spring-projects/spring-framework v7.0.9 on GitHub

⚠️ Attention Required

in Spring Framework 7.0.9, ForwardedHeaderFilter (Spring MVC) and ForwardedHeaderTransformer (WebFlux) each provide a boolean constructor argument whether to use the standard "Forwarded" header or the "X-Forwarded" alternative headers. A separate property turns on and off use of "X-Forwarded-Prefix". While the default constructor preserves the existing behavior, we recommend to use the new constructor to explicitly specify which forwarded headers to use to make the processing more deterministic and aligned with what is expected from the proxy. Please, see the updated Security Considerations section for details. In 7.1 with #37072 the default constructor is deprecated and marked for removal. #37090

Ignore an empty port value in URI parsing #37117
Avoid retaining class files in annotation metadata #37112
Add @Nullable annotations when treating Map.remove() as returning @Nullable #37067
Fix missing nullability in JdbcTemplate.batchUpdate #37012
Timeout property in RetryPolicy does not have a default constant #36983
Write native configuration files as UTF-8 #36972
DefaultServerRequest.ServletParametersMap.entrySet() does not retain HttpServletRequest.getParameterMap() order #36966
Perform nextKey within synchronization for SQLite as well #36959
Add support for custom ObjectInputFilter on DefaultDeserializer #36958
Revise resource bundle caching for common locales #36957
Improve nullability for getSession(*) in MockHttpServletRequest #36926
Improve fallback logic in ParameterContentNegotiationStrategy and ParameterContentTypeResolver #36925
Improve ambiguous match check on preflight request #36903
Improve Groovy markup template loading #36902
Improve request path handling on a Reactor Netty server #36893
Improve JettyWebSocketSession error handling #36891

EclipseLinkJpaDialect singleton lock in EclipseLinkConnectionHandle.getConnection() serializes all JDBC connection acquisitions under load #37085
MetadataReader fails to read byte[] array from annotation #37083
Character outside of permitted range in Content Disposition #37062
Release Jackson BufferRecycler to its pool in encoders #37059
Reset TwoByteMatcher partial match on mismatching byte #37053
Align domainToAscii with current WhatWG spec #37018
Ensure consistent ButtonTag value attribute processing #37017
SpEL's InlineList is cached as a mutable list in compiled mode #37001
Write native configuration file when only lambda hints are present #36989
SpEL Indexer reuses invalid cached PropertyAccessor #36986
SpEL reuses invalid cached ConstructorExecutor #36985
MimeTypeUtils raises StringIndexOutOfBoundsException for some invalid mime types #36971
Ignore DOCTYPE inside a multi-line comment body #36948
Avoid divide-by-zero in ExponentialBackOff jitter #36932
Refactor use or close lock in ConcurrentWebSocketSessionDecorator #36909
Host header initialization breaking change in StompRelayMessageBrokerHandler #36907
Remote address checks for SockJS session #36681 breaks xhr-polling #36904
LifeCyclePrintWriter does not delegate correctly #36885
IllegalArgumentException when creating named native query via Shared EntityManager with Hibernate 8.0.0-SNAPSHOT / JPA 4.0.0-M4 #36878

Document AOP proxy semantics for Bean Overrides in tests #37121
Provide guidance for object model design in SpEL #37102
Fix Javadoc error in ProtobufDecoder #37079
Document security implications of evaluating untrusted SpEL expressions #36997
Document relationships between expressions, evaluation contexts, and accessors in SpEL #36968
Update Javadoc for @ActiveProfiles ordering #36950
Document behavior for 0 delay combined with jitter in backoff policies #36946
Clarify design goal of UrlFilenameViewController in Javadoc #36906

Thank you to all the contributors who worked on this release: