Skip to content

Upgrading org.springframework:spring-context-support 6 to 7

Breaking6.2.19 → 7.0.10Breaking24Security18Deprecated17New196Changed263Fixed303Other155

Full comparisonBack to org.springframework:spring-context-support
BreakingUpgrade verdict

24 breaking changes and 18 security fixes.

In plain terms
  • Two web filters that read proxy forwarding headers now let you explicitly choose which header style to trust. The old constructor still works as before, but the new one is recommended.
  • A safer expression evaluation context now skips compiling expressions unless you explicitly ask for it. Compiling can be faster but removes safety checks.
  • Simplifies TransactionalOperator.executeAndAwait by removing Optional from its signature.
  • Renames maxAttempts to maxRetries in @Retryable and RetryPolicy.
Must act Top 5 of 59 that need code or config changes

org.springframework:spring-context-support publishes an official migration guide for version 7. It covers more than the release notes do.

The official release notes and upgrade guide ↗

Installs 9 packages in all (was 8).

What you must change

Breaking24
ForwardedHeaderFilter and ForwardedHeaderTransformer add a boolean constructor argument to choose standard Forwarded or X-Forwarded headers; default constructor keeps existing behavior.
ForwardedHeaderFilterForwardedHeaderTransformer
7.0.9GitHub ReleaseSummarizedView source
SimpleEvaluationContext no longer supports expression compilation by default; opt in via withCompilationSupported() on the builder.
SimpleEvaluationContextSpelParserConfigurationspring.expression.compiler.modewithCompilationSupported()
7.0.9GitHub ReleaseSummarizedView source
Simplifies TransactionalOperator.executeAndAwait by removing Optional from its signature.
TransactionalOperatorexecuteAndAwait
7.0.3GitHub ReleaseSummarizedView source
Renames maxAttempts to maxRetries in @Retryable and RetryPolicy.
@RetryableRetryPolicymaxAttemptsmaxRetries
7.0.0GitHub ReleaseSummarizedView source
Removes the Hamcrest dependency from RestTestClient.
RestTestClient
7.0.0-RC3GitHub ReleaseSummarizedView source
Removes support for callable references in BeanRegistrarDsl.
BeanRegistrarDsl
7.0.0-RC3GitHub ReleaseSummarizedView source
Removes HttpServiceClient annotation support.
HttpServiceClient
7.0.0-M9GitHub ReleaseSummarizedView source
Removes maxDuration and maxElapsedTime support from RetryPolicy.
RetryPolicymaxDurationmaxElapsedTime
7.0.0-M7GitHub ReleaseSummarizedView source
Removes (String, String) variants of setProperty() and withProperty() from MockEnvironment.
MockEnvironmentsetProperty()withProperty()
7.0.0-M6GitHub ReleaseSummarizedView source
Removes support for Aware interfaces in BeanRegistrar.
AwareBeanRegistrar
7.0.0-M3GitHub ReleaseSummarizedView source
Removes the deprecated rowsExpected property of SqlQuery.
SqlQueryrowsExpected
7.0.0-M3GitHub ReleaseSummarizedView source
Removes convention-based annotation attribute override support.
7.0.0-M3GitHub ReleaseSummarizedView source
Removes Netty 5 support.
7.0.0-M2GitHub ReleaseSummarizedView source
Removes binary array name handling in ClassUtils.forName().
ClassUtils.forName()
7.0.0-M1GitHub ReleaseSummarizedView source
Remove path mapping options marked as deprecated for removal.
7.0.0-M1GitHub ReleaseSummarizedView source
ApiVersionConfigurer.setSupportedVersionPredicate() now returns void instead of ApiVersionConfigurer.
ApiVersionConfigurersetSupportedVersionPredicate()
7.0.7GitHub ReleaseSummarizedView source
Revises ApplicationContext#getId() nullability to non-null.
ApplicationContext#getId()
7.0.2GitHub ReleaseSummarizedView source
Changes canRead/canWrite overrides to Class ones in AbstractSmartHttpMessageConverter.
AbstractSmartHttpMessageConvertercanReadcanWrite
7.0.2GitHub ReleaseSummarizedView source
Makes RetryException#getCause non-nullable.
RetryExceptiongetCause
7.0.0-M9GitHub ReleaseSummarizedView source
Refines Jackson 3 constructors to accept only JsonMapper instances for JSON.
JsonMapper
7.0.0-M9GitHub ReleaseSummarizedView source
Replaces useRequestParam with useQueryParam in ApiVersionConfigurer to align with the client.
ApiVersionConfigureruseRequestParamuseQueryParam
7.0.0-M8GitHub ReleaseSummarizedView source
Migrates orm.hibernate5 to the orm.jpa.hibernate package for Hibernate ORM 7.0.
orm.hibernate5orm.jpa.hibernate
7.0.0-M7GitHub ReleaseSummarizedView source
Redesigns RetryPolicy to directly incorporate BackOff.
RetryPolicyBackOff
7.0.0-M7GitHub ReleaseSummarizedView source
Makes built-in RetryPolicy implementations final.
RetryPolicy
7.0.0-M7GitHub ReleaseSummarizedView source
Security18
Limits result size of BigDecimal/BigInteger power operations in SpEL.
BigDecimalBigInteger
7.0.9GitHub ReleaseSummarizedView source
Fixes CVE-2026-41838, a predictable session ID issue in the WebSocket module.
7.0.8GitHub ReleaseSummarizedView source
Fixes CVE-2026-41839, a privilege escalation via session fixation in WebFlux.
7.0.8GitHub ReleaseSummarizedView source
Fixes CVE-2026-41840, a denial of service via multipart requests in WebFlux.
7.0.8GitHub ReleaseSummarizedView source
Fixes CVE-2026-41841, an information disclosure via static resource cache in Spring MVC and WebFlux.
7.0.8GitHub ReleaseSummarizedView source
Fixes CVE-2026-41842, a denial of service via versioned resources in Spring MVC and WebFlux.
7.0.8GitHub ReleaseSummarizedView source
Fixes CVE-2026-41843, a path traversal via versioned static resources in Spring MVC and WebFlux.
7.0.8GitHub ReleaseSummarizedView source
Fixes CVE-2026-41844, an open redirect in Spring MVC and WebFlux.
7.0.8GitHub ReleaseSummarizedView source
Fixes CVE-2026-41845, a cross-site scripting issue via JavaScriptUtils.
JavaScriptUtils
7.0.8GitHub ReleaseSummarizedView source
Fixes CVE-2026-41846, a cross-site scripting issue via JSP form tags.
7.0.8GitHub ReleaseSummarizedView source
Fixes CVE-2026-41848, a denial of service via AntPathMatcher.
AntPathMatcher
7.0.8GitHub ReleaseSummarizedView source
Fixes CVE-2026-41850, an algorithmic denial of service via SpEL expressions.
7.0.8GitHub ReleaseSummarizedView source
Fixes CVE-2026-41851, a denial of service via an unbounded cache in SpEL.
7.0.8GitHub ReleaseSummarizedView source
Fixes CVE-2026-41852, arbitrary method invocation in SpEL expressions.
7.0.8GitHub ReleaseSummarizedView source
Fixes CVE-2026-41853, multipart request smuggling in Spring MVC and WebFlux.
7.0.8GitHub ReleaseSummarizedView source
Fixes CVE-2026-41854, a server-side request forgery via UriComponentsBuilder.
UriComponentsBuilder
7.0.8GitHub ReleaseSummarizedView source
Fixes CVE-2026-41855, unsafe deserialization via Jackson JMS converters.
7.0.8GitHub ReleaseSummarizedView source
Warns against unsafe static resource locations in MVC and WebFlux.
7.0.8GitHub ReleaseSummarizedView source

Deprecations to plan for

Deprecated17
Deprecates methodIdentification() in CacheAspectSupport for removal.
CacheAspectSupportmethodIdentification()
7.0.7GitHub ReleaseSummarizedView source
Deprecate PagedListHolder and PropertyComparator for removal.
PagedListHolderPropertyComparator
7.0.3GitHub ReleaseSummarizedView source
Deprecates MockMvcClientHttpRequestFactory, which is still required for tests with HTTP service interface proxy.
MockMvcClientHttpRequestFactory
7.0.3GitHub ReleaseSummarizedView source
Deprecates the BeanShell scripting support.
7.0.0-RC3GitHub ReleaseSummarizedView source
Deprecates the lang XML namespace.
lang
7.0.0-RC3GitHub ReleaseSummarizedView source
Deprecates Hamcrest methods in WebTestClient.
WebTestClient
7.0.0-RC3GitHub ReleaseSummarizedView source
Deprecates TransactionCallbackWithoutResult.
TransactionCallbackWithoutResult
7.0.0-RC1GitHub ReleaseSummarizedView source
Deprecates the org.springframework.web.servlet.view.document package.
org.springframework.web.servlet.view.document
7.0.0-RC1GitHub ReleaseSummarizedView source
Deprecates put(MergedContextConfiguration, ApplicationContext) in ContextCache.
ContextCacheput(MergedContextConfiguration, ApplicationContext)MergedContextConfigurationApplicationContext
7.0.0-M9GitHub ReleaseSummarizedView source
Deprecates the DaoSupport classes.
DaoSupport
7.0.0-M7GitHub ReleaseSummarizedView source
Deprecates PropertyPlaceholderConfigurer and PreferencesPlaceholderConfigurer for removal.
PropertyPlaceholderConfigurerPreferencesPlaceholderConfigurer
7.0.0-M5GitHub ReleaseSummarizedView source
Deprecates JUnit 4 support in the Spring TestContext Framework.
TestContext
7.0.0-M5GitHub ReleaseSummarizedView source
Deprecate PathExtensionPredicate in functional web frameworks.
PathExtensionPredicate
7.0.0-M1GitHub ReleaseSummarizedView source
Deprecate mvc XML configuration namespace.
7.0.0-M1GitHub ReleaseSummarizedView source
Deprecate HandlerMappingIntrospector.
HandlerMappingIntrospector
7.0.0-M1GitHub ReleaseSummarizedView source
Deprecate use of PathMatcher in web modules.
PathMatcher
7.0.0-M1GitHub ReleaseSummarizedView source
Deprecate use of several bean factory methods for the same bean in a configuration class.
7.0.0-M1GitHub ReleaseSummarizedView source

API changes

Generated by DepDelta from published JVM bytecode. Not mixed with prose notes.

  • added: method JCacheCacheManager.resetCaches(): void
  • added: method ConfigurableMimeFileTypeMap.getContentType(Path): String
  • removed: method SimpleThreadPoolTaskExecutor.submitListenable(Callable): ListenableFuture
  • removed: method SimpleThreadPoolTaskExecutor.submitListenable(Runnable): ListenableFuture
  • changed: class SimpleThreadPoolTaskExecutor extends SimpleThreadPool implements AsyncListenableTaskExecutor, SchedulingTaskExecutor, InitializingBean, DisposableBean → class SimpleThreadPoolTaskExecutor extends SimpleThreadPool implements AsyncTaskExecutor, SchedulingTaskExecutor, InitializingBean, DisposableBean