springdoc/springdoc-openapi v3.2.0

springdoc-openapi v3.2.0 released!

on GitHub

Spring Boot 4.1.x line (built on Spring Boot 4.1.2).

⚠️ Changes you may notice

• Default API version (#3354): the default API version is now only listed in the version header or query parameter of the operations that actually serve it (a handler mapped to it, or one without a version). Operations mapped only to other versions no longer show it as an allowed value or as their default. This also fixes the HTTP 500 raised when the version parameter declared @Schema(allowableValues).
• Newly required properties (#3360, #3361): the PagedModel / PageMetadata properties and the amount / currency properties of MonetaryAmount are now marked as required, as they are always serialized. Generated clients will see them as non-nullable.
• Scalar 0.6 (#3359): upgraded to 0.6.83. The first tag is now open by default, and model links changed from #model/name to #models/Name.
• Scalar's standalone integration (#3387): with the Swagger UI or API-only starters, Scalar's own auto-configuration is no longer disabled by springdoc. If you have com.scalar.maven on the classpath and don't want it, set scalar.enabled=false.

New

• Opt-in nullability for Java models (#3382): springdoc.model-converters.java-nullable-property-customizer.enabled=true marks properties annotated with @Nullable (JSpecify, Spring, JSR-305) as nullable, including $ref and oneOf properties, without changing shared components.
• Polymorphic oneOf as reusable components (#3390): springdoc.model-converters.polymorphic-converter.one-of-as-ref=true, with the name suffix set by springdoc.model-converters.polymorphic-converter.one-of-ref-suffix (Variant by default).
• ParameterCustomizer can read type-use annotations, including inside Optional<@MyAnnotation Foo> (#3370).
• MCP tools are registered with a McpStatelessSyncServer, for the Spring AI STATELESS protocol (#3388).

Fixed

• @ResponseStatus on a controller class is applied to its operations (#3352).
• An injected WebSession is no longer documented as a query parameter in WebFlux (#3355).
• The application no longer fails to start with Spring HATEOAS on the classpath but no LinkRelationProvider bean (#3364).
• WebAsyncTask return types are unwrapped (#3368).
• A JSpecify @Nullable on a controller parameter makes its schema nullable (#3377).
• Nullable Kotlin properties described by a oneOf (e.g. sealed classes) are documented as nullable (#3381).
• Gradle builds no longer lift Jackson 2 above the version managed by Spring Boot (#3373).

Security

• The MCP dashboard no longer pre-fills the OAuth2 token endpoint, client id and client secret, and warns when the token endpoint is not HTTPS.

Dependencies

Spring Boot 4.1.2 · swagger-ui 5.34.0 · Scalar 0.6.83 · Spring AI 2.0.1 · Spring Cloud Function 5.0.5 · spring-security-oauth2-authorization-server managed by Spring Boot (7.1.2)

Thanks to all the contributors of this release: @MaxFreedomPollard, @kdelay, @arimu1, @dpkass, @anupamchaubey, @Mattias-Sehlstedt, @Naresh7175, @ys0v9, @sharanggupta, @itd-sw, @gwr0-0, @Tework123, @awinishere.