Skip to content

Upgrading org.springframework:spring-jdbc 6 to 7

Breaking6.2.19 → 7.0.10Breaking23Security18Deprecated17New204Changed270Fixed290Other154

Full comparisonBack to org.springframework:spring-jdbc
BreakingUpgrade verdict

23 breaking changes and 18 security fixes.

In plain terms
  • SpEL expressions evaluated in the restricted context are no longer compiled for speed unless you explicitly ask for it.
  • Simplifies TransactionalOperator.executeAndAwait by removing Optional from its signature.
  • Renames maxAttempts to maxRetries in @Retryable and RetryPolicy.
  • Removes the Hamcrest dependency from RestTestClient.
Must act Top 5 of 58 that need code or config changes

org.springframework:spring-jdbc publishes an official migration guide for version 7. It covers more than the release notes do.

The official release notes and upgrade guide ↗

Installs 5 packages in all (was 4).

Also installs commons-logging:commons-logging, org.jspecify:jspecify.

No longer installs org.springframework:spring-jcl.

3 packages of its own release move with it.

What you must change

Breaking23
SimpleEvaluationContext no longer supports expression compilation by default; opt in via withCompilationSupported().
SimpleEvaluationContextSpelParserConfigurationspring.expression.compiler.modewithCompilationSupported()
7.0.9GitHub ReleaseSummarizedView source
Simplifies TransactionalOperator.executeAndAwait by removing Optional from its signature.
TransactionalOperatorexecuteAndAwaitOptional
7.0.3GitHub ReleaseSummarizedView source
Renames maxAttempts to maxRetries in @Retryable and RetryPolicy.
@RetryableRetryPolicymaxAttemptsmaxRetries
7.0.0GitHub ReleaseSummarizedView source
Removes the Hamcrest dependency from RestTestClient.
RestTestClient
7.0.0-RC3GitHub ReleaseSummarizedView source
Removes support for callable references in BeanRegistrarDsl.
BeanRegistrarDsl
7.0.0-RC3GitHub ReleaseSummarizedView source
Removes HttpServiceClient annotation support.
HttpServiceClient
7.0.0-M9GitHub ReleaseSummarizedView source
Removes maxDuration and maxElapsedTime support from RetryPolicy.
RetryPolicymaxDurationmaxElapsedTime
7.0.0-M7GitHub ReleaseSummarizedView source
Removes (String, String) variants of setProperty() and withProperty() from MockEnvironment.
MockEnvironment.setProperty()MockEnvironment.withProperty()
7.0.0-M6GitHub ReleaseSummarizedView source
Removes support for Aware interfaces in BeanRegistrar.
AwareBeanRegistrar
7.0.0-M3GitHub ReleaseSummarizedView source
Removes the deprecated rowsExpected property of SqlQuery.
SqlQueryrowsExpected
7.0.0-M3GitHub ReleaseSummarizedView source
Removes convention-based annotation attribute override support.
7.0.0-M3GitHub ReleaseSummarizedView source
Removes Netty 5 support.
7.0.0-M2GitHub ReleaseSummarizedView source
Removes binary array name handling in ClassUtils.forName().
ClassUtils.forName()
7.0.0-M1GitHub ReleaseSummarizedView source
Remove path mapping options marked as deprecated for removal.
7.0.0-M1GitHub ReleaseSummarizedView source
ForwardedHeaderFilter and ForwardedHeaderTransformer add a boolean constructor argument to choose standard Forwarded or X-Forwarded headers.
ForwardedHeaderFilterForwardedHeaderTransformer
7.0.9GitHub ReleaseSummarizedView source
ApiVersionConfigurer.setSupportedVersionPredicate() now returns void instead of ApiVersionConfigurer.
ApiVersionConfigurer.setSupportedVersionPredicate()
7.0.7GitHub ReleaseSummarizedView source
Revises ApplicationContext#getId() nullability to non-null.
ApplicationContext#getId()
7.0.2GitHub ReleaseSummarizedView source
Changes canRead/canWrite overrides to Class ones in AbstractSmartHttpMessageConverter.
AbstractSmartHttpMessageConvertercanReadcanWrite
7.0.2GitHub ReleaseSummarizedView source
Makes RetryException#getCause non-nullable.
RetryExceptiongetCause
7.0.0-M9GitHub ReleaseSummarizedView source
Replaces useRequestParam with useQueryParam in ApiVersionConfigurer to align with the client.
ApiVersionConfigureruseRequestParamuseQueryParam
7.0.0-M8GitHub ReleaseSummarizedView source
Migrates the orm.hibernate5 package to orm.jpa.hibernate for Hibernate ORM 7.0.
orm.hibernate5orm.jpa.hibernate
7.0.0-M7GitHub ReleaseSummarizedView source
Redesigns RetryPolicy to directly incorporate BackOff.
RetryPolicyBackOff
7.0.0-M7GitHub ReleaseSummarizedView source
Makes built-in RetryPolicy implementations final.
RetryPolicy
7.0.0-M7GitHub ReleaseSummarizedView source
Security18
Limits result size of BigDecimal/BigInteger power operations in SpEL.
BigDecimalBigInteger
7.0.9GitHub ReleaseSummarizedView source
Fixes CVE-2026-41838, a predictable session ID issue in the WebSocket module.
7.0.8GitHub ReleaseSummarizedView source
Fixes CVE-2026-41839, a privilege escalation via session fixation in WebFlux.
7.0.8GitHub ReleaseSummarizedView source
Fixes CVE-2026-41840, a denial of service via multipart requests in WebFlux.
7.0.8GitHub ReleaseSummarizedView source
Fixes CVE-2026-41841, an information disclosure via static resource cache in Spring MVC and WebFlux.
7.0.8GitHub ReleaseSummarizedView source
Fixes CVE-2026-41842, a denial of service via versioned resources in Spring MVC and WebFlux.
7.0.8GitHub ReleaseSummarizedView source
Fixes CVE-2026-41843, a path traversal via versioned static resources in Spring MVC and WebFlux.
7.0.8GitHub ReleaseSummarizedView source
Fixes CVE-2026-41844, an open redirect in Spring MVC and WebFlux.
7.0.8GitHub ReleaseSummarizedView source
Fixes CVE-2026-41845, a cross-site scripting issue via JavaScriptUtils.
JavaScriptUtils
7.0.8GitHub ReleaseSummarizedView source
Fixes CVE-2026-41846, a cross-site scripting issue via JSP form tags.
7.0.8GitHub ReleaseSummarizedView source
Fixes CVE-2026-41848, a denial of service via AntPathMatcher.
AntPathMatcher
7.0.8GitHub ReleaseSummarizedView source
Fixes CVE-2026-41850, an algorithmic denial of service via SpEL expressions.
7.0.8GitHub ReleaseSummarizedView source
Fixes CVE-2026-41851, a denial of service via an unbounded cache in SpEL.
7.0.8GitHub ReleaseSummarizedView source
Fixes CVE-2026-41852, arbitrary method invocation in SpEL expressions.
7.0.8GitHub ReleaseSummarizedView source
Fixes CVE-2026-41853, multipart request smuggling in Spring MVC and WebFlux.
7.0.8GitHub ReleaseSummarizedView source
Fixes CVE-2026-41854, a server-side request forgery via UriComponentsBuilder.
UriComponentsBuilder
7.0.8GitHub ReleaseSummarizedView source
Fixes CVE-2026-41855, unsafe deserialization via Jackson JMS converters.
7.0.8GitHub ReleaseSummarizedView source
Warns against unsafe static resource locations in MVC and WebFlux.
7.0.8GitHub ReleaseSummarizedView source

Deprecations to plan for

Deprecated17
Deprecates methodIdentification() in CacheAspectSupport for removal.
CacheAspectSupport.methodIdentification()
7.0.7GitHub ReleaseSummarizedView source
Deprecates PagedListHolder and PropertyComparator for removal.
PagedListHolderPropertyComparator
7.0.3GitHub ReleaseSummarizedView source
Notes that deprecated MockMvcClientHttpRequestFactory is required for tests with HTTP service interface proxy.
MockMvcClientHttpRequestFactory
7.0.3GitHub ReleaseSummarizedView source
Deprecates the BeanShell scripting support.
7.0.0-RC3GitHub ReleaseSummarizedView source
Deprecates the lang XML namespace.
lang
7.0.0-RC3GitHub ReleaseSummarizedView source
Deprecates Hamcrest methods in WebTestClient.
WebTestClient
7.0.0-RC3GitHub ReleaseSummarizedView source
Deprecates TransactionCallbackWithoutResult.
TransactionCallbackWithoutResult
7.0.0-RC1GitHub ReleaseSummarizedView source
Deprecate the org.springframework.web.servlet.view.document package.
org.springframework.web.servlet.view.document
7.0.0-RC1GitHub ReleaseSummarizedView source
Deprecates put(MergedContextConfiguration, ApplicationContext) in ContextCache.
ContextCacheput(MergedContextConfiguration, ApplicationContext)MergedContextConfigurationApplicationContext
7.0.0-M9GitHub ReleaseSummarizedView source
Deprecates the DaoSupport classes.
DaoSupport
7.0.0-M7GitHub ReleaseSummarizedView source
Deprecates PropertyPlaceholderConfigurer and PreferencesPlaceholderConfigurer for removal.
PropertyPlaceholderConfigurerPreferencesPlaceholderConfigurer
7.0.0-M5GitHub ReleaseSummarizedView source
Deprecates JUnit 4 support in the Spring TestContext Framework.
TestContext
7.0.0-M5GitHub ReleaseSummarizedView source
Deprecate PathExtensionPredicate in functional web frameworks.
PathExtensionPredicate
7.0.0-M1GitHub ReleaseSummarizedView source
Deprecate mvc XML configuration namespace.
7.0.0-M1GitHub ReleaseSummarizedView source
Deprecate HandlerMappingIntrospector.
HandlerMappingIntrospector
7.0.0-M1GitHub ReleaseSummarizedView source
Deprecate use of PathMatcher in web modules.
PathMatcher
7.0.0-M1GitHub ReleaseSummarizedView source
Deprecate use of several bean factory methods for the same bean in a configuration class.
7.0.0-M1GitHub ReleaseSummarizedView source

API changes

Generated by DepDelta from published JVM bytecode. Not mixed with prose notes.

  • added: ctor JdbcTemplate(JdbcAccessor)
  • added: ctor RowMapperResultSetExtractor(RowMapper, int, int)
  • added: ctor SingleColumnRowMapper(Class, ConversionService)
  • added: static method JdbcOperationsExtensionsKt.query(JdbcOperations, String, Object[], Function1): Object
  • added: ctor NamedParameterJdbcTemplate(NamedParameterJdbcTemplate, JdbcTemplate)
  • added: method JdbcClient.StatementSpec.withFetchSize(int): JdbcClient.StatementSpec
  • added: method JdbcClient.StatementSpec.withMaxRows(int): JdbcClient.StatementSpec
  • added: method JdbcClient.StatementSpec.withQueryTimeout(int): JdbcClient.StatementSpec
  • added: static method JdbcClient.create(NamedParameterJdbcOperations, ConversionService): JdbcClient
  • removed: method SqlQuery.getRowsExpected(): int
  • removed: method SqlQuery.setRowsExpected(int): void
  • added: method SqlQuery.stream(): Stream
  • added: method SqlQuery.stream(Map): Stream
  • added: method SqlQuery.stream(Object[]): Stream
  • added: method SqlQuery.stream(Object[], Map): Stream
  • added: method SqlQuery.streamByNamedParam(Map): Stream
  • added: method SqlQuery.streamByNamedParam(Map, Map): Stream
  • added: class SqliteMaxValueIncrementer extends AbstractColumnMaxValueIncrementer
  • added: ctor SqliteMaxValueIncrementer()
  • added: ctor SqliteMaxValueIncrementer(DataSource, String, String)
  • added: method SqliteMaxValueIncrementer.getNextKey(): long