Security
- CVE-2026-47836 — Spring Cloud Config Server Susceptible To TOCTOU Attack When Using SVN
- CVE-2026-47837 — Spring Cloud Config Server Monitor Endpoint Does Not Validate Webhook Requests
- CVE-2026-47894 — Spring Cloud Config Server Native Environment Repository Exposure
- CVE-2026-59315 — Spring Cloud Config Monitor Denial of Service
What's Changed
- docs: document .json alternative format endpoint and add URL pattern table by @won-seoop in #3245
- GH-572: Document Config Server behavior when Git backend is unavailable by @won-seoop in #3251
- docs: expand Config Server security guide by @won-seoop in #3247
- Expand embedded server docs with standalone vs embedded trade-offs (GH-1203) by @won-seoop in #3249
- Document sharing configuration across a subset of applications (GH-618) by @won-seoop in #3250
- Support Git-style searchPaths with wildcards in AWS S3 buckets (#2812) by @tomy8964 in #2958
- Bump antora from 3.2.0-alpha.12 to 3.2.0-rc.2 in /docs by @dependabot[bot] in #3255
- Bump actions/checkout from 6 to 7 by @dependabot[bot] in #3253
- Fix native file monitor relative URI handling by @hutiefang76 in #3258
- Bump actions/setup-java from 5.4.0 to 5.5.0 by @dependabot[bot] in #3259
- Ignore release train workflow files in Dependabot by @ryanjbaxter in #3263
- Bump org.apache.maven.plugins:maven-jar-plugin from 3.5.0 to 3.5.1 by @dependabot[bot] in #3264
- Bump @springio/antora-extensions from 1.14.12 to 1.14.13 in /docs by @dependabot[bot] in #3268
- Use '=' instead in encryption-and-decryption.adoc and server.adoc by @ngocnhan-tran1996 in #3269
New Contributors
- @won-seoop made their first contribution in #3245
- @tomy8964 made their first contribution in #2958
- @hutiefang76 made their first contribution in #3258
Full Changelog: v5.0.4...v5.0.5