Upgrading org.springframework:spring-tx 6 to 7
Breaking6.2.19 → 7.0.10Breaking6Security19Platform1Deprecated3New343Changed171Fixed280Other153
BreakingUpgrade verdict
6 breaking changes and a platform requirement change and 19 security fixes.
In plain terms
- SpEL expressions evaluated in the simple context are no longer compiled for speed unless you explicitly turn compilation on.
- Simplifies TransactionalOperator.executeAndAwait by removing Optional from its signature.
- Renames maxAttempts to maxRetries in @Retryable and RetryPolicy.
- Two web components now let you explicitly choose which forwarded headers to trust, so proxy handling is more predictable.
Must act Top 5 of 29 that need code or config changes
org.springframework:spring-tx publishes an official migration guide for version 7. It covers more than the release notes do.
The official release notes and upgrade guide ↗Installs 4 packages in all (was 3).
What you must change
Breaking6
SimpleEvaluationContext no longer supports expression compilation by default; opt in via withCompilationSupported().
SimpleEvaluationContextSpelParserConfigurationspring.expression.compiler.modewithCompilationSupported()Simplifies TransactionalOperator.executeAndAwait by removing Optional from its signature.
TransactionalOperatorexecuteAndAwaitOptionalRenames maxAttempts to maxRetries in @Retryable and RetryPolicy.
@RetryableRetryPolicymaxAttemptsmaxRetriesForwardedHeaderFilter and ForwardedHeaderTransformer add a boolean constructor argument to choose standard Forwarded or X-Forwarded headers.
ForwardedHeaderFilterForwardedHeaderTransformerApiVersionConfigurer.setSupportedVersionPredicate() now returns void instead of ApiVersionConfigurer.
ApiVersionConfigurer.setSupportedVersionPredicate()ApiVersionConfigurerRevises ApplicationContext#getId() nullability to non-null.
ApplicationContext#getId()Security19
Limits result size of BigDecimal/BigInteger power operations in SpEL.
BigDecimalBigIntegerFixes CVE-2026-41838, a predictable session ID issue in the WebSocket module.
Fixes CVE-2026-41839, a privilege escalation via session fixation in WebFlux.
Fixes CVE-2026-41840, a denial of service via multipart requests in WebFlux.
Fixes CVE-2026-41841, an information disclosure via static resource cache in Spring MVC and WebFlux.
Fixes CVE-2026-41842, a denial of service via versioned resources in Spring MVC and WebFlux.
Fixes CVE-2026-41843, a path traversal via versioned static resources in Spring MVC and WebFlux.
Fixes CVE-2026-41844, an open redirect in Spring MVC and WebFlux.
Fixes CVE-2026-41845, a cross-site scripting issue via JavaScriptUtils.
JavaScriptUtilsFixes CVE-2026-41846, a cross-site scripting issue via JSP form tags.
Fixes CVE-2026-41848, a denial of service via AntPathMatcher.
AntPathMatcherFixes CVE-2026-41850, an algorithmic denial of service via SpEL expressions.
Fixes CVE-2026-41851, a denial of service via an unbounded cache in SpEL.
Fixes CVE-2026-41852, arbitrary method invocation in SpEL expressions.
Fixes CVE-2026-41853, multipart request smuggling in Spring MVC and WebFlux.
Fixes CVE-2026-41854, a server-side request forgery via UriComponentsBuilder.
UriComponentsBuilderFixes CVE-2026-41855, unsafe deserialization via Jackson JMS converters.
Warns against unsafe static resource locations in MVC and WebFlux.
Improves principal checks for SockJS session.
Platform1
Fix Jetty multipart client support with Java 25.
Deprecations to plan for
Deprecated3
Deprecates methodIdentification() in CacheAspectSupport for removal.
CacheAspectSupport.methodIdentification()CacheAspectSupportDeprecates PagedListHolder and PropertyComparator for removal.
PagedListHolderPropertyComparatorNotes that deprecated MockMvcClientHttpRequestFactory is required for tests with HTTP service interface proxy.
MockMvcClientHttpRequestFactoryAPI changes
Generated by DepDelta from published JVM bytecode. Not mixed with prose notes.
- changed:
class TransactionInterceptor extends TransactionAspectSupport implements MethodInterceptor, Serializable → class TransactionInterceptor extends TransactionAspectSupport implements MethodInterceptor, ApplicationEventPublisherAware, Serializable - changed:
method TransactionAspectSupport.completeTransactionAfterThrowing(TransactionAspectSupport.TransactionInfo, Throwable): void → method TransactionAspectSupport.completeTransactionAfterThrowing(TransactionAspectSupport.TransactionInfo, TransactionAspectSupport.InvocationCallback, Throwable): void - added:
class MethodRollbackEvent extends MethodFailureEvent - added:
ctor MethodRollbackEvent(MethodInvocation, Throwable, TransactionExecution) - added:
method MethodRollbackEvent.getFailure(): Throwable - added:
method MethodRollbackEvent.getTransaction(): TransactionExecution - added:
method TransactionAspectSupport.InvocationCallback.onRollback(Throwable, TransactionExecution): void - added:
method TransactionInterceptor.setApplicationEventPublisher(ApplicationEventPublisher): void
- removed:
ctor GenericReactiveTransaction(Object, boolean, boolean, boolean, boolean, Object)
- removed:
ctor DefaultTransactionStatus(Object, boolean, boolean, boolean, boolean, Object) - removed:
method SimpleTransactionScope.resolveContextualObject(String): Object - added:
static method TransactionSynchronizationManager.bindSynchronizedResource(Object, Object): void