Skip to content

Update dependency org.springframework.cloud:spring-cloud-dependencies to v2025.1.3 - #370

Open
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/spring-cloud
Open

Update dependency org.springframework.cloud:spring-cloud-dependencies to v2025.1.3#370
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/spring-cloud

Conversation

@renovate

@renovate renovate Bot commented Aug 31, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Type Update Change OpenSSF
org.springframework.cloud:spring-cloud-dependencies (source) import patch Hoxton.SR122025.1.3 OpenSSF Scorecard

Release Notes

spring-cloud/spring-cloud-release (org.springframework.cloud:spring-cloud-dependencies)

v2025.1.3

Security

This release train contains fixes for 17 CVEs across 5 modules.

Spring Cloud Commons 5.0.3

  • CVE-2026-59284 — Spring Cloud Commons no allow list for writable env actuator endpoint

Spring Cloud Config 5.0.5

  • CVE-2026-47836 — Spring Cloud Config Server Susceptible To TOCTOU Attack When Using SVN
  • CVE-2026-47837 — Spring Cloud Config Server Monitor Endpoint Does Not Validate Webhook Requests
  • CVE-2026-47894 — Spring Cloud Config Server Native Environment Repository Exposure
  • CVE-2026-59315 — Spring Cloud Config Monitor Denial of Service

Spring Cloud Function 5.0.4

  • CVE-2026-59291 — Potential arbitrary file read and SSRF vulnerability in Spring Cloud Function
  • CVE-2026-59297 — Spring Cloud Function can incorrectly determine if URI is secure
  • CVE-2026-59298 — Potential for improper filtering of HTTP headers in Spring Cloud Function
  • CVE-2026-59299 — Composition lookup can potentially poison base function in Spring Cloud Function
  • CVE-2026-59300 — Potential for logging sensitive data in Spring Cloud Function AWS
  • CVE-2026-59301 — Potential for logging sensitive data in Spring Cloud Function Azure

Spring Cloud Gateway 5.0.3

  • CVE-2026-47879 — Spring Cloud Gateway SSRF and native file access with gRPC

Spring Cloud Stream 5.0.3

  • CVE-2026-59302 — Potential for logging sensitive data in Spring Cloud Stream
  • CVE-2026-59303 — Dynamic destination cache size is not properly bound in Spring Cloud Stream
  • CVE-2026-59304 — Improper caching of the original content type in Spring Cloud Stream Avro
  • CVE-2026-59305 — Partition interceptor may be improperly added while sending message
  • CVE-2026-59306 — Potential for deserialization of untrusted types in Spring Cloud Stream

What's Included

  • Spring Cloud Build 5.0.3 (issues)
  • Spring Cloud Function 5.0.4 (issues)
  • Spring Cloud Stream 5.0.3 (issues)
  • Spring Cloud Commons 5.0.3 (issues)
  • Spring Cloud Bus 5.0.3 (issues)
  • Spring Cloud Task 5.0.2 (issues)
  • Spring Cloud Config 5.0.5 (issues)
  • Spring Cloud Netflix 5.0.2 (issues)
  • Spring Cloud Openfeign 5.0.3 (issues)
  • Spring Cloud Consul 5.0.3 (issues)
  • Spring Cloud Circuitbreaker 5.0.3 (issues)
  • Spring Cloud Gateway 5.0.3 (issues)
  • Spring Cloud Zookeeper 5.0.2 (issues)
  • Spring Cloud Kubernetes 5.0.3 (issues)
  • Spring Cloud Vault 5.0.2 (issues)

What's Changed

Full Changelog: spring-cloud/spring-cloud-release@v2025.1.2...v2025.1.3

v2025.1.2

Compare Source

What's Included

  • Spring Cloud Netflix 5.0.2 (issues)
  • Spring Cloud Stream 5.0.2 (issues)
  • Spring Cloud Config 5.0.4 (issues)
  • Spring Cloud Consul 5.0.2 (issues)
  • Spring Cloud Circuitbreaker 5.0.2 (issues)
  • Spring Cloud Starter Build 2025.1.2 (issues)
  • Spring Cloud Build 5.0.2 (issues)
  • Spring Cloud Gateway 5.0.2 (issues)
  • Spring Cloud Bus 5.0.2 (issues)
  • Spring Cloud Contract 5.0.3 (issues)
  • Spring Cloud Vault 5.0.2 (issues)
  • Spring Cloud Task 5.0.2 (issues)
  • Spring Cloud Function 5.0.3 (issues)
  • Spring Cloud Kubernetes 5.0.2 (issues)
  • Spring Cloud Commons 5.0.2 (issues)
  • Spring Cloud Openfeign 5.0.2 (issues)
  • Spring Cloud Zookeeper 5.0.2 (issues)

What's Changed

Full Changelog: spring-cloud/spring-cloud-release@v2025.1.1...v2025.1.2

v2025.1.1

Compare Source

What's Changed

Full Changelog: spring-cloud/spring-cloud-release@v2025.1.0...v2025.1.1

v2025.1.0

Compare Source

v2025.0.3

Compare Source

What's Included

  • Spring Cloud Bus 4.3.2 (issues)
  • Spring Cloud Openfeign 4.3.3 (issues)
  • Spring Cloud Circuitbreaker 3.3.3 (issues)
  • Spring Cloud Kubernetes 3.3.3 (issues)
  • Spring Cloud Function 4.3.4 (issues)
  • Spring Cloud Task 3.3.2 (issues)
  • Spring Cloud Stream 4.3.3 (issues)
  • Spring Cloud Starter Build 2025.0.3 (issues)
  • Spring Cloud Vault 4.3.3 (issues)
  • Spring Cloud Commons 4.3.3 (issues)
  • Spring Cloud Netflix 4.3.3 (issues)
  • Spring Cloud Consul 4.3.3 (issues)
  • Spring Cloud Gateway 4.3.5 (issues)
  • Spring Cloud Zookeeper 4.3.3 (issues)
  • Spring Cloud Config 4.3.4 (issues)
  • Spring Cloud Build 4.3.4 (issues)
  • Spring Cloud Contract 4.3.4 (issues)

What's Changed

Full Changelog: spring-cloud/spring-cloud-release@v2025.0.2...v2025.0.3

v2025.0.2

What's Changed

Full Changelog: spring-cloud/spring-cloud-release@v2025.0.1...v2025.0.2

v2025.0.1

v2025.0.0: 2025.0.0

Compare Source

Breaking Changes

Spring Cloud Gateway
  • New Module and Starter names have been created, and the old names are deprecated. The new and deprecated artifacts are listed in the table below #​3645. These new names clarify the two styles of gateway (server or proxy exchange) as well as the two web stacks from Spring Framework (Web MCV and WebFlux). Use of the deprecated artifacts will add a warning message in the logs.
Deprecated Artifact New Artifact
spring-cloud-gateway-server spring-cloud-gateway-server-webflux
spring-cloud-gateway-server-mvc spring-cloud-gateway-server-webmvc
spring-cloud-starter-gateway-server spring-cloud-starter-gateway-server-webflux
spring-cloud-starter-gateway-server-mvc spring-cloud-starter-gateway-server-webmvc
spring-cloud-gateway-mvc spring-cloud-gateway-proxyexchange-webmvc
spring-cloud-gateway-webflux spring-cloud-gateway-proxyexchange-webflux
  • Migration to new property prefixes to match the new module names: #​3361, #​3362, #​3363, #​3647. Use spring-boot-properties-migrator to support the deprecated prefixes. The table below lists the module or starter, its old prefix, and the new replacement prefix.
Module/Starter Deprecated prefix New prefix
spring-cloud-starter-gateway-server-webflux spring.cloud.gateway.* spring.cloud.gateway.server.webflux.*
spring-cloud-starter-gateway-server-webmvc spring.cloud.gateway.mvc.* spring.cloud.gateway.server.webmvc.*
spring-cloud-gateway-proxyexchange-webflux spring.cloud.gateway.proxy.* spring.cloud.gateway.proxy-exchange.webflux.*
spring-cloud-gateway-proxyexchange-webmvc spring.cloud.gateway.proxy.* spring.cloud.gateway.proxy-exchange.webmvc.*
  • The X-Forwarded-* and Forwarded header functionality will be disabled by default with the fix versions. If you require X-Forwarded-* or Forwarded header functionality, set spring.cloud.gateway.server.webflux.trusted-proxies to a Java Regular Expression that specifies the proxies whose headers you trust. If you are using Spring Cloud Gateway Server MVC (only available from 4.1.x onward) set spring.cloud.gateway.mvc.trusted-proxies. For example for Spring Cloud Gateway Server:
spring.cloud.gateway.server.webflux.trusted-proxies=10\.0\.0\..*

For example, for Spring Cloud Gateway Server WebMVC:

spring.cloud.gateway.server.webmvc.trusted-proxies=10\.0\.0\..*
Spring Cloud Kubernetes
  • Upgrade To Fabric8 7.3.1 from 6.13.x. This is necessary due to the use of Jackson 2.19.x in Spring Boot 3.5.0.
    There is precedence in upgrading a major dependency in a minor with Spring Data and database drivers. #​1923.

2025-05-29

  • Spring Cloud Starter Build 2025.0.0 (issues)
  • Spring Cloud Vault 4.3.0 (issues)
  • Spring Cloud Bus 4.3.0 (issues)
  • Spring Cloud Task 3.3.0 (issues)
  • Spring Cloud Zookeeper 4.3.0 (issues)
  • Spring Cloud Kubernetes 3.3.0 (issues)
  • Spring Cloud Function 4.3.0 (issues)
  • Spring Cloud Commons 4.3.0 (issues)
  • Spring Cloud Circuitbreaker 3.3.0 (issues)
  • Spring Cloud Openfeign 4.3.0 (issues)
  • Spring Cloud Stream 4.3.0 (issues)
  • Spring Cloud Consul 4.3.0 (issues)
  • Spring Cloud Gateway 4.3.0 (issues)
  • Spring Cloud Contract 4.3.0 (issues)
  • Spring Cloud Config 4.3.0 (issues)
  • Spring Cloud Build 4.3.0 (issues)
  • Spring Cloud Netflix 4.3.0 (issues)

Full Changelog: spring-cloud/spring-cloud-release@v2024.0.0...v2025.0.0

v2024.0.3

Compare Source

v2024.0.2

Compare Source

v2024.0.1

Compare Source

v2024.0.0: 2024.0.0

Compare Source

What's Changed

New Contributors

Full Changelog: spring-cloud/spring-cloud-release@v2023.0.3...v2024.0.0

v2023.0.6

v2023.0.5

v2023.0.4: 2023.0.4

Full Changelog: spring-cloud/spring-cloud-release@v2023.0.3...v2023.0.4

v2023.0.3

Compare Source

Full Changelog: spring-cloud/spring-cloud-release@v2023.0.2...v2023.0.3

Module Version Issues
Spring Cloud Vault 4.1.3
Spring Cloud Bus 4.1.2
Spring Cloud Zookeeper 4.1.2
Spring Cloud Kubernetes 3.1.3 (issues)
Spring Cloud Task 3.1.2 (issues)
Spring Cloud Function 4.1.3 (issues)
Spring Cloud Commons 4.1.4 (issues)
Spring Cloud OpenFeign 4.1.3 (issues)
Spring Cloud CircuitBreaker 3.1.2 (issues)
Spring Cloud Starter Build 2023.0.3
Spring Cloud Stream 4.1.3
Spring Cloud Gateway 4.1.5 (issues)
Spring Cloud Consul 4.1.2
Spring Cloud Contract 4.1.4 (issues)
Spring Cloud Config 4.1.3 (issues)
Spring Cloud Build 4.1.3
Spring Cloud Netflix 4.1.3 (issues)

v2023.0.2

Compare Source

Module Version Issues
Spring Cloud Vault 4.1.2 (issues)
Spring Cloud Kubernetes 3.1.2 (issues)
Spring Cloud Function 4.1.2 (issues)
Spring Cloud Commons 4.1.3 (issues)
Spring Cloud Openfeign 4.1.2 (issues)
Spring Cloud Starter Build 2023.0.2 (issues)
Spring Cloud Stream 4.1.2 (issues)
Spring Cloud Gateway 4.1.4 (issues)
Spring Cloud Contract 4.1.3 (issues)
Spring Cloud Config 4.1.2 (issues)
Spring Cloud Build 4.1.2 (issues)
Spring Cloud Netflix 4.1.2 (issues)

v2023.0.1

Compare Source

Module Version Issues
Spring Cloud Vault 4.1.1 (issues)
Spring Cloud Bus 4.1.1 (issues)
Spring Cloud Zookeeper 4.1.1 (issues)
Spring Cloud Kubernetes 3.1.1 (issues)
Spring Cloud Task 3.1.1 (issues)
Spring Cloud Function 4.1.1 (issues)
Spring Cloud Commons 4.1.2 (issues)
Spring Cloud Openfeign 4.1.1 (issues)
Spring Cloud Circuitbreaker 3.1.1 (issues)
Spring Cloud Starter Build 2023.0.1 (issues)
Spring Cloud Stream 4.1.1 (issues)
Spring Cloud Gateway 4.1.2 (issues)
Spring Cloud Consul 4.1.1 (issues)
Spring Cloud Contract 4.1.2 (issues)
Spring Cloud Config 4.1.1 (issues)
Spring Cloud Build 4.1.1 (issues)
Spring Cloud Netflix 4.1.1 (issues)

v2023.0.0: 2023.0.0

Compare Source

What's Changed

  • Spring Cloud Function 4.1.0 (issues)
  • Spring Cloud Vault 4.1.0 (issues)
  • Spring Cloud Zookeeper 4.1.0 (issues)
  • Spring Cloud Circuitbreaker 3.1.0 (issues)
  • Spring Cloud Task 3.1.0 (issues)
  • Spring Cloud Kubernetes 3.1.0 (issues)
  • Spring Cloud Starter Build 2023.0.0 (issues)
  • Spring Cloud Openfeign 4.1.0 (issues)
  • Spring Cloud Bus 4.1.0 (issues)
  • Spring Cloud Stream 4.1.0 (issues)
  • Spring Cloud Commons 4.1.0 (issues)
  • Spring Cloud Contract 4.1.0 (issues)
  • Spring Cloud Netflix 4.1.0 (issues)
  • Spring Cloud Consul 4.1.0 (issues)
  • Spring Cloud Config 4.1.0 (issues)
  • Spring Cloud Build 4.1.0 (issues)
  • Spring Cloud Gateway 4.1.0 (issues)

v2022.0.4

Compare Source

v2022.0.3: 2022.0.3

Compare Source

⭐ Releases

  • spring-cloud-build 4.0.3
  • spring-cloud-bus 4.0.1
  • spring-cloud-circuitbreaker 3.0.2
  • spring-cloud-commons 4.0.3
  • spring-cloud-config 4.0.3
  • spring-cloud-consul 4.0.2
  • spring-cloud-contract 4.0.3
  • spring-cloud-function 4.0.3
  • spring-cloud-gateway 4.0.6
  • spring-cloud-kubernetes 3.0.3
  • spring-cloud-netflix 4.0.2
  • spring-cloud-openfeign 4.0.3
  • spring-cloud-stream 4.0.3
  • spring-cloud-task 3.0.3
  • spring-cloud-vault 4.0.1
  • spring-cloud-zookeeper 4.0.0

v2022.0.2

Compare Source

v2022.0.1

Compare Source

v2022.0.0

Compare Source

v2021.0.9

Compare Source

v2021.0.8: 2021.0.8

Compare Source

⭐ Releases

  • spring-cloud-build 3.1.8
  • spring-cloud-bus 3.1.2
  • spring-cloud-circuitbreaker 2.1.7
  • spring-cloud-cli 3.1.1
  • spring-cloud-cloudfoundry 3.1.3
  • spring-cloud-commons 3.1.7
  • spring-cloud-config 3.1.8
  • spring-cloud-consul 3.1.4
  • spring-cloud-contract 3.1.8
  • spring-cloud-function 3.2.11
  • spring-cloud-gateway 3.1.8
  • spring-cloud-kubernetes 2.1.8
  • spring-cloud-netflix 3.1.7
  • spring-cloud-openfeign 3.1.8
  • spring-cloud-sleuth 3.1.9
  • spring-cloud-stream 3.2.9
  • spring-cloud-task 2.4.6
  • spring-cloud-vault 3.1.3
  • spring-cloud-zookeeper 3.1.4

v2021.0.7

Compare Source

v2021.0.6

Compare Source

v2021.0.5

Compare Source

v2021.0.4

Compare Source

v2021.0.3

Compare Source

v2021.0.2

Compare Source

v2021.0.1

Compare Source

v2021.0.0

Compare Source

v2020.0.6

Compare Source

v2020.0.5

Compare Source

v2020.0.4

Compare Source

v2020.0.3

Compare Source

v2020.0.2

Compare Source

v2020.0.1

Compare Source


Configuration

📅 Schedule: (in timezone America/Los_Angeles)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the dependencies Pull requests that update a dependency file label Aug 31, 2026
@renovate
renovate Bot enabled auto-merge (squash) August 31, 2026 10:58
@renovate
renovate Bot force-pushed the renovate/spring-cloud branch 2 times, most recently from df22b6c to 504b040 Compare August 31, 2026 23:31
@renovate
renovate Bot force-pushed the renovate/spring-cloud branch 12 times, most recently from c91f083 to 5214f3e Compare September 3, 2026 01:24
… to v2025.1.3

| datasource | package                                             | from        | to       |
| ---------- | --------------------------------------------------- | ----------- | -------- |
| maven      | org.springframework.cloud:spring-cloud-dependencies | Hoxton.SR12 | 2025.1.3 |


Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
@renovate
renovate Bot force-pushed the renovate/spring-cloud branch from 5214f3e to 28d2124 Compare September 3, 2026 05:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants