boot:spring-boot` from 4.1.0 to 4.1.1
- [Release notes](https://github.com/spring-projects/spring-boot/releases)
- [Commits](spring-projects/spring-boot@v4.1.0...v4.1.1)

Updates `org.springframework.boot:spring-boot-autoconfigure` from 4.1.0 to 4.1.1
- [Release notes](https://github.com/spring-projects/spring-boot/releases)
- [Commits](spring-projects/spring-boot@v4.1.0...v4.1.1)

Updates `org.springframework.boot:spring-boot-actuator` from 4.1.0 to 4.1.1
- [Release notes](https://github.com/spring-projects/spring-boot/releases)
- [Commits](spring-projects/spring-boot@v4.1.0...v4.1.1)

Updates `org.springframework.boot:spring-boot-test` from 4.1.0 to 4.1.1
- [Release notes](https://github.com/spring-projects/spring-boot/releases)
- [Commits](spring-projects/spring-boot@v4.1.0...v4.1.1)

Updates `org.springframework:spring-core` from 7.0.8 to 7.0.9
- [Release notes](https://github.com/spring-projects/spring-framework/releases)
- [Commits](spring-projects/spring-framework@v7.0.8...v7.0.9)

Updates `org.springframework:spring-aop` from 7.0.8 to 7.0.9
- [Release notes](https://github.com/spring-projects/spring-framework/releases)
- [Commits](spring-projects/spring-framework@v7.0.8...v7.0.9)

Updates `org.springframework:spring-beans` from 7.0.8 to 7.0.9
- [Release notes](https://github.com/spring-projects/spring-framework/releases)
- [Commits](spring-projects/spring-framework@v7.0.8...v7.0.9)

Updates `org.springframework:spring-context` from 7.0.8 to 7.0.9
- [Release notes](https://github.com/spring-projects/spring-framework/releases)
- [Commits](spring-projects/spring-framework@v7.0.8...v7.0.9)

Updates `org.springframework:spring-expression` from 7.0.8 to 7.0.9
- [Release notes](https://github.com/spring-projects/spring-framework/releases)
- [Commits](spring-projects/spring-framework@v7.0.8...v7.0.9)

Updates `org.springframework:spring-test` from 7.0.8 to 7.0.9
- [Release notes](https://github.com/spring-projects/spring-framework/releases)
- [Commits](spring-projects/spring-framework@v7.0.8...v7.0.9)

Updates `org.springframework:spring-aop` from 7.0.8 to 7.0.9
- [Release notes](https://github.com/spring-projects/spring-framework/releases)
- [Commits](spring-projects/spring-framework@v7.0.8...v7.0.9)

Updates `org.springframework:spring-beans` from 7.0.8 to 7.0.9
- [Release notes](https://github.com/spring-projects/spring-framework/releases)
- [Commits](spring-projects/spring-framework@v7.0.8...v7.0.9)

Updates `org.springframework:spring-context` from 7.0.8 to 7.0.9
- [Release notes](https://github.com/spring-projects/spring-framework/releases)
- [Commits](spring-projects/spring-framework@v7.0.8...v7.0.9)

Updates `org.springframework:spring-expression` from 7.0.8 to 7.0.9
- [Release notes](https://github.com/spring-projects/spring-framework/releases)
- [Commits](spring-projects/spring-framework@v7.0.8...v7.0.9)

Updates `org.springframework.boot:spring-boot-autoconfigure` from 4.1.0 to 4.1.1
- [Release notes](https://github.com/spring-projects/spring-boot/releases)
- [Commits](spring-projects/spring-boot@v4.1.0...v4.1.1)

Updates `org.springframework.boot:spring-boot-actuator` from 4.1.0 to 4.1.1
- [Release notes](https://github.com/spring-projects/spring-boot/releases)
- [Commits](spring-projects/spring-boot@v4.1.0...v4.1.1)

Updates `org.springframework.boot:spring-boot-test` from 4.1.0 to 4.1.1
- [Release notes](https://github.com/spring-projects/spring-boot/releases)
- [Commits](spring-projects/spring-boot@v4.1.0...v4.1.1)

Updates `org.springframework:spring-test` from 7.0.8 to 7.0.9
- [Release notes](https://github.com/spring-projects/spring-framework/releases)
- [Commits](spring-projects/spring-framework@v7.0.8...v7.0.9)

Updates `com.diffplug.spotless:spotless-maven-plugin` from 3.9.0 to 3.10.0
- [Release notes](https://github.com/diffplug/spotless/releases)
- [Changelog](https://github.com/diffplug/spotless/blob/main/CHANGES.md)
- [Commits](diffplug/spotless@maven/3.9.0...maven/3.10.0)

---
updated-dependencies:
- dependency-name: software.amazon.awssdk:sts
  dependency-version: 2.54.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-dependencies
- dependency-name: software.amazon.awssdk:auth
  dependency-version: 2.54.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-dependencies
- dependency-name: software.amazon.awssdk:http-auth-aws
  dependency-version: 2.54.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-dependencies
- dependency-name: software.amazon.awssdk:http-auth-spi
  dependency-version: 2.54.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-dependencies
- dependency-name: software.amazon.awssdk:http-client-spi
  dependency-version: 2.54.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-dependencies
- dependency-name: software.amazon.awssdk:utils
  dependency-version: 2.54.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-dependencies
- dependency-name: software.amazon.awssdk:auth
  dependency-version: 2.54.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-dependencies
- dependency-name: software.amazon.awssdk:http-auth-aws
  dependency-version: 2.54.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-dependencies
- dependency-name: software.amazon.awssdk:http-auth-spi
  dependency-version: 2.54.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-dependencies
- dependency-name: software.amazon.awssdk:http-client-spi
  dependency-version: 2.54.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-dependencies
- dependency-name: software.amazon.awssdk:utils
  dependency-version: 2.54.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-dependencies
- dependency-name: com.google.protobuf:protobuf-java
  dependency-version: 4.36.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-dependencies
- dependency-name: org.springframework.boot:spring-boot
  dependency-version: 4.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-dependencies
- dependency-name: org.springframework.boot:spring-boot-autoconfigure
  dependency-version: 4.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-dependencies
- dependency-name: org.springframework.boot:spring-boot-actuator
  dependency-version: 4.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-dependencies
- dependency-name: org.springframework.boot:spring-boot-test
  dependency-version: 4.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-dependencies
- dependency-name: org.springframework:spring-core
  dependency-version: 7.0.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-dependencies
- dependency-name: org.springframework:spring-aop
  dependency-version: 7.0.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-dependencies
- dependency-name: org.springframework:spring-beans
  dependency-version: 7.0.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-dependencies
- dependency-name: org.springframework:spring-context
  dependency-version: 7.0.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-dependencies
- dependency-name: org.springframework:spring-expression
  dependency-version: 7.0.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-dependencies
- dependency-name: org.springframework:spring-test
  dependency-version: 7.0.9
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: maven-dependencies
- dependency-name: org.springframework:spring-aop
  dependency-version: 7.0.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-dependencies
- dependency-name: org.springframework:spring-beans
  dependency-version: 7.0.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-dependencies
- dependency-name: org.springframework:spring-context
  dependency-version: 7.0.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-dependencies
- dependency-name: org.springframework:spring-expression
  dependency-version: 7.0.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-dependencies
- dependency-name: org.springframework.boot:spring-boot-autoconfigure
  dependency-version: 4.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-dependencies
- dependency-name: org.springframework.boot:spring-boot-actuator
  dependency-version: 4.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-dependencies
- dependency-name: org.springframework.boot:spring-boot-test
  dependency-version: 4.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: maven-dependencies
- dependency-name: org.springframework:spring-test
  dependency-version: 7.0.9
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: maven-dependencies
- dependency-name: com.diffplug.spotless:spotless-maven-plugin
  dependency-version: 3.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: maven-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file java Pull requests that update Java code labels Aug 24, 2026
@kubernetes-prow

kubernetes-prow Bot commented Aug 24, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: dependabot[bot]
Once this PR has been reviewed and has the lgtm label, please assign brendandburns for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@kubernetes-prow kubernetes-prow Bot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Aug 24, 2026
@kubernetes-prow kubernetes-prow Bot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Aug 24, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@brendandburns brendandburns Awaiting requested review from brendandburns
@yue9944882 yue9944882 Awaiting requested review from yue9944882

Assignees

No one assigned

Labels

cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. dependencies Pull requests that update a dependency file java Pull requests that update Java code size/L Denotes a PR that changes 100-499 lines, ignoring generated files.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants