Skip to content

Upgrading org.springframework:spring-beans 6 to 7

Breaking6.2.19 → 7.0.10Breaking6Security19Platform1Deprecated3New335Changed179Fixed281Other152

Full comparisonBack to org.springframework:spring-beans
BreakingUpgrade verdict

6 breaking changes and a platform requirement change and 19 security fixes.

In plain terms
  • A restricted expression evaluation context no longer compiles expressions unless you explicitly ask for it, which is safer but may be slower for trusted expressions.
  • Simplifies TransactionalOperator.executeAndAwait by removing Optional from its signature.
  • The retry configuration attribute has a new name, so existing code using the old name must be updated.
  • Two web components that read proxy forwarding headers now let you state explicitly which header style your proxy uses, so behavior is more predictable.
Must act Top 5 of 29 that need code or config changes

org.springframework:spring-beans publishes an official migration guide for version 7. It covers more than the release notes do.

The official release notes and upgrade guide ↗

Installs 3 packages in all (was 2).

What you must change

Breaking6
SimpleEvaluationContext no longer supports expression compilation by default; opt in via withCompilationSupported().
SimpleEvaluationContextSpelParserConfigurationspring.expression.compiler.modewithCompilationSupported()
7.0.9GitHub ReleaseSummarizedView source
Simplifies TransactionalOperator.executeAndAwait by removing Optional from its signature.
TransactionalOperatorexecuteAndAwait
7.0.3GitHub ReleaseSummarizedView source
Renames maxAttempts to maxRetries in @Retryable and RetryPolicy.
@RetryableRetryPolicymaxAttemptsmaxRetries
7.0.0GitHub ReleaseSummarizedView source
ForwardedHeaderFilter and ForwardedHeaderTransformer add a boolean constructor argument to choose standard Forwarded or X-Forwarded headers.
ForwardedHeaderFilterForwardedHeaderTransformer
7.0.9GitHub ReleaseSummarizedView source
Changes ApiVersionConfigurer.setSupportedVersionPredicate() to return void instead of ApiVersionConfigurer.
ApiVersionConfigurer.setSupportedVersionPredicate()
7.0.7GitHub ReleaseSummarizedView source
Revises ApplicationContext#getId() nullability to non-null.
ApplicationContext#getId()
7.0.2GitHub ReleaseSummarizedView source
Security19
Limits result size of BigDecimal/BigInteger power operations in SpEL.
BigDecimalBigInteger
7.0.9GitHub ReleaseSummarizedView source
Documents security implications of evaluating untrusted SpEL expressions.
7.0.9GitHub ReleaseSummarizedView source
Fixes CVE-2026-41838, a predictable session ID issue in the WebSocket module.
7.0.8GitHub ReleaseSummarizedView source
Fixes CVE-2026-41839, a privilege escalation via session fixation in WebFlux.
7.0.8GitHub ReleaseSummarizedView source
Fixes CVE-2026-41840, a denial of service via multipart requests in WebFlux.
7.0.8GitHub ReleaseSummarizedView source
Fixes CVE-2026-41841, an information disclosure via static resource cache in Spring MVC and WebFlux.
7.0.8GitHub ReleaseSummarizedView source
Fixes CVE-2026-41842, a denial of service via versioned resources in Spring MVC and WebFlux.
7.0.8GitHub ReleaseSummarizedView source
Fixes CVE-2026-41843, a path traversal via versioned static resources in Spring MVC and WebFlux.
7.0.8GitHub ReleaseSummarizedView source
Fixes CVE-2026-41844, an open redirect in Spring MVC and WebFlux.
7.0.8GitHub ReleaseSummarizedView source
Fixes CVE-2026-41845, a cross-site scripting issue via JavaScriptUtils.
JavaScriptUtils
7.0.8GitHub ReleaseSummarizedView source
Fixes CVE-2026-41846, a cross-site scripting issue via JSP form tags.
7.0.8GitHub ReleaseSummarizedView source
Fixes CVE-2026-41848, a denial of service via AntPathMatcher.
AntPathMatcher
7.0.8GitHub ReleaseSummarizedView source
Fixes CVE-2026-41850, an algorithmic denial of service via SpEL expressions.
7.0.8GitHub ReleaseSummarizedView source
Fixes CVE-2026-41851, a denial of service via an unbounded cache in SpEL.
7.0.8GitHub ReleaseSummarizedView source
Fixes CVE-2026-41852, arbitrary method invocation in SpEL expressions.
7.0.8GitHub ReleaseSummarizedView source
Fixes CVE-2026-41853, multipart request smuggling in Spring MVC and WebFlux.
7.0.8GitHub ReleaseSummarizedView source
Fixes CVE-2026-41854, a server-side request forgery via UriComponentsBuilder.
UriComponentsBuilder
7.0.8GitHub ReleaseSummarizedView source
Fixes CVE-2026-41855, unsafe deserialization via Jackson JMS converters.
7.0.8GitHub ReleaseSummarizedView source
Warns against unsafe static resource locations in MVC and WebFlux.
7.0.8GitHub ReleaseSummarizedView source
Platform1
Fix Jetty multipart client support with Java 25.
7.0.0-RC2GitHub ReleaseOriginalView source

Deprecations to plan for

Deprecated3
Deprecates methodIdentification() in CacheAspectSupport for removal.
CacheAspectSupport.methodIdentification()
7.0.7GitHub ReleaseSummarizedView source
Deprecates PagedListHolder and PropertyComparator for removal.
PagedListHolderPropertyComparator
7.0.3GitHub ReleaseSummarizedView source
Notes that deprecated MockMvcClientHttpRequestFactory is required for tests with HTTP service interface proxy.
MockMvcClientHttpRequestFactory
7.0.3GitHub ReleaseSummarizedView source

API changes

Generated by DepDelta from published JVM bytecode. Not mixed with prose notes.

  • added: @interface BeanRegistrarDslMarker
  • added: class BeanRegistrarDsl implements BeanRegistrar
  • added: ctor BeanRegistrarDsl(Function1)
  • added: ctor BeanRegistrarDsl.SupplierContextDsl(BeanRegistry.SupplierContext, Environment)
  • added: field BeanRegistrarDsl.env: Environment
  • added: field BeanRegistrarDsl.registry: BeanRegistry
  • added: interface BeanRegistrar
  • added: interface BeanRegistry
  • added: interface BeanRegistry.Spec
  • added: interface BeanRegistry.SupplierContext
  • added: method BeanFactory.getBeanProvider(ParameterizedTypeReference): ObjectProvider
  • added: method BeanRegistrar.register(BeanRegistry, Environment): void
  • added: method BeanRegistrarDsl.SupplierContextDsl.getContext(): BeanRegistry.SupplierContext
  • added: method BeanRegistrarDsl.SupplierContextDsl.getEnv(): Environment
  • added: method BeanRegistrarDsl.getEnv(): Environment
  • added: method BeanRegistrarDsl.getRegistry(): BeanRegistry
  • added: method BeanRegistrarDsl.profile(String, Function1): void
  • added: method BeanRegistrarDsl.register(BeanRegistrar): void
  • added: method BeanRegistrarDsl.register(BeanRegistry, Environment): void
  • added: method BeanRegistrarDsl.registerAlias(String, String): void
  • added: method BeanRegistrarDsl.setEnv(Environment): void
  • added: method BeanRegistrarDsl.setRegistry(BeanRegistry): void
  • added: method BeanRegistry.Spec.backgroundInit(): BeanRegistry.Spec
  • added: method BeanRegistry.Spec.description(String): BeanRegistry.Spec
  • added: method BeanRegistry.Spec.fallback(): BeanRegistry.Spec
  • added: method BeanRegistry.Spec.infrastructure(): BeanRegistry.Spec
  • added: method BeanRegistry.Spec.lazyInit(): BeanRegistry.Spec
  • added: method BeanRegistry.Spec.notAutowirable(): BeanRegistry.Spec
  • added: method BeanRegistry.Spec.order(int): BeanRegistry.Spec
  • added: method BeanRegistry.Spec.primary(): BeanRegistry.Spec
  • added: method BeanRegistry.Spec.prototype(): BeanRegistry.Spec
  • added: method BeanRegistry.Spec.scope(String): BeanRegistry.Spec
  • added: method BeanRegistry.Spec.supplier(Function): BeanRegistry.Spec
  • added: method BeanRegistry.SupplierContext.bean(Class): Object
  • added: method BeanRegistry.SupplierContext.bean(ParameterizedTypeReference): Object
  • added: method BeanRegistry.SupplierContext.bean(String, Class): Object
  • added: method BeanRegistry.SupplierContext.beanProvider(Class): ObjectProvider
  • added: method BeanRegistry.SupplierContext.beanProvider(ParameterizedTypeReference): ObjectProvider
  • added: method BeanRegistry.register(BeanRegistrar): void
  • added: method BeanRegistry.registerAlias(String, String): void
  • added: method BeanRegistry.registerBean(Class): String
  • added: method BeanRegistry.registerBean(Class, Consumer): String
  • added: method BeanRegistry.registerBean(ParameterizedTypeReference): String
  • added: method BeanRegistry.registerBean(ParameterizedTypeReference, Consumer): String
  • added: method BeanRegistry.registerBean(String, Class): void
  • added: method BeanRegistry.registerBean(String, Class, Consumer): void
  • added: method BeanRegistry.registerBean(String, ParameterizedTypeReference): void
  • added: method BeanRegistry.registerBean(String, ParameterizedTypeReference, Consumer): void
  • added: method SmartFactoryBean.getObject(Class): Object
  • added: method SmartFactoryBean.supportsType(Class): boolean
  • added: static class BeanRegistrarDsl.SupplierContextDsl
  • removed: method BeanInstanceSupplier.withGenerator(ThrowingSupplier): BeanInstanceSupplier
  • removed: method BeanInstanceSupplier.withShortcuts(String[]): BeanInstanceSupplier
  • added: abstract class BeanDefinitionPropertyValueCodeGeneratorDelegates
  • added: ctor BeanDefinitionPropertyValueCodeGeneratorDelegates()
  • added: method BeanFactoryInitializationCode.getClassName(): ClassName
  • added: static field BeanDefinitionPropertyValueCodeGeneratorDelegates.INSTANCES: List
  • added: static method BeanDefinitionPropertyValueCodeGeneratorDelegates.createValueCodeGenerator(GeneratedMethods, List): ValueCodeGenerator
  • added: ctor RuntimeBeanReference(String, Class)
  • added: ctor RuntimeBeanReference(String, Class, boolean)
  • added: method YamlProcessor.getFlattenedMap(Map, boolean, Object): Map
  • removed: static method SimpleInstantiationStrategy.setCurrentlyInvokedFactoryMethod(Method): void
  • changed: method AbstractAutowireCapableBeanFactory.getObjectForBeanInstance(Object, String, String, RootBeanDefinition): Object → method AbstractAutowireCapableBeanFactory.getObjectForBeanInstance(Object, Class, String, String, RootBeanDefinition): Object
  • changed: method AbstractBeanFactory.getObjectForBeanInstance(Object, String, String, RootBeanDefinition): Object → method AbstractBeanFactory.getObjectForBeanInstance(Object, Class, String, String, RootBeanDefinition): Object
  • changed: method FactoryBeanRegistrySupport.getObjectFromFactoryBean(FactoryBean, String, boolean): Object → method FactoryBeanRegistrySupport.getObjectFromFactoryBean(FactoryBean, Class, String, boolean): Object
  • added: class BeanRegistryAdapter implements BeanRegistry
  • added: ctor BeanRegistryAdapter(BeanDefinitionRegistry, ListableBeanFactory, Environment, Class)
  • added: ctor BeanRegistryAdapter(BeanDefinitionRegistry, ListableBeanFactory, Environment, Class, MultiValueMap)
  • added: ctor BeanRegistryAdapter(DefaultListableBeanFactory, Environment, Class)
  • added: method BeanRegistryAdapter.register(BeanRegistrar): void
  • added: method BeanRegistryAdapter.registerAlias(String, String): void
  • added: method BeanRegistryAdapter.registerBean(Class): String
  • added: method BeanRegistryAdapter.registerBean(Class, Consumer): String
  • added: method BeanRegistryAdapter.registerBean(ParameterizedTypeReference): String
  • added: method BeanRegistryAdapter.registerBean(ParameterizedTypeReference, Consumer): String
  • added: method BeanRegistryAdapter.registerBean(String, Class): void
  • added: method BeanRegistryAdapter.registerBean(String, Class, Consumer): void
  • added: method BeanRegistryAdapter.registerBean(String, ParameterizedTypeReference): void
  • added: method BeanRegistryAdapter.registerBean(String, ParameterizedTypeReference, Consumer): void
  • added: method DefaultListableBeanFactory.getBeanProvider(ParameterizedTypeReference): ObjectProvider
  • added: method DefaultListableBeanFactory.getOrder(String): int
  • added: method DefaultListableBeanFactory.getOrder(String, Object): int
  • added: method StaticListableBeanFactory.getBeanProvider(ParameterizedTypeReference): ObjectProvider