Update dependency org.springframework:spring-framework-bom to v7

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
org.springframework:spring-framework-bom	6.2.16 → 7.0.5

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

spring-projects/spring-framework (org.springframework:spring-framework-bom)

v7.0.5

Compare Source

v7.0.4

Compare Source

⭐ New Features

• Cache method annotations in MethodParameter and AnnotatedMethod #​36307
• Consistently support @Lazy as a meta-annotation at arbitrary depths #​36306
• Consistently support @Validated as a meta-annotation at arbitrary depths #​36305
• Let developers disable default registrations in HttpMessageConverters #​36303
• Log which HandlerInterceptor threw the exception #​36281
• Improve performance of hashcode calculations for request mappings #​36279
• Improve performance of HandlerMethod bean lookup #​36278
• Improve performance of version mapping #​36276
• Improve performance of single pattern request mappings #​36275
• Improve performance of validation groups determination #​36274
• Add setPackagesToScan configuration method to LocalEntityManagerFactoryBean #​36270
• Remove outdated GraalVM substitution #​36257
• Introduce beforeRetry callback with RetryState argument #​36245
• Optimize NamedParameterUtils#buildValueArray by lazily fetching SqlParameter #​36230
• Allow customization of the ProxyFactory in HttpServiceProxyFactory used to create HTTP service proxies #​36225
• Consistently close streams through try-with-resources in FileCopyUtils #​36223
• Use Java Files utilities in FileCopyUtils #​36221
• SqlBinaryValue and SqlCharacterValue should support InputStream content with undetermined length #​36219
• Support JtaTransactionManager and SpringBeanContainer configuration on HibernateJpaVendorAdapter #​36216
• Add TaskCallback/Callable/Runnable wrapper for retryable tasks #​36208
• Refine YamlProcessor to allow different empty values #​36207
• Anticipate fixing Kotlin 2.3 compilation warning #​36203
• Allow YAML processors to create a flattened map with nulls included #​36197
• Use Reader.transferTo in FileCopyUtils #​36196
• DataBufferUtils.write() with NettyDataBuffer on JDK 25 hangs indefinitely #​36184
• Make SendToMethodReturnValueHandler and SubscriptionMethodReturnValueHandler customizable, to allow for pass-through of message headers #​36179
• Introduce RestClient.ResponseSpec#requiredBody #​36173
• Make scope fully configurable in BeanRegistry/BeanRegistrar #​36171
• ConcurrencyThrottleSupport and thread interruption #​36167
• Add overloaded sendAndReceive methods to JmsTemplate to use explicit response queue #​36162
• WebClient (Reactor) attributes on Netty channel do not clear after connection release #​36158
• Support HttpEntity on ContentRequestMatchers.multipartData #​36154
• Reintroduce WebLogicJtaTransactionManager in Spring Framework 6.2.x #​36151
• Back-off for DefaultMessageListenerContainer is not applied consistently in case of listener setup failure #​36143
• Early support for JPA 4.0 EntityAgent (autowiring a shared proxy) #​36025
• Early compatibility with JPA 4.0 and Hibernate ORM 8.0 #​35705

🐞 Bug Fixes

• Resolved HttpEntity Controller argument does not reflect mutated HTTP headers #​36298
• Avoid lock congestion in ConcurrentReferenceHashMap #​36293
• AbstractMessageConverter does not support wildcards in supported MIME types #​36285
• Make LocalEntityManagerFactoryBean#setDataSource work on Hibernate as well as EclipseLink #​36271
• StompBrokerRelayMessageHandler fails to restart due to test context pausing #​36266
• Deadlock might occur when calling System.exit on startup (against multiple shutdown hooks) #​36260
• Missing resource hint for BeanRegistrar implementing ImportAware #​36242
• Inconsistent behavior with @Retryable on annotated interfaces #​36233
• Netty4HeadersAdapter.remove returns empty list instead of null for non-existing key #​36226
• Generic type in AsyncTaskExecutor.submit(Callable) should be @Nullable #​36191
• EclipseLinkConnectionHandle can fail against transaction isolation race condition #​36165

📔 Documentation

• Remove obsolete code in Redirecting to a resource section #​36284
• Fix formatting in Web MVC HTTP Message Conversion documentation #​36250
• Remove obsolete doc for spring.context.annotated-bean-reader.create #​36241
• Document @SpringExtensionConfig in the reference manual #​36240
• Fix JSON syntax in STOMP overview documentation #​36229
• Revise documentation on JSR-330 support in the reference manual #​36222
• Fix links to JUnit User Guide #​36217
• Corrected the definition of coroutines #​36209
• Fix LocalContainerEntityManagerFactoryBean#setPersistenceUnitName javadoc #​36205
• Update documentation on trailing slash handling where type-level @GetMapping("/base") is combined with method level @GetMapping("/") #​36198
• Update documentation on the MediaType used for ProblemDetail #​36192
• Extract DispatcherServlet snippets #​36175
• Replace getErrors() with getBindingResult() in examples #​36170
• Refine CORS documentation to match latest changes #​36156

🔨 Dependency Upgrades

• Upgrade to Apache POI 5.5 #​36174
• Upgrade to ASM 9.9.1 and Objenesis 3.5 #​36243
• Upgrade to Micrometer 1.6.3 #​36287
• Upgrade to Reactor 2025.0.3 #​36288

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​Ivarz, @​catturtle123, @​chschu, @​deejay1, @​dingqianwen, @​dungdm93, @​furaizi, @​izeye, @​kchung1995, @​kilink, @​msridhar, @​ngocnhan-tran1996, @​pgoslatara, @​philwebb, @​pisek, and @​shub-est

v7.0.3

Compare Source

⭐ New Features

• DisconnectedClientHelper should detect presence of RestClientException and WebClientException separately #​36141
• Deprecate PagedListHolder and PropertyComparator for removal #​36139
• Add DataAccessException and MessagingException to the excluded outermost exceptions in DisconnectedClientHelper #​36134
• Support property placeholders in HTTP service registry #​36126
• Introduce Spring property to disable context pausing for tests #​36117
• Retain original requested bean class for SpringContainedBean #​36116
• Add task rejection support to SyncTaskExecutor's concurrency throttle #​36114
• Precompute PropertyDescriptor array in SimpleBeanInfoFactory #​36112
• Add option for @ConcurrencyLimit to throw rejection exception #​36109
• Support HttpComponents 5.6 #​36100
• Fix double encoding in DefaultApiVersionInserter #​36097
• Optimize single-char wildcard path matching performance #​36095
• Allow WebFlux ApiVersionResolver to return a Mono #​36084
• Configure HttpMessageConverters as a list #​36083
• HTTP Interface with an @RequestBody Object method parameter should use class of actual value #​36078
• Consistently declare @Nullable on parameter in equals() implementations #​36075
• Support listener registration for @Transactional triggered method rollbacks #​36073
• Introduce generalized MethodFailureEvent for use in EventPublicationInterceptor #​36072
• Avoid duplicate flushes in StringHttpMessageConverter #​36065
• When no API version is provided, static resources fail to load #​36059
• When no API version is provided, /error requests also fail. #​36058
• Declare TaskCallback return value as potentially nullable #​36057
• Fix case-insensitive semantics for LinkedCaseInsensitiveMap entrySet #​36056
• Update to NullAway 0.12.15 and fix new warnings #​36054
• Provide alternative to execute(Retryable) which avoids RetryException in favor of rethrowing the last original RuntimeException #​36052
• Avoid unnecessary pausing of application contexts in the TestContext framework #​36044
• Simplify TransactionalOperator.executeAndAwait by removing Optional #​36039
• Deprecated MockMvcClientHttpRequestFactory is required for tests with HTTP service interface proxy #​35989
• Introduce Jackson XML codecs #​35752
• Support listener registration for @Retryable triggered retry executions #​35382

🐞 Bug Fixes

• Fix SmartFactoryBean type matching for ResolvableType.NONE #​36123
• AbstractMessageSendingTemplate ignores headers in convertAndSend() variant #​36120
• JmsClient.sendAndReceive() fails if headers are included #​36118
• PropertyDescriptorUtils does not reliably resolve overloaded write methods #​36113
• Fix context class resolution for nested types in AbstractJacksonHttpMessageConverter #​36111
• DefaultApiVersionInserter encodes already encoded URI #​36080
• ConverterFactory nullness mismatch with Converter #​36063
• WiretapConnector leaks data buffers when response body not consumed #​36050
• CompilationException should not use -1 for line or column numbers when they are unknown #​36041
• org.springframework.core.test.tools.TestCompiler.Errors should handle case where warnings are turned into errors #​36037
• UriComponentsBuilder loses the fragment when it consists of only a single character #​36029
• Parameter names of the handler method are null in HandlerInterceptor::preHandle during first invocation of an endpoint #​36024
• PropertyDescriptorUtils does not reliably resolve read/write methods in type hierarchies with generics #​36019
• Illegal reflection use against Hibernate Validator 9 on module path #​36012

📔 Documentation

• Clarify unversioned handler matching precedence #​36125
• Clarify meaning of maxAttempts in FixedBackOff vs. maxRetries in RetryPolicy #​36119
• Polishing AOT cache documentation #​36108
• Upgrade Antora dependencies #​36105
• Modernize the DispatcherServlet Locale documentation #​36099
• Fix Kotlin example in Multipart Content #​36094
• Remove @EnableWebFlux from documentation code snippets #​36091
• Fix Kotlin example in CORS and Functional Endpoints references #​36089
• Extract remaining WebMVC configuration snippets #​36088
• Remove the "Other Web Frameworks" documentation #​36086
• Fix reference links in Configuration page #​36079
• Document HttpHeaders#toSingleValueMap() case-sensitive behavior #​36070
• Correct encode Javadoc for UriComponents and UriComponentsBuilder #​36040
• Fix typos and grammar #​36022
• Custom @ExceptionHandler silently ignored when spring.mvc.problemdetails.enabled=true without @Order #​35982
• Document how to discard response body with WebTestClient #​35953
• Modernize the view technologies section #​35450
• Remove JavaScript/Kotlin from ScriptEngine documentation #​27919

🔨 Dependency Upgrades

• Upgrade to Micrometer 1.16.2 #​36145
• Upgrade to Reactor 2025.0.2 #​36144

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​JKaplanEmpty-Nes, @​MukjepScarlet, @​TerryTaoYY, @​haydenrear, @​jhan0121, @​jher235, @​marcphilipp, @​mipo256, @​msridhar, @​ngocnhan-tran1996, @​parkhojeong, @​philipbolting, @​playous, @​quaff, @​thelightway24, and @​xyraclius

v7.0.2

Compare Source

⭐ New Features

• Avoid unnecessary list creation and processing in AbstractTestContextBootstrapper #​35995
• AbstractTestContextBootstrapper should resolve ContextLoader only once #​35994
• Log RetryException for @Retryable methods #​35983
• Consistently stop already started Lifecycle beans on cancelled refresh #​35964
• Support timeouts in @Retryable and RetryPolicy #​35963
• Use == instead of instanceof for primitive array type checks #​35962
• Introduce MultiValueMapCollector for use with streams #​35958
• Avoid package cycle caused by use of UriComponentsBuilder in ServletServerHttpRequest #​35952
• Target type in Converter interface should be @Nullable #​35947
• Provide access to attempt count in RetryListener as well as callbacks for the initial attempt #​35940
• DefaultHandshakeHandler should not log client faults on error level #​35930
• Log warning when meta-annotation is ignored due to types not present in classpath #​35927
• Revise ApplicationContext#getId() nullability to non-null #​35925
• Use concurrent set behind reactive TransactionSynchronizationManager#registerSynchronization #​35921
• Refine AbstractKotlinSerializationHttpMessageConverter#canWrite #​35920
• Register bean dependency for Optional injection point as well #​35919
• Change canRead/canWrite overrides to Class ones in AbstractSmartHttpMessageConverter #​35916
• Do not make HttpHeaders read-only in HttpEntity #​35888
• Add WebFlux SSE support with GSON #​35884
• Different ReactorNettyWebSocketSession call getId() may return the same value #​35883
• Refine nullability of Assert#noNullElements #​35868
• Allow configuring default maxIdleTime on InMemoryWebSessionStore. #​35866
• Refine BindingReflectionHintsRegistrar with ObjectToObjectConverter hints #​35847
• Add resetCaches() method to general CacheManager interface #​35845
• Enhance handleTypeMismatch error message in ResponseEntityExceptionHandler #​35837
• Add support for package-private BeanRegistrar in Spring AOT generated code #​35803
• Use ExtendedServletRequestDataBinder/ExtendedWebExchangeDataBinder for functional request binding #​35800
• Expose Collection on FragmentsRendering to facilitate Unit Tests #​35775
• Improve i18n-support for NoResourceFoundException #​35758
• Cache resolved singleton beans in injected Provider instance #​35373

🐞 Bug Fixes

• ContextConfigurationAttributes(Class) constructor incorrectly sets inheritLocations to false #​36000
• NullPointerException thrown from JdkClientHttpRequestFactory for null request header value #​35996
• State inconsistency in LazyConnectionDataSourceProxy when connection settings fail #​35980
• SubscriberInputStream#resume misuses parked thread reference #​35978
• Shared EntityManager returned by AbstractEntityManagerFactoryBean cannot be advised by AspectJ interceptor #​35974
• RestClient cannot make HEAD requests when the response declares gzip Content-Encoding #​35966
• ServerRequestObservationContext(s) miss Propagator.Getter method implementation #​35965
• Jackson used instead of kotlinx.serialization for more complex types #​35960
• Strong locking in ConcurrentReferenceHashMap#computeIfAbsent may cause context initialisation deadlock #​35944
• BridgeMethodResolver change in 6.2.13 breaks Spring Data entity introspection #​35936
• DefaultMessageListenerContainer does not clear Session and MessageConsumer for paused invokers #​35932
• Tighten cacheable decision behind @Lazy injection point #​35917
• AOT-generated bean definition does not consider name of RuntimeBeanReference using name and type #​35913
• Accidental fallback match for Collection-type beans due to @Bean-level qualifier annotation #​35908
• SingletonSupplier should be defensive against singletonInstance/initialized visibility mismatch #​35905
• SortedResourcesFactoryBean does not accept non-existent resources anymore #​35895
• Support reading unresolvable types in AbstractJacksonHttpMessageConverter #​35889
• Refine Kotlin Serialization codec type checks #​35885
• UrlHandlerFilter also removes query parameters and fragment when using HTTP redirect #​35873
• Fix handling of ServerSentEvent with Jackson encoder #​35872
• @EnableResilientMethods does not participate in globally enforced target class proxying #​35863
• RestTestClient can leak HTTP connections when no body expectations are performed #​35784
• Use provided ReactiveAdapterRegistry in BindingContext constructor #​35771
• PathMatchingResourcePatternResolver fails with URI in JAR manifest Class-Path entries #​35682

📔 Documentation

• Correct link to Reactive Libraries in reference docs #​35970
• Document that annotations are ignored if attributes reference types not present in the classpath #​35959
• Remove JUnit 4 based meta-annotation example #​35903
• Refer to "Spring Tools" instead of "Spring Tools for Eclipse" in reference manual #​35901
• Document that SpringExtension requires JUnit Jupiter 6.0 or higher #​35900
• Fix broken Javadoc links to methods #​35899
• Clarify JMS sessionTransacted flag for local versus global transaction #​35897
• Reference docs should not use obsolete "junit5" links #​35892
• Testing chapter references nonexistent Dependency Management documentation #​35890
• Wrong interface in WebFlux Documentation page for API Version #​35887
• Update reference documentation to use Jackson 3 #​35886

🔨 Dependency Upgrades

• Upgrade to json-path 2.10.0 #​35924
• Upgrade to Micrometer 1.16.1 #​35984
• Upgrade to Reactor 2025.0.1 #​35985

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​JohnNiang, @​Pankraz76, @​florianhof, @​ivonaest, @​izeye, @​jnizet, @​ngocnhan-tran1996, @​remeio, and @​zamzterz

v7.0.1

Compare Source

⭐ New Features

• Align RestOperations Kotlin extensions nullability with Java one #​35852
• Add resetCaches() method to Caffeine/ConcurrentMapCacheManager #​35840
• Fix single-check idiom in UnmodifiableMultiValueMap #​35822
• Fix Spliterator characteristics in ConcurrentReferenceHashMap #​35817
• RestTestClient does not configure JsonPathAssertions in the same way as WebTestClient #​35793

🐞 Bug Fixes

• Fix JdbcOperations Kotlin extensions #​35846
• Fix getCacheNames() concurrent access in NoOpCacheManager #​35842
• Annotation discovery regression for interfaces extending BeanNameAware and co. #​35835
• MissingPathVariableException produces wrong status code in ProblemDetail #​35829
• Refine ParameterizedPreparedStatementSetter nullability #​35749
• Fix HtmlUtils unescape for supplementary chars #​35477

📔 Documentation

• Fix cross-reference links in HtmlUnit sections #​35853
• Remove @see Javadoc references to deprecated PropertiesBeanDefinitionReader #​35836
• Replace kotlin-issues attribute reference #​35820
• Document semantics and behavior of SpringExtension.getApplicationContext() #​35764

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​juntae6942, @​kilink, @​ngocnhan-tran1996, and @​quaff

v7.0.0

Compare Source

🍃 Please read the official release notes and upgrade guide

⭐ New Features

• Make SessionHolder publicly accessible for external resource management #​35799
• RouterFunctions Builders do not support ServerResponse subtypes #​35791
• Configure Jackson CBOR codecs by default if present #​35787
• Rename maxAttempts to maxRetries in @Retryable and RetryPolicy #​35772
• Prevent Kotlin Serialization side effects #​35761
• Add default API version to the list of supported versions #​35755
• Improve user check in TransportHandlingSockJsService #​35753
• Update ApiVersionDeprecationHandler to provide access to handler #​35750
• Use dedicated classes for ApiVersionResolver implementations #​35747
• Provide AOT support for @Nested classes in a @ParameterizedClass #​35744
• AssertJ support for WebTestClient #​35737
• Reject attempt to use @MockitoSpyBean with a scoped proxy #​35722
• Provide a way to supply the client builder for an HttpServiceGroup #​35707
• Review HttpMessageConverters.Builder to improve readability of code using the API #​35704
• Configure custom Kotlin Serialization converter on HttpMessageConverters #​35733

🐞 Bug Fixes

• Missing support for UnprocessableContent in WebClientResponseException.create(HttpStatusCode, ..) methods #​35802
• Relax media type checks in HttpMessageConverters #​35801
• Fix HttpHeaders and WebSocketHttpHeaders interop issues #​35792
• @ConcurrencyLimit weird behavior when combined with @Async and @Transactional #​35788
• buildSrc:test failing on JDKs before JDK 25 #​35777
• Add jar validation and fix multi-release jar #​35768
• Upgrade to JUnit 6.0.1 and prevent AOT test scanning failure for JUnit 4 tests #​35740
• Fix port handling in HtmlUnitRequestBuilder #​35709
• RestTestClient.mutate() should not have side effects #​35698

📔 Documentation

• Document workaround for @PersistenceContext and @PersistenceUnit in test classes in AOT #​31442

🔨 Dependency Upgrades

• Upgrade to Jetty 12.1.4 #​35805
• Upgrade to Micrometer 1.16.0 #​35811
• Upgrade to Reactor 2025.0.0 #​35779

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​Sineaggi and @​UpStreamThomas

---

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[A1exKH]

LGTM.

[MarkEWaite]

LGTM.

A major version upgrade of Spring framework needs significant analysis before we merge it. Please don't merge this until someone has spent the time to assess the changes in the upgrade from Spring 6 to Spring 7.

[MarkEWaite]

I'm requesting changes on this pull request until someone does the detailed analysis to understand the Jenkins impact of upgrading to Spring Framework 7

[NotMyFault]

LGTM.

A major version upgrade of Spring framework needs significant analysis before we merge it. Please don't merge this until someone has spent the time to assess the changes in the upgrade from Spring 6 to Spring 7.

While the build is green, there are some underlying changes, which could impact plugins, given APIs have been removed. I'd recommend testing spring-core and -security v7 together.

[jglick]

I'd recommend testing spring-core and -security v7 together.

#11304 yes. Deserves a run through bom at least.

[github-actions]

Please take a moment and address the merge conflicts of your pull request. Thanks!