Upgrading org.springframework:spring-context 6 to 7
Breaking6.2.19 → 7.0.10Breaking22Security18Deprecated17New201Changed268Fixed296Other154
BreakingUpgrade verdict
22 breaking changes and 18 security fixes.
In plain terms
- SpEL expressions evaluated with SimpleEvaluationContext are no longer compiled unless you explicitly ask for it.
- Simplifies TransactionalOperator.executeAndAwait by removing Optional from its signature.
- Renames maxAttempts to maxRetries in @Retryable and RetryPolicy.
- RestTestClient no longer bundles Hamcrest, so code relying on it transitively must add it explicitly.
Must act Top 5 of 57 that need code or config changes
org.springframework:spring-context publishes an official migration guide for version 7. It covers more than the release notes do.
The official release notes and upgrade guide ↗Installs 8 packages in all (was 7).
What you must change
Breaking22
SimpleEvaluationContext no longer supports expression compilation by default; opt in via withCompilationSupported().
SimpleEvaluationContextSpelParserConfigurationspring.expression.compiler.modewithCompilationSupported()Simplifies TransactionalOperator.executeAndAwait by removing Optional from its signature.
TransactionalOperatorexecuteAndAwaitOptionalRenames maxAttempts to maxRetries in @Retryable and RetryPolicy.
@RetryableRetryPolicymaxAttemptsmaxRetriesRemoves the Hamcrest dependency from RestTestClient.
RestTestClientRemoves support for callable references in
BeanRegistrarDsl.BeanRegistrarDslRemoves HttpServiceClient annotation support.
HttpServiceClientRemoves maxDuration and maxElapsedTime support from RetryPolicy.
RetryPolicymaxDurationmaxElapsedTimeRemoves the (String, String) variants of setProperty() and withProperty() from MockEnvironment.
MockEnvironmentsetProperty()withProperty()Removes support for Aware interfaces in BeanRegistrar.
AwareBeanRegistrarRemoves the deprecated rowsExpected property of SqlQuery.
SqlQueryrowsExpectedRemoves convention-based annotation attribute override support.
Removes Netty 5 support.
Netty 5Removes binary array name handling in ClassUtils.forName().
ClassUtils.forName()Removes path mapping options that were marked as deprecated for removal.
ForwardedHeaderFilter and ForwardedHeaderTransformer add a boolean constructor argument to choose standard Forwarded or X-Forwarded headers.
ForwardedHeaderFilterForwardedHeaderTransformerApiVersionConfigurer.setSupportedVersionPredicate() now returns void instead of ApiVersionConfigurer.
ApiVersionConfigurersetSupportedVersionPredicate()Revises ApplicationContext#getId() nullability to non-null.
ApplicationContext#getId()Makes RetryException#getCause non-nullable.
RetryExceptiongetCauseReplaces useRequestParam with useQueryParam in ApiVersionConfigurer to align with the client.
ApiVersionConfigureruseRequestParamuseQueryParamMigrates orm.hibernate5 to the orm.jpa.hibernate package for Hibernate ORM 7.0.
orm.hibernate5orm.jpa.hibernateRedesigns RetryPolicy to directly incorporate BackOff.
RetryPolicyBackOffMakes built-in RetryPolicy implementations final.
RetryPolicySecurity18
Limits result size of BigDecimal/BigInteger power operations in SpEL.
BigDecimalBigIntegerFixes CVE-2026-41838, a predictable session ID issue in the WebSocket module.
Fixes CVE-2026-41839, a privilege escalation via session fixation in WebFlux.
Fixes CVE-2026-41840, a denial of service via multipart requests in WebFlux.
Fixes CVE-2026-41841, an information disclosure via static resource cache in Spring MVC and WebFlux.
Fixes CVE-2026-41842, a denial of service via versioned resources in Spring MVC and WebFlux.
Fixes CVE-2026-41843, a path traversal via versioned static resources in Spring MVC and WebFlux.
Fixes CVE-2026-41844, an open redirect in Spring MVC and WebFlux.
Fixes CVE-2026-41845, a cross-site scripting issue via JavaScriptUtils.
JavaScriptUtilsFixes CVE-2026-41846, a cross-site scripting issue via JSP form tags.
Fixes CVE-2026-41848, a denial of service via AntPathMatcher.
AntPathMatcherFixes CVE-2026-41850, an algorithmic denial of service via SpEL expressions.
Fixes CVE-2026-41851, a denial of service via an unbounded cache in SpEL.
Fixes CVE-2026-41852, arbitrary method invocation in SpEL expressions.
Fixes CVE-2026-41853, multipart request smuggling in Spring MVC and WebFlux.
Fixes CVE-2026-41854, a server-side request forgery via UriComponentsBuilder.
UriComponentsBuilderFixes CVE-2026-41855, unsafe deserialization via Jackson JMS converters.
Warns against unsafe static resource locations in MVC and WebFlux.
Deprecations to plan for
Deprecated17
Deprecates methodIdentification() in CacheAspectSupport for removal.
CacheAspectSupportmethodIdentification()Deprecates PagedListHolder and PropertyComparator for removal.
PagedListHolderPropertyComparatorNotes that deprecated MockMvcClientHttpRequestFactory is required for tests with HTTP service interface proxy.
MockMvcClientHttpRequestFactoryDeprecates the BeanShell scripting support.
Deprecates the
lang XML namespace.langDeprecates Hamcrest methods in WebTestClient.
WebTestClientDeprecates TransactionCallbackWithoutResult.
TransactionCallbackWithoutResultDeprecates the org.springframework.web.servlet.view.document package.
org.springframework.web.servlet.view.documentDeprecates put(MergedContextConfiguration, ApplicationContext) in ContextCache.
ContextCacheput(MergedContextConfiguration, ApplicationContext)MergedContextConfigurationApplicationContextDeprecates the DaoSupport classes.
DaoSupportDeprecates PropertyPlaceholderConfigurer and PreferencesPlaceholderConfigurer for removal.
PropertyPlaceholderConfigurerPreferencesPlaceholderConfigurerDeprecates JUnit 4 support in the Spring TestContext Framework.
TestContextDeprecates PathExtensionPredicate in functional web frameworks.
PathExtensionPredicateDeprecates the MVC XML configuration namespace.
Deprecates HandlerMappingIntrospector.
HandlerMappingIntrospectorDeprecates use of PathMatcher in web modules.
PathMatcherDeprecates use of several bean factory methods for the same bean in a configuration class.
API changes
Generated by DepDelta from published JVM bytecode. Not mixed with prose notes.
- added:
method CacheManager.resetCaches(): void
- added:
method AbstractCacheManager.resetCaches(): void - added:
method CompositeCacheManager.resetCaches(): void - added:
method NoOpCacheManager.resetCaches(): void
- added:
method ConfigurableApplicationContext.pause(): void - added:
method ConfigurableApplicationContext.restart(): void - added:
method LifecycleProcessor.onPause(): void - added:
method LifecycleProcessor.onRestart(): void - added:
method SmartLifecycle.isPauseable(): boolean
- added:
@interface Proxyable - added:
class FullyQualifiedConfigurationBeanNameGenerator extends FullyQualifiedAnnotationBeanNameGenerator implements ConfigurationBeanNameGenerator - added:
ctor FullyQualifiedConfigurationBeanNameGenerator() - added:
enum ProxyType - added:
interface ConfigurationBeanNameGenerator extends BeanNameGenerator - added:
method AnnotationConfigRegistry.register(BeanRegistrar[]): void - added:
method ConfigurationBeanNameGenerator.deriveBeanName(MethodMetadata, String): String - added:
method FullyQualifiedConfigurationBeanNameGenerator.deriveBeanName(MethodMetadata, String): String - added:
method Proxyable.interfaces(): Class[] - added:
method Proxyable.value(): ProxyType - added:
static field FullyQualifiedConfigurationBeanNameGenerator.INSTANCE: FullyQualifiedConfigurationBeanNameGenerator - added:
static field ProxyType.DEFAULT: ProxyType - added:
static field ProxyType.INTERFACES: ProxyType - added:
static field ProxyType.TARGET_CLASS: ProxyType - added:
static method ProxyType.valueOf(String): ProxyType - added:
static method ProxyType.values(): ProxyType[]
- added:
class ContextPausedEvent extends ContextStoppedEvent - added:
class ContextRestartedEvent extends ContextStartedEvent - added:
class MethodFailureEvent extends ApplicationEvent - added:
ctor ContextPausedEvent(ApplicationContext) - added:
ctor ContextRestartedEvent(ApplicationContext) - added:
ctor MethodFailureEvent(MethodInvocation, Throwable) - added:
interface EventPublicationInterceptor.ApplicationEventFactory - added:
method ApplicationContextEvent.getSource(): ApplicationContext - added:
method EventPublicationInterceptor.ApplicationEventFactory.onFailure(MethodInvocation, Throwable): ApplicationEvent - added:
method EventPublicationInterceptor.ApplicationEventFactory.onSuccess(MethodInvocation, Object): ApplicationEvent - added:
method EventPublicationInterceptor.setApplicationEventFactory(EventPublicationInterceptor.ApplicationEventFactory): void - added:
method MethodFailureEvent.getFailure(): Throwable - added:
method MethodFailureEvent.getMethod(): Method - added:
method MethodFailureEvent.getSource(): MethodInvocation - added:
method MethodFailureEvent.toString(): String
- removed:
method MapAccessor.canRead(EvaluationContext, Object, String): boolean - removed:
method MapAccessor.canWrite(EvaluationContext, Object, String): boolean - removed:
method MapAccessor.generateCode(String, MethodVisitor, CodeFlow): void - removed:
method MapAccessor.getPropertyType(): Class - removed:
method MapAccessor.getSpecificTargetClasses(): Class[] - removed:
method MapAccessor.isCompilable(): boolean - removed:
method MapAccessor.read(EvaluationContext, Object, String): TypedValue - removed:
method MapAccessor.write(EvaluationContext, Object, String, Object): void - changed:
class MapAccessor implements CompilablePropertyAccessor → class MapAccessor extends MapAccessor
- added:
ctor CandidateComponentsIndex() - added:
method CandidateComponentsIndex.getRegisteredScans(): Set - added:
method CandidateComponentsIndex.getRegisteredStereotypes(): Set - added:
method CandidateComponentsIndex.hasScannedPackage(String): boolean - added:
method CandidateComponentsIndex.registerCandidateType(String, String[]): void - added:
method CandidateComponentsIndex.registerScan(String[]): void - added:
static method CandidateComponentsIndexLoader.addIndex(ClassLoader, CandidateComponentsIndex): void - added:
static method CandidateComponentsIndexLoader.clearCache(): void
- removed:
method SimpleThreadScope.resolveContextualObject(String): Object - added:
method AbstractApplicationContext.getBeanProvider(ParameterizedTypeReference): ObjectProvider - added:
method AbstractApplicationContext.pause(): void - added:
method AbstractApplicationContext.restart(): void - added:
method AbstractResourceBasedMessageSource.getDefaultCharset(): Charset - added:
method AbstractResourceBasedMessageSource.setDefaultCharset(Charset): void - added:
method DefaultLifecycleProcessor.onPause(): void - added:
method DefaultLifecycleProcessor.onRestart(): void - added:
method GenericApplicationContext.register(BeanRegistrar[]): void - added:
static method BeanDefinitionDsl.Role.getEntries(): EnumEntries - added:
static method BeanDefinitionDsl.Scope.getEntries(): EnumEntries
- added:
method MBeanExporter.registerManagedResource(Object, String): ObjectName
- added:
method SimpleJndiBeanFactory.getBeanProvider(ParameterizedTypeReference): ObjectProvider
- added:
class InvocationRejectedException extends RejectedExecutionException - added:
ctor InvocationRejectedException(String, Object) - added:
method InvocationRejectedException.getTarget(): Object
- added:
@interface ConcurrencyLimit - added:
@interface EnableResilientMethods - added:
@interface Retryable - added:
class ConcurrencyLimitBeanPostProcessor extends AbstractBeanFactoryAwareAdvisingPostProcessor implements EmbeddedValueResolverAware - added:
class ResilientMethodsConfiguration implements ImportAware - added:
class RetryAnnotationBeanPostProcessor extends AbstractBeanFactoryAwareAdvisingPostProcessor implements ApplicationEventPublisherAware, EmbeddedValueResolverAware - added:
ctor ConcurrencyLimitBeanPostProcessor() - added:
ctor ResilientMethodsConfiguration() - added:
ctor RetryAnnotationBeanPostProcessor() - added:
enum ConcurrencyLimit.ThrottlePolicy - added:
method ConcurrencyLimit.limit(): int - added:
method ConcurrencyLimit.limitString(): String - added:
method ConcurrencyLimit.policy(): ConcurrencyLimit.ThrottlePolicy - added:
method ConcurrencyLimit.value(): int - added:
method ConcurrencyLimitBeanPostProcessor.setEmbeddedValueResolver(StringValueResolver): void - added:
method EnableResilientMethods.order(): int - added:
method EnableResilientMethods.proxyTargetClass(): boolean - added:
method ResilientMethodsConfiguration.concurrencyLimitAdvisor(): ConcurrencyLimitBeanPostProcessor - added:
method ResilientMethodsConfiguration.retryAdvisor(): RetryAnnotationBeanPostProcessor - added:
method ResilientMethodsConfiguration.setImportMetadata(AnnotationMetadata): void - added:
method RetryAnnotationBeanPostProcessor.setApplicationEventPublisher(ApplicationEventPublisher): void - added:
method RetryAnnotationBeanPostProcessor.setEmbeddedValueResolver(StringValueResolver): void - added:
method Retryable.delay(): long - added:
method Retryable.delayString(): String - added:
method Retryable.excludes(): Class[] - added:
method Retryable.includes(): Class[] - added:
method Retryable.jitter(): long - added:
method Retryable.jitterString(): String - added:
method Retryable.maxDelay(): long - added:
method Retryable.maxDelayString(): String - added:
method Retryable.maxRetries(): long - added:
method Retryable.maxRetriesString(): String - added:
method Retryable.multiplier(): double - added:
method Retryable.multiplierString(): String - added:
method Retryable.predicate(): Class - added:
method Retryable.timeUnit(): TimeUnit - added:
method Retryable.timeout(): long - added:
method Retryable.timeoutString(): String - added:
method Retryable.value(): Class[] - added:
static field ConcurrencyLimit.ThrottlePolicy.BLOCK: ConcurrencyLimit.ThrottlePolicy - added:
static field ConcurrencyLimit.ThrottlePolicy.REJECT: ConcurrencyLimit.ThrottlePolicy - added:
static method ConcurrencyLimit.ThrottlePolicy.valueOf(String): ConcurrencyLimit.ThrottlePolicy - added:
static method ConcurrencyLimit.ThrottlePolicy.values(): ConcurrencyLimit.ThrottlePolicy[]
- added:
abstract class AbstractRetryInterceptor implements MethodInterceptor, ApplicationEventPublisherAware - added:
class MethodRetryEvent extends MethodFailureEvent - added:
class SimpleRetryInterceptor extends AbstractRetryInterceptor - added:
ctor AbstractRetryInterceptor() - added:
ctor MethodRetryEvent(MethodInvocation, Throwable, boolean) - added:
ctor MethodRetrySpec(Collection, Collection, MethodRetryPredicate, long, Duration, Duration, Duration, double, Duration) - added:
ctor MethodRetrySpec(Collection, Collection, MethodRetryPredicate, long, Duration, Duration, double, Duration) - added:
ctor MethodRetrySpec(MethodRetryPredicate, long, Duration) - added:
ctor MethodRetrySpec(MethodRetryPredicate, long, Duration, Duration, double, Duration) - added:
ctor SimpleRetryInterceptor(MethodRetrySpec) - added:
interface MethodRetryPredicate - added:
method AbstractRetryInterceptor.getRetrySpec(Method, Class): MethodRetrySpec - added:
method AbstractRetryInterceptor.invoke(MethodInvocation): Object - added:
method AbstractRetryInterceptor.setApplicationEventPublisher(ApplicationEventPublisher): void - added:
method MethodRetryEvent.getFailure(): Throwable - added:
method MethodRetryEvent.isRetryAborted(): boolean - added:
method MethodRetryEvent.toString(): String - added:
method MethodRetryPredicate.forMethod(Method): Predicate - added:
method MethodRetryPredicate.shouldRetry(Method, Throwable): boolean - added:
method MethodRetrySpec.delay(): Duration - added:
method MethodRetrySpec.equals(Object): boolean - added:
method MethodRetrySpec.excludes(): Collection - added:
method MethodRetrySpec.hashCode(): int - added:
method MethodRetrySpec.includes(): Collection - added:
method MethodRetrySpec.jitter(): Duration - added:
method MethodRetrySpec.maxDelay(): Duration - added:
method MethodRetrySpec.maxRetries(): long - added:
method MethodRetrySpec.multiplier(): double - added:
method MethodRetrySpec.predicate(): MethodRetryPredicate - added:
method MethodRetrySpec.timeout(): Duration - added:
method MethodRetrySpec.toString(): String - added:
method SimpleRetryInterceptor.getRetrySpec(Method, Class): MethodRetrySpec - added:
record MethodRetrySpec
- removed:
method AsyncResult.addCallback(ListenableFutureCallback): void - removed:
method AsyncResult.addCallback(SuccessCallback, FailureCallback): void - removed:
method AsyncResult.completable(): CompletableFuture - changed:
class AsyncResult implements ListenableFuture → class AsyncResult implements Future - changed:
static method AsyncResult.forExecutionException(Throwable): ListenableFuture → static method AsyncResult.forExecutionException(Throwable): Future - changed:
static method AsyncResult.forValue(Object): ListenableFuture → static method AsyncResult.forValue(Object): Future
- removed:
method ConcurrentTaskExecutor.submitListenable(Callable): ListenableFuture - removed:
method ConcurrentTaskExecutor.submitListenable(Runnable): ListenableFuture - removed:
method ConcurrentTaskScheduler.submitListenable(Callable): ListenableFuture - removed:
method ConcurrentTaskScheduler.submitListenable(Runnable): ListenableFuture - removed:
method SimpleAsyncTaskScheduler.submitListenable(Callable): ListenableFuture - removed:
method SimpleAsyncTaskScheduler.submitListenable(Runnable): ListenableFuture - removed:
method ThreadPoolTaskExecutor.submitListenable(Callable): ListenableFuture - removed:
method ThreadPoolTaskExecutor.submitListenable(Runnable): ListenableFuture - removed:
method ThreadPoolTaskScheduler.cancelRemainingTask(Runnable): void - removed:
method ThreadPoolTaskScheduler.submitListenable(Callable): ListenableFuture - removed:
method ThreadPoolTaskScheduler.submitListenable(Runnable): ListenableFuture - changed:
class ConcurrentTaskExecutor implements AsyncListenableTaskExecutor, SchedulingTaskExecutor → class ConcurrentTaskExecutor implements AsyncTaskExecutor, SchedulingTaskExecutor - changed:
class ThreadPoolTaskExecutor extends ExecutorConfigurationSupport implements AsyncListenableTaskExecutor, SchedulingTaskExecutor → class ThreadPoolTaskExecutor extends ExecutorConfigurationSupport implements AsyncTaskExecutor, SchedulingTaskExecutor - changed:
class ThreadPoolTaskScheduler extends ExecutorConfigurationSupport implements AsyncListenableTaskExecutor, SchedulingTaskExecutor, TaskScheduler → class ThreadPoolTaskScheduler extends ExecutorConfigurationSupport implements AsyncTaskExecutor, SchedulingTaskExecutor, TaskScheduler
- removed:
interface HierarchicalThemeSource extends ThemeSource - removed:
interface Theme - removed:
interface ThemeSource - removed:
method HierarchicalThemeSource.getParentThemeSource(): ThemeSource - removed:
method HierarchicalThemeSource.setParentThemeSource(ThemeSource): void - removed:
method Theme.getMessageSource(): MessageSource - removed:
method Theme.getName(): String - removed:
method ThemeSource.getTheme(String): Theme
- removed:
abstract class UiApplicationContextUtils - removed:
class DelegatingThemeSource implements HierarchicalThemeSource - removed:
class ResourceBundleThemeSource implements HierarchicalThemeSource, BeanClassLoaderAware - removed:
class SimpleTheme implements Theme - removed:
ctor DelegatingThemeSource() - removed:
ctor ResourceBundleThemeSource() - removed:
ctor SimpleTheme(String, MessageSource) - removed:
ctor UiApplicationContextUtils() - removed:
field ResourceBundleThemeSource.logger: Log - removed:
method DelegatingThemeSource.getParentThemeSource(): ThemeSource - removed:
method DelegatingThemeSource.getTheme(String): Theme - removed:
method DelegatingThemeSource.setParentThemeSource(ThemeSource): void - removed:
method ResourceBundleThemeSource.createMessageSource(String): MessageSource - removed:
method ResourceBundleThemeSource.getParentThemeSource(): ThemeSource - removed:
method ResourceBundleThemeSource.getTheme(String): Theme - removed:
method ResourceBundleThemeSource.initParent(Theme): void - removed:
method ResourceBundleThemeSource.setBasenamePrefix(String): void - removed:
method ResourceBundleThemeSource.setBeanClassLoader(ClassLoader): void - removed:
method ResourceBundleThemeSource.setDefaultEncoding(String): void - removed:
method ResourceBundleThemeSource.setFallbackToSystemLocale(boolean): void - removed:
method ResourceBundleThemeSource.setParentThemeSource(ThemeSource): void - removed:
method SimpleTheme.getMessageSource(): MessageSource - removed:
method SimpleTheme.getName(): String - removed:
static field UiApplicationContextUtils.THEME_SOURCE_BEAN_NAME: String - removed:
static method UiApplicationContextUtils.initThemeSource(ApplicationContext): ThemeSource
- added:
static method ValidationAnnotationUtils.determineValidationGroups(Object, Method): Class[]
- added:
ctor SpringConstraintValidatorFactory(AutowireCapableBeanFactory, ConstraintValidatorFactory)
- removed:
ctor ParameterValidationResult(MethodParameter, Object, Collection) - removed:
ctor ParameterValidationResult(MethodParameter, Object, Collection, Object, Integer, Object) - removed:
method MethodValidationResult.getAllValidationResults(): List