Upgrading org.springframework:spring-context-support 5 to 6
Breaking5.3.39 → 6.2.19Breaking9Security16Platform4Deprecated14New229Changed354Fixed940Other477
SecurityFixes CVE-2026-41838, a predictable session ID issue in the WebSocket module.CVE-2026-41838 ↗
BreakingUpgrade verdict
9 breaking changes and 4 platform requirement changes and 16 security fixes.
In plain terms
- XML configurations using the jibx-marshaller element in the Spring OXM schema will no longer validate.
- BeanOverrideProcessor is no longer marked as a functional interface, so it can no longer be used as a lambda target.
- The pure attribute is no longer available on the @Contract annotation.
- Renames aopAvailable constants in TransactionSynchronizationUtils for better GraalVM native image support.
Must act Top 5 of 43 that need code or config changes
org.springframework:spring-context-support publishes an official migration guide for version 6. It covers more than the release notes do.
Upgrading to Spring Framework 6.x ↗Installs 8 packages in all (was 6).
What you must change
Breaking9
Removes the jibx-marshaller element from spring-oxm.xsd.
jibx-marshallerspring-oxm.xsdRemoves the @FunctionalInterface declaration from BeanOverrideProcessor.
BeanOverrideProcessor@FunctionalInterfaceRemoves the pure attribute from @Contract.
@ContractRenames aopAvailable constants in TransactionSynchronizationUtils for better GraalVM native image support.
TransactionSynchronizationUtilsaopAvailableSpring Web RestTemplate
http.client.requests metrics no longer have the client.name tag.RestTemplatehttp.client.requestsclient.nameRejects @RequestMapping and @HttpExchange declarations on the same element.
@RequestMapping@HttpExchangeRejects multiple @HttpExchange declarations on the same element.
@HttpExchangeMakes the DefaultGenerationContext(DefaultGenerationContext, String) constructor protected.
DefaultGenerationContextChanges InvocableHandlerMethod#invokeSuspendingFunction return type to Object.
InvocableHandlerMethod#invokeSuspendingFunctionSecurity16
Fixes CVE-2026-41838, a predictable session ID issue in the WebSocket module.
Fixes CVE-2026-41839, a privilege escalation via session fixation in WebFlux.
Fixes CVE-2026-41840, a denial of service via multipart requests in WebFlux.
Fixes CVE-2026-41841, an information disclosure via static resource cache in Spring MVC and WebFlux.
Fixes CVE-2026-41842, a denial of service via versioned resources in Spring MVC and WebFlux.
Fixes CVE-2026-41843, a path traversal via versioned static resources in Spring MVC and WebFlux.
Fixes CVE-2026-41844, an open redirect in Spring MVC and WebFlux.
Fixes CVE-2026-41845, a cross-site scripting issue via JavaScriptUtils.
JavaScriptUtilsFixes CVE-2026-41846, a cross-site scripting issue via JSP form tags.
Fixes CVE-2026-41848, a denial of service via AntPathMatcher.
AntPathMatcherFixes CVE-2026-41850, an algorithmic denial of service via SpEL expressions.
Fixes CVE-2026-41851, a denial of service via an unbounded cache in SpEL.
Fixes CVE-2026-41852, arbitrary method invocation in SpEL expressions.
Fixes CVE-2026-41853, multipart request smuggling in Spring MVC and WebFlux.
Fixes CVE-2026-41854, a server-side request forgery via UriComponentsBuilder.
UriComponentsBuilderFixes CVE-2026-41855, unsafe deserialization via Jackson JMS converters.
Platform4
Upgrades to ASM 9.8 for early Java 25 support.
ASMUpgrades to ASM 9.7.1 for early Java 24 support.
ASMAdds early support for Java 23.
Adds early support for JDK 21.
Deprecations to plan for
Deprecated14
Adds missing @Deprecated(forRemoval = true) markers for APIs deleted in 7.0.
@DeprecatedDeprecates methodIdentification() in CacheAspectSupport for removal.
CacheAspectSupportmethodIdentification()Deprecates setConnectTimeout on HttpComponentsClientHttpRequestFactory.
HttpComponentsClientHttpRequestFactorysetConnectTimeoutIntroduces isAutowirableConstructor(Executable, PropertyProvider) in TestConstructorUtils and deprecates existing variants.
TestConstructorUtilsisAutowirableConstructor(Executable, PropertyProvider)Deprecates the rowsExpected property of SqlQuery for removal.
SqlQueryrowsExpectedDeprecates and removes use of UrlPathHelper in ServletWebSocketHandlerRegistry.
UrlPathHelperServletWebSocketHandlerRegistryDeprecates exchangeTimeout and refactors readTimeout in ReactorClientHttpRequestFactory.
ReactorClientHttpRequestFactoryexchangeTimeoutreadTimeoutDeprecates the RootBeanDefinition(ResolvableType) constructor.
RootBeanDefinitionDeprecates the obsolete
ConcurrentExecutorAdapter for removal in 6.1.ConcurrentExecutorAdapterDeprecates HttpStatus 103 CHECKPOINT in favor of the new EARLY_HINTS.
HttpStatusCHECKPOINTEARLY_HINTSDeprecates Base64Utils.
Base64UtilsDeprecates the application/graphql+json media type after spec changes.
application/graphql+jsonDeprecates JettyWebSocketClient in favor of StandardWebSocketClient.
JettyWebSocketClientStandardWebSocketClientDeprecates LocalVariableTableParameterNameDiscoverer completely, avoiding its exposure in native images.
LocalVariableTableParameterNameDiscovererAPI changes
Generated by DepDelta from published JVM bytecode. Not mixed with prose notes.
- added:
ctor CaffeineCache(String, AsyncCache, boolean) - added:
method CaffeineCache.getAsyncCache(): AsyncCache - added:
method CaffeineCache.retrieve(Object): CompletableFuture - added:
method CaffeineCache.retrieve(Object, Supplier): CompletableFuture - added:
method CaffeineCacheManager.adaptCaffeineCache(String, AsyncCache): Cache - added:
method CaffeineCacheManager.createAsyncCaffeineCache(String): AsyncCache - added:
method CaffeineCacheManager.registerCustomCache(String, AsyncCache): void - added:
method CaffeineCacheManager.removeCache(String): void - added:
method CaffeineCacheManager.resetCaches(): void - added:
method CaffeineCacheManager.setAsyncCacheLoader(AsyncCacheLoader): void - added:
method CaffeineCacheManager.setAsyncCacheMode(boolean): void
- removed:
abstract class EhCacheManagerUtils - removed:
class EhCacheCache implements Cache - removed:
class EhCacheCacheManager extends AbstractTransactionSupportingCacheManager - removed:
class EhCacheFactoryBean extends CacheConfiguration implements FactoryBean, BeanNameAware, InitializingBean - removed:
class EhCacheManagerFactoryBean implements FactoryBean, InitializingBean, DisposableBean - removed:
ctor EhCacheCache(Ehcache) - removed:
ctor EhCacheCacheManager() - removed:
ctor EhCacheCacheManager(CacheManager) - removed:
ctor EhCacheFactoryBean() - removed:
ctor EhCacheManagerFactoryBean() - removed:
ctor EhCacheManagerUtils() - removed:
field EhCacheFactoryBean.logger: Log - removed:
field EhCacheManagerFactoryBean.logger: Log - removed:
method EhCacheCache.clear(): void - removed:
method EhCacheCache.evict(Object): void - removed:
method EhCacheCache.evictIfPresent(Object): boolean - removed:
method EhCacheCache.get(Object): Cache.ValueWrapper - removed:
method EhCacheCache.get(Object, Callable): Object - removed:
method EhCacheCache.get(Object, Class): Object - removed:
method EhCacheCache.getName(): String - removed:
method EhCacheCache.getNativeCache(): Ehcache - removed:
method EhCacheCache.invalidate(): boolean - removed:
method EhCacheCache.put(Object, Object): void - removed:
method EhCacheCache.putIfAbsent(Object, Object): Cache.ValueWrapper - removed:
method EhCacheCacheManager.afterPropertiesSet(): void - removed:
method EhCacheCacheManager.getCacheManager(): CacheManager - removed:
method EhCacheCacheManager.getMissingCache(String): Cache - removed:
method EhCacheCacheManager.loadCaches(): Collection - removed:
method EhCacheCacheManager.setCacheManager(CacheManager): void - removed:
method EhCacheFactoryBean.afterPropertiesSet(): void - removed:
method EhCacheFactoryBean.createCache(): Cache - removed:
method EhCacheFactoryBean.decorateCache(Ehcache): Ehcache - removed:
method EhCacheFactoryBean.getObject(): Ehcache - removed:
method EhCacheFactoryBean.getObjectType(): Class - removed:
method EhCacheFactoryBean.isSingleton(): boolean - removed:
method EhCacheFactoryBean.setBeanName(String): void - removed:
method EhCacheFactoryBean.setBlocking(boolean): void - removed:
method EhCacheFactoryBean.setBootstrapCacheLoader(BootstrapCacheLoader): void - removed:
method EhCacheFactoryBean.setCacheEntryFactory(CacheEntryFactory): void - removed:
method EhCacheFactoryBean.setCacheEventListeners(Set): void - removed:
method EhCacheFactoryBean.setCacheManager(CacheManager): void - removed:
method EhCacheFactoryBean.setCacheName(String): void - removed:
method EhCacheFactoryBean.setDisabled(boolean): void - removed:
method EhCacheFactoryBean.setDiskSpoolBufferSize(int): void - removed:
method EhCacheFactoryBean.setTimeToIdle(int): void - removed:
method EhCacheFactoryBean.setTimeToLive(int): void - removed:
method EhCacheManagerFactoryBean.afterPropertiesSet(): void - removed:
method EhCacheManagerFactoryBean.destroy(): void - removed:
method EhCacheManagerFactoryBean.getObject(): CacheManager - removed:
method EhCacheManagerFactoryBean.getObjectType(): Class - removed:
method EhCacheManagerFactoryBean.isSingleton(): boolean - removed:
method EhCacheManagerFactoryBean.setAcceptExisting(boolean): void - removed:
method EhCacheManagerFactoryBean.setCacheManagerName(String): void - removed:
method EhCacheManagerFactoryBean.setConfigLocation(Resource): void - removed:
method EhCacheManagerFactoryBean.setShared(boolean): void - removed:
static method EhCacheManagerUtils.buildCacheManager(): CacheManager - removed:
static method EhCacheManagerUtils.buildCacheManager(Resource): CacheManager - removed:
static method EhCacheManagerUtils.buildCacheManager(String): CacheManager - removed:
static method EhCacheManagerUtils.buildCacheManager(String, Resource): CacheManager - removed:
static method EhCacheManagerUtils.parseConfiguration(Resource): Configuration
- removed:
abstract class JCacheOperationSourcePointcut extends StaticMethodMatcherPointcut implements Serializable - removed:
ctor JCacheOperationSourcePointcut() - removed:
method JCacheOperationSourcePointcut.equals(Object): boolean - removed:
method JCacheOperationSourcePointcut.getCacheOperationSource(): JCacheOperationSource - removed:
method JCacheOperationSourcePointcut.hashCode(): int - removed:
method JCacheOperationSourcePointcut.matches(Method, Class): boolean - removed:
method JCacheOperationSourcePointcut.toString(): String - added:
method AbstractFallbackJCacheOperationSource.hasCacheOperation(Method, Class): boolean - added:
method AnnotationJCacheOperationSource.isCandidateClass(Class): boolean - added:
method JCacheOperationSource.hasCacheOperation(Method, Class): boolean - added:
method JCacheOperationSource.isCandidateClass(Class): boolean
- added:
method TransactionAwareCacheDecorator.retrieve(Object): CompletableFuture - added:
method TransactionAwareCacheDecorator.retrieve(Object, Supplier): CompletableFuture
- removed:
method JavaMailSenderImpl.send(MimeMessage): void - removed:
method JavaMailSenderImpl.send(MimeMessagePreparator): void - removed:
method JavaMailSenderImpl.send(MimeMessagePreparator[]): void - removed:
method JavaMailSenderImpl.send(SimpleMailMessage): void - added:
method MimeMessageHelper.addInline(String, String, DataSource): void - added:
method MimeMessageHelper.addInline(String, String, InputStreamSource): void - added:
method MimeMessageHelper.addInline(String, String, InputStreamSource, String): void
- removed:
abstract class TimerManagerAccessor extends JndiLocatorSupport implements InitializingBean, DisposableBean, Lifecycle - removed:
class DelegatingTimerListener implements TimerListener - removed:
class DelegatingWork implements Work - removed:
class ScheduledTimerListener - removed:
class TimerManagerFactoryBean extends TimerManagerAccessor implements FactoryBean, InitializingBean, DisposableBean, Lifecycle - removed:
class TimerManagerTaskScheduler extends TimerManagerAccessor implements TaskScheduler - removed:
class WorkManagerTaskExecutor extends JndiLocatorSupport implements AsyncListenableTaskExecutor, SchedulingTaskExecutor, WorkManager, InitializingBean - removed:
ctor DelegatingTimerListener(Runnable) - removed:
ctor DelegatingWork(Runnable) - removed:
ctor ScheduledTimerListener() - removed:
ctor ScheduledTimerListener(Runnable) - removed:
ctor ScheduledTimerListener(Runnable, long) - removed:
ctor ScheduledTimerListener(Runnable, long, long, boolean) - removed:
ctor ScheduledTimerListener(TimerListener) - removed:
ctor ScheduledTimerListener(TimerListener, long) - removed:
ctor ScheduledTimerListener(TimerListener, long, long, boolean) - removed:
ctor TimerManagerAccessor() - removed:
ctor TimerManagerFactoryBean() - removed:
ctor TimerManagerTaskScheduler() - removed:
ctor WorkManagerTaskExecutor() - removed:
method DelegatingTimerListener.timerExpired(Timer): void - removed:
method DelegatingWork.getDelegate(): Runnable - removed:
method DelegatingWork.isDaemon(): boolean - removed:
method DelegatingWork.release(): void - removed:
method DelegatingWork.run(): void - removed:
method ScheduledTimerListener.getDelay(): long - removed:
method ScheduledTimerListener.getPeriod(): long - removed:
method ScheduledTimerListener.getTimerListener(): TimerListener - removed:
method ScheduledTimerListener.isFixedRate(): boolean - removed:
method ScheduledTimerListener.isOneTimeTask(): boolean - removed:
method ScheduledTimerListener.setDelay(long): void - removed:
method ScheduledTimerListener.setFixedRate(boolean): void - removed:
method ScheduledTimerListener.setPeriod(long): void - removed:
method ScheduledTimerListener.setRunnable(Runnable): void - removed:
method ScheduledTimerListener.setTimerListener(TimerListener): void - removed:
method TimerManagerAccessor.afterPropertiesSet(): void - removed:
method TimerManagerAccessor.destroy(): void - removed:
method TimerManagerAccessor.getTimerManager(): TimerManager - removed:
method TimerManagerAccessor.isRunning(): boolean - removed:
method TimerManagerAccessor.obtainTimerManager(): TimerManager - removed:
method TimerManagerAccessor.setShared(boolean): void - removed:
method TimerManagerAccessor.setTimerManager(TimerManager): void - removed:
method TimerManagerAccessor.setTimerManagerName(String): void - removed:
method TimerManagerAccessor.start(): void - removed:
method TimerManagerAccessor.stop(): void - removed:
method TimerManagerFactoryBean.afterPropertiesSet(): void - removed:
method TimerManagerFactoryBean.destroy(): void - removed:
method TimerManagerFactoryBean.getObject(): TimerManager - removed:
method TimerManagerFactoryBean.getObjectType(): Class - removed:
method TimerManagerFactoryBean.isSingleton(): boolean - removed:
method TimerManagerFactoryBean.setScheduledTimerListeners(ScheduledTimerListener[]): void - removed:
method TimerManagerTaskScheduler.schedule(Runnable, Date): ScheduledFuture - removed:
method TimerManagerTaskScheduler.schedule(Runnable, Trigger): ScheduledFuture - removed:
method TimerManagerTaskScheduler.scheduleAtFixedRate(Runnable, Date, long): ScheduledFuture - removed:
method TimerManagerTaskScheduler.scheduleAtFixedRate(Runnable, long): ScheduledFuture - removed:
method TimerManagerTaskScheduler.scheduleWithFixedDelay(Runnable, Date, long): ScheduledFuture - removed:
method TimerManagerTaskScheduler.scheduleWithFixedDelay(Runnable, long): ScheduledFuture - removed:
method TimerManagerTaskScheduler.setErrorHandler(ErrorHandler): void - removed:
method WorkManagerTaskExecutor.afterPropertiesSet(): void - removed:
method WorkManagerTaskExecutor.execute(Runnable): void - removed:
method WorkManagerTaskExecutor.execute(Runnable, long): void - removed:
method WorkManagerTaskExecutor.schedule(Work): WorkItem - removed:
method WorkManagerTaskExecutor.schedule(Work, WorkListener): WorkItem - removed:
method WorkManagerTaskExecutor.setTaskDecorator(TaskDecorator): void - removed:
method WorkManagerTaskExecutor.setWorkListener(WorkListener): void - removed:
method WorkManagerTaskExecutor.setWorkManager(WorkManager): void - removed:
method WorkManagerTaskExecutor.setWorkManagerName(String): void - removed:
method WorkManagerTaskExecutor.submit(Callable): Future - removed:
method WorkManagerTaskExecutor.submit(Runnable): Future - removed:
method WorkManagerTaskExecutor.submitListenable(Callable): ListenableFuture - removed:
method WorkManagerTaskExecutor.submitListenable(Runnable): ListenableFuture - removed:
method WorkManagerTaskExecutor.waitForAll(Collection, long): boolean - removed:
method WorkManagerTaskExecutor.waitForAny(Collection, long): Collection
- removed:
method SimpleThreadPoolTaskExecutor.execute(Runnable, long): void
- added:
method FreeMarkerConfigurationFactory.setDefaultCharset(Charset): void