Upgrading org.springframework:spring-jdbc 5 to 6
Breaking5.3.39 → 6.2.19Breaking6Security16Platform4Deprecated14New241Changed340Fixed943Other479
SecurityFixes CVE-2026-41838, a predictable session ID issue in the WebSocket module.CVE-2026-41838 ↗
BreakingUpgrade verdict
6 breaking changes and 4 platform requirement changes and 16 security fixes.
In plain terms
- Removes the jibx-marshaller element from spring-oxm.xsd.
- The pure attribute is no longer available on the @Contract annotation.
- Two constants in a transaction utility class have new names, so code referencing the old names must be updated.
- Metrics for RestTemplate requests no longer include the client.name tag, which can break dashboards or alerts that rely on it.
Must act Top 5 of 40 that need code or config changes
org.springframework:spring-jdbc publishes an official migration guide for version 6. It covers more than the release notes do.
Upgrading to Spring Framework 6.x ↗What you must change
Breaking6
Removes the jibx-marshaller element from spring-oxm.xsd.
jibx-marshallerspring-oxm.xsdRemoves the pure attribute from @Contract.
@ContractRenames aopAvailable constants in TransactionSynchronizationUtils for better GraalVM native image support.
TransactionSynchronizationUtilsaopAvailableSpring Web RestTemplate http.client.requests metrics no longer have the client.name tag.
RestTemplatehttp.client.requestsclient.nameMakes the DefaultGenerationContext(DefaultGenerationContext, String) constructor protected.
DefaultGenerationContextChanges the return type of InvocableHandlerMethod#invokeSuspendingFunction to Object.
InvocableHandlerMethod#invokeSuspendingFunctionSecurity16
Fixes CVE-2026-41838, a predictable session ID issue in the WebSocket module.
Fixes CVE-2026-41839, a privilege escalation via session fixation in WebFlux.
Fixes CVE-2026-41840, a denial of service via multipart requests in WebFlux.
Fixes CVE-2026-41841, an information disclosure via static resource cache in Spring MVC and WebFlux.
Fixes CVE-2026-41842, a denial of service via versioned resources in Spring MVC and WebFlux.
Fixes CVE-2026-41843, a path traversal via versioned static resources in Spring MVC and WebFlux.
Fixes CVE-2026-41844, an open redirect in Spring MVC and WebFlux.
Fixes CVE-2026-41845, a cross-site scripting issue via JavaScriptUtils.
JavaScriptUtilsFixes CVE-2026-41846, a cross-site scripting issue via JSP form tags.
Fixes CVE-2026-41848, a denial of service via AntPathMatcher.
AntPathMatcherFixes CVE-2026-41850, an algorithmic denial of service via SpEL expressions.
Fixes CVE-2026-41851, a denial of service via an unbounded cache in SpEL.
Fixes CVE-2026-41852, arbitrary method invocation in SpEL expressions.
Fixes CVE-2026-41853, multipart request smuggling in Spring MVC and WebFlux.
Fixes CVE-2026-41854, a server-side request forgery via UriComponentsBuilder.
UriComponentsBuilderFixes CVE-2026-41855, unsafe deserialization via Jackson JMS converters.
Platform4
Upgrades to ASM 9.8 for early Java 25 support.
ASMUpgrades to ASM 9.7.1 for early Java 24 support.
ASMAdds early support for Java 23.
Adds early support for JDK 21.
Deprecations to plan for
Deprecated14
Adds missing @Deprecated(forRemoval = true) markers for APIs deleted in 7.0.
@DeprecatedDeprecates methodIdentification() in CacheAspectSupport for removal.
CacheAspectSupport.methodIdentification()CacheAspectSupportDeprecates setConnectTimeout on HttpComponentsClientHttpRequestFactory.
HttpComponentsClientHttpRequestFactorysetConnectTimeoutIntroduces isAutowirableConstructor(Executable, PropertyProvider) in TestConstructorUtils and deprecates existing variants.
TestConstructorUtilsisAutowirableConstructor(Executable, PropertyProvider)Deprecates the rowsExpected property of SqlQuery for removal.
SqlQueryrowsExpectedDeprecates and removes use of UrlPathHelper in ServletWebSocketHandlerRegistry.
UrlPathHelperServletWebSocketHandlerRegistryDeprecates exchangeTimeout and refactors readTimeout in ReactorClientHttpRequestFactory.
ReactorClientHttpRequestFactoryexchangeTimeoutreadTimeoutDeprecates the RootBeanDefinition(ResolvableType) constructor.
RootBeanDefinitionResolvableTypeDeprecates the obsolete ConcurrentExecutorAdapter for removal in 6.1.
ConcurrentExecutorAdapterDeprecates HttpStatus 103 CHECKPOINT in favor of the new EARLY_HINTS.
HttpStatusCHECKPOINTEARLY_HINTSDeprecates Base64Utils.
Base64UtilsDeprecates the application/graphql+json media type after spec changes.
application/graphql+jsonDeprecates JettyWebSocketClient in favor of StandardWebSocketClient.
JettyWebSocketClientStandardWebSocketClientDeprecates LocalVariableTableParameterNameDiscoverer completely, avoiding its exposure in native images.
LocalVariableTableParameterNameDiscovererAPI changes
Generated by DepDelta from published JVM bytecode. Not mixed with prose notes.
- removed:
abstract class BatchUpdateUtils - removed:
ctor BatchUpdateUtils() - removed:
static method BatchUpdateUtils.executeBatchUpdate(String, List, int[], JdbcOperations): int[] - removed:
static method BatchUpdateUtils.setStatementParameters(Object[], PreparedStatement, int[]): void - added:
class AggregatedBatchUpdateException extends BatchUpdateException - added:
class SimplePropertyRowMapper implements RowMapper - added:
ctor AggregatedBatchUpdateException(int[][], BatchUpdateException) - added:
ctor SimplePropertyRowMapper(Class) - added:
ctor SimplePropertyRowMapper(Class, ConversionService) - added:
method AggregatedBatchUpdateException.getOriginalException(): BatchUpdateException - added:
method AggregatedBatchUpdateException.getSuccessfulUpdateCounts(): int[][] - added:
method BeanPropertyRowMapper.mappedNames(PropertyDescriptor): Set - added:
method JdbcOperations.batchUpdate(PreparedStatementCreator, BatchPreparedStatementSetter, KeyHolder): int[] - added:
method JdbcTemplate.batchUpdate(PreparedStatementCreator, BatchPreparedStatementSetter, KeyHolder): int[] - added:
method SimplePropertyRowMapper.mapRow(ResultSet, int): Object
- removed:
ctor CallParameterMetaData(String, int, int, String, boolean) - removed:
method TableMetaDataContext.getSimulationQueryForGetGeneratedKey(String, String): String - added:
class MySQLTableMetaDataProvider extends GenericTableMetaDataProvider - added:
ctor MySQLTableMetaDataProvider(DatabaseMetaData) - added:
method CallMetaDataProvider.namedParameterBindingToUse(String): String - added:
method GenericCallMetaDataProvider.namedParameterBindingToUse(String): String - added:
method GenericTableMetaDataProvider.columnNameToUse(String): String - added:
method GenericTableMetaDataProvider.getIdentifierQuoteString(): String - added:
method PostgresTableMetaDataProvider.metaDataCatalogNameToUse(String): String - added:
method PostgresTableMetaDataProvider.metaDataSchemaNameToUse(String): String - added:
method SqlServerCallMetaDataProvider.namedParameterBindingToUse(String): String - added:
method SybaseCallMetaDataProvider.namedParameterBindingToUse(String): String - added:
method TableMetaDataContext.isQuoteIdentifiers(): boolean - added:
method TableMetaDataContext.setQuoteIdentifiers(boolean): void - added:
method TableMetaDataProvider.columnNameToUse(String): String - added:
method TableMetaDataProvider.getIdentifierQuoteString(): String
- removed:
abstract class NamedParameterBatchUpdateUtils extends BatchUpdateUtils - removed:
ctor NamedParameterBatchUpdateUtils() - removed:
static method NamedParameterBatchUpdateUtils.executeBatchUpdateWithNamedParameters(ParsedSql, SqlParameterSource[], JdbcOperations): int[] - added:
class SimplePropertySqlParameterSource extends AbstractSqlParameterSource - added:
ctor SimplePropertySqlParameterSource(Object) - added:
method MapSqlParameterSource.hasValues(): boolean - added:
method NamedParameterJdbcOperations.batchUpdate(String, SqlParameterSource[], KeyHolder): int[] - added:
method NamedParameterJdbcOperations.batchUpdate(String, SqlParameterSource[], KeyHolder, String[]): int[] - added:
method NamedParameterJdbcTemplate.batchUpdate(String, SqlParameterSource[], KeyHolder): int[] - added:
method NamedParameterJdbcTemplate.batchUpdate(String, SqlParameterSource[], KeyHolder, String[]): int[] - added:
method SimplePropertySqlParameterSource.getSqlType(String): int - added:
method SimplePropertySqlParameterSource.getValue(String): Object - added:
method SimplePropertySqlParameterSource.hasValue(String): boolean
- changed:
method SimpleJdbcInsert.includeSynonymsForTableColumnMetaData(): SimpleJdbcInsertOperations → method SimpleJdbcInsert.includeSynonymsForTableColumnMetaData(): SimpleJdbcInsert - changed:
method SimpleJdbcInsert.withoutTableColumnMetaDataAccess(): SimpleJdbcInsertOperations → method SimpleJdbcInsert.withoutTableColumnMetaDataAccess(): SimpleJdbcInsert - added:
interface JdbcClient - added:
interface JdbcClient.MappedQuerySpec - added:
interface JdbcClient.ResultQuerySpec - added:
interface JdbcClient.StatementSpec - added:
method AbstractJdbcInsert.isQuoteIdentifiers(): boolean - added:
method AbstractJdbcInsert.setQuoteIdentifiers(boolean): void - added:
method JdbcClient.MappedQuerySpec.list(): List - added:
method JdbcClient.MappedQuerySpec.optional(): Optional - added:
method JdbcClient.MappedQuerySpec.set(): Set - added:
method JdbcClient.MappedQuerySpec.single(): Object - added:
method JdbcClient.MappedQuerySpec.stream(): Stream - added:
method JdbcClient.ResultQuerySpec.listOfRows(): List - added:
method JdbcClient.ResultQuerySpec.optionalValue(): Optional - added:
method JdbcClient.ResultQuerySpec.rowSet(): SqlRowSet - added:
method JdbcClient.ResultQuerySpec.singleColumn(): List - added:
method JdbcClient.ResultQuerySpec.singleRow(): Map - added:
method JdbcClient.ResultQuerySpec.singleValue(): Object - added:
method JdbcClient.StatementSpec.param(Object): JdbcClient.StatementSpec - added:
method JdbcClient.StatementSpec.param(String, Object): JdbcClient.StatementSpec - added:
method JdbcClient.StatementSpec.param(String, Object, int): JdbcClient.StatementSpec - added:
method JdbcClient.StatementSpec.param(int, Object): JdbcClient.StatementSpec - added:
method JdbcClient.StatementSpec.param(int, Object, int): JdbcClient.StatementSpec - added:
method JdbcClient.StatementSpec.paramSource(Object): JdbcClient.StatementSpec - added:
method JdbcClient.StatementSpec.paramSource(SqlParameterSource): JdbcClient.StatementSpec - added:
method JdbcClient.StatementSpec.params(List): JdbcClient.StatementSpec - added:
method JdbcClient.StatementSpec.params(Map): JdbcClient.StatementSpec - added:
method JdbcClient.StatementSpec.params(Object[]): JdbcClient.StatementSpec - added:
method JdbcClient.StatementSpec.query(): JdbcClient.ResultQuerySpec - added:
method JdbcClient.StatementSpec.query(Class): JdbcClient.MappedQuerySpec - added:
method JdbcClient.StatementSpec.query(ResultSetExtractor): Object - added:
method JdbcClient.StatementSpec.query(RowCallbackHandler): void - added:
method JdbcClient.StatementSpec.query(RowMapper): JdbcClient.MappedQuerySpec - added:
method JdbcClient.StatementSpec.update(): int - added:
method JdbcClient.StatementSpec.update(KeyHolder): int - added:
method JdbcClient.StatementSpec.update(KeyHolder, String[]): int - added:
method JdbcClient.sql(String): JdbcClient.StatementSpec - added:
method SimpleJdbcInsert.usingQuotedIdentifiers(): SimpleJdbcInsert - added:
method SimpleJdbcInsertOperations.usingQuotedIdentifiers(): SimpleJdbcInsertOperations - added:
static method JdbcClient.create(DataSource): JdbcClient - added:
static method JdbcClient.create(JdbcOperations): JdbcClient - added:
static method JdbcClient.create(NamedParameterJdbcOperations): JdbcClient
- added:
class SqlBinaryValue implements SqlTypeValue - added:
class SqlCharacterValue implements SqlTypeValue - added:
ctor SqlBinaryValue(InputStream, long) - added:
ctor SqlBinaryValue(InputStreamSource, long) - added:
ctor SqlBinaryValue(Resource) - added:
ctor SqlBinaryValue(byte[]) - added:
ctor SqlCharacterValue(CharSequence) - added:
ctor SqlCharacterValue(InputStream, long) - added:
ctor SqlCharacterValue(Reader, long) - added:
ctor SqlCharacterValue(char[]) - added:
method SqlBinaryValue.setTypeValue(PreparedStatement, int, int, String): void - added:
method SqlCharacterValue.setTypeValue(PreparedStatement, int, int, String): void
- removed:
class WebSphereDataSourceAdapter extends IsolationLevelDataSourceAdapter - removed:
ctor WebSphereDataSourceAdapter() - removed:
field WebSphereDataSourceAdapter.logger: Log - removed:
method JdbcTransactionObjectSupport.flush(): void - removed:
method LazyConnectionDataSourceProxy.afterPropertiesSet(): void - removed:
method WebSphereDataSourceAdapter.afterPropertiesSet(): void - removed:
method WebSphereDataSourceAdapter.createConnectionSpec(Integer, Boolean, String, String): Object - removed:
method WebSphereDataSourceAdapter.doGetConnection(String, String): Connection - changed:
class SingleConnectionDataSource extends DriverManagerDataSource implements SmartDataSource, DisposableBean → class SingleConnectionDataSource extends DriverManagerDataSource implements SmartDataSource, AutoCloseable, DisposableBean - added:
class ShardingKeyDataSourceAdapter extends DelegatingDataSource - added:
ctor ShardingKeyDataSourceAdapter(DataSource) - added:
ctor ShardingKeyDataSourceAdapter(DataSource, ShardingKeyProvider) - added:
interface ShardingKeyProvider - added:
method DelegatingDataSource.createConnectionBuilder(): ConnectionBuilder - added:
method DelegatingDataSource.createShardingKeyBuilder(): ShardingKeyBuilder - added:
method LazyConnectionDataSourceProxy.checkDefaultConnectionProperties(): void - added:
method LazyConnectionDataSourceProxy.setReadOnlyDataSource(DataSource): void - added:
method ShardingKeyDataSourceAdapter.createConnectionBuilder(): ConnectionBuilder - added:
method ShardingKeyDataSourceAdapter.getConnection(): Connection - added:
method ShardingKeyDataSourceAdapter.getConnection(String, String): Connection - added:
method ShardingKeyDataSourceAdapter.setShardingKeyProvider(ShardingKeyProvider): void - added:
method ShardingKeyProvider.getShardingKey(): ShardingKey - added:
method ShardingKeyProvider.getSuperShardingKey(): ShardingKey - added:
method SingleConnectionDataSource.close(): void - added:
method SingleConnectionDataSource.closeConnection(Connection): void - added:
method SingleConnectionDataSource.isRollbackBeforeClose(): boolean - added:
method SingleConnectionDataSource.setRollbackBeforeClose(boolean): void - added:
method TransactionAwareDataSourceProxy.setLazyTransactionalConnections(boolean): void
- added:
abstract class EmbeddedDatabaseConfigurers - added:
class EmbeddedDatabaseConfigurerDelegate extends AbstractEmbeddedDatabaseConfigurer - added:
ctor EmbeddedDatabaseConfigurerDelegate(EmbeddedDatabaseConfigurer) - added:
ctor EmbeddedDatabaseConfigurers() - added:
method EmbeddedDatabaseBuilder.setDatabaseConfigurer(EmbeddedDatabaseConfigurer): EmbeddedDatabaseBuilder - added:
method EmbeddedDatabaseConfigurerDelegate.configureConnectionProperties(ConnectionProperties, String): void - added:
static method EmbeddedDatabaseConfigurers.customizeConfigurer(EmbeddedDatabaseType, UnaryOperator): EmbeddedDatabaseConfigurer - added:
static method EmbeddedDatabaseConfigurers.getConfigurer(EmbeddedDatabaseType): EmbeddedDatabaseConfigurer
- removed:
static method ScriptUtils.containsSqlScriptDelimiters(String, String): boolean - removed:
static method ScriptUtils.readScript(LineNumberReader, String, String, String): String - removed:
static method ScriptUtils.readScript(LineNumberReader, String[], String, String): String - removed:
static method ScriptUtils.splitSqlScript(EncodedResource, String, String, String, String, String, List): void - removed:
static method ScriptUtils.splitSqlScript(EncodedResource, String, String, String[], String, String, List): void - removed:
static method ScriptUtils.splitSqlScript(String, String, List): void - removed:
static method ScriptUtils.splitSqlScript(String, char, List): void
- added:
method AbstractRoutingDataSource.createConnectionBuilder(): ConnectionBuilder - added:
method AbstractRoutingDataSource.createShardingKeyBuilder(): ShardingKeyBuilder - added:
method AbstractRoutingDataSource.initialize(): void
- added:
class SqlArrayValue implements SqlValue - added:
ctor SqlArrayValue(String, Object[]) - added:
method AbstractFallbackSQLExceptionTranslator.getCustomTranslator(): SQLExceptionTranslator - added:
method AbstractFallbackSQLExceptionTranslator.setCustomTranslator(SQLExceptionTranslator): void - added:
method SqlArrayValue.cleanup(): void - added:
method SqlArrayValue.setValue(PreparedStatement, int): void - added:
static method JdbcUtils.convertPropertyNameToUnderscoreName(String): String
- removed:
class DB2MainframeSequenceMaxValueIncrementer extends AbstractSequenceMaxValueIncrementer - removed:
class DB2SequenceMaxValueIncrementer extends Db2LuwMaxValueIncrementer - removed:
class PostgreSQLSequenceMaxValueIncrementer extends PostgresSequenceMaxValueIncrementer - removed:
ctor DB2MainframeSequenceMaxValueIncrementer() - removed:
ctor DB2MainframeSequenceMaxValueIncrementer(DataSource, String) - removed:
ctor DB2SequenceMaxValueIncrementer() - removed:
ctor DB2SequenceMaxValueIncrementer(DataSource, String) - removed:
ctor PostgreSQLSequenceMaxValueIncrementer() - removed:
ctor PostgreSQLSequenceMaxValueIncrementer(DataSource, String) - removed:
method DB2MainframeSequenceMaxValueIncrementer.getSequenceQuery(): String - added:
class MariaDBSequenceMaxValueIncrementer extends AbstractSequenceMaxValueIncrementer - added:
class MySQLIdentityColumnMaxValueIncrementer extends AbstractIdentityColumnMaxValueIncrementer - added:
class SqlServerSequenceMaxValueIncrementer extends AbstractSequenceMaxValueIncrementer - added:
ctor MariaDBSequenceMaxValueIncrementer() - added:
ctor MariaDBSequenceMaxValueIncrementer(DataSource, String) - added:
ctor MySQLIdentityColumnMaxValueIncrementer() - added:
ctor MySQLIdentityColumnMaxValueIncrementer(DataSource, String, String) - added:
ctor SqlServerSequenceMaxValueIncrementer() - added:
ctor SqlServerSequenceMaxValueIncrementer(DataSource, String) - added:
method MariaDBSequenceMaxValueIncrementer.getSequenceQuery(): String - added:
method MySQLIdentityColumnMaxValueIncrementer.getIdentityStatement(): String - added:
method MySQLIdentityColumnMaxValueIncrementer.getIncrementStatement(): String - added:
method SqlServerSequenceMaxValueIncrementer.getSequenceQuery(): String