Update dependency org.springframework:spring-context to v6 [SECURITY] (3.30)

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
org.springframework:spring-context	5.3.39 -> 6.0.0

---

Spring Framework DataBinder Case Sensitive Match Exception

CVE-2025-22233 / GHSA-4wp7-92pw-q264

More information

Details

CVE-2024-38820 ensured Locale-independent, lowercase conversion for both the configured disallowedFields patterns and for request parameter names. However, there are still cases where it is possible to bypass the disallowedFields checks.

Affected Spring Products and Versions

Spring Framework:

• 6.2.0 - 6.2.6

• 6.1.0 - 6.1.19

• 6.0.0 - 6.0.27

• 5.3.0 - 5.3.42

• Older, unsupported versions are also affected

Mitigation

Users of affected versions should upgrade to the corresponding fixed version.

Affected version(s)	Fix Version	Availability
6.2.x	6.2.7	OSS
6.1.x	6.1.20	OSS
6.0.x	6.0.28	Commercial https://enterprise.spring.io/
5.3.x	5.3.43	Commercial https://enterprise.spring.io/

No further mitigation steps are necessary.

Generally, we recommend using a dedicated model object with properties only for data binding, or using constructor binding since constructor arguments explicitly declare what to bind together with turning off setter binding through the declarativeBinding flag. See the Model Design section in the reference documentation.

For setting binding, prefer the use of allowedFields (an explicit list) over disallowedFields.

Credit

This issue was responsibly reported by the TERASOLUNA Framework Development Team from NTT DATA Group Corporation.

Severity

• CVSS Score: 3.1 / 10 (Low)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-22233
• https://github.com/spring-projects/spring-framework/issues/34801
• https://github.com/spring-projects/spring-framework/commit/edfcc6ffb188e4614ec9b212e3208b666981851c
• https://github.com/spring-projects/spring-framework/commit/ee62701f5634e904e42e218baad142cea2bcd332
• https://github.com/spring-projects/spring-framework
• https://spring.io/security/cve-2025-22233

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Spring Framework DataBinder Case Sensitive Match Exception

CVE-2024-38820 / GHSA-4gc7-5j7h-4qph

More information

Details

The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive. However, String.toLowerCase() has some Locale dependent exceptions that could potentially result in fields not protected as expected.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-38820
• https://github.com/spring-projects/spring-framework/commit/23656aebc6c7d0f9faff1080981eb4d55eff296c
• https://github.com/spring-projects/spring-framework
• https://github.com/spring-projects/spring-framework/commits/v6.2.0-RC2
• https://security.netapp.com/advisory/ntap-20241129-0003
• https://spring.io/security/cve-2024-38820

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

spring-projects/spring-framework (org.springframework:spring-context)

v6.0.0

See What's New in Spring Framework 6.x and Upgrading to Spring Framework 6.x for upgrade instructions and details of new features.

⭐ New Features

• Avoid direct URL construction and URL equality checks #​29486
• Simplify creating RFC 7807 responses from functional endpoints #​29462
• Allow test classes to provide runtime hints via declarative mechanisms #​29455

📔 Documentation

• Align javadoc of DefaultParameterNameDiscoverer with its behavior #​29494
• Document AOT support in the TestContext framework #​29482
• Document Ahead of Time processing in the reference guide #​29350

🔨 Dependency Upgrades

• Upgrade to Reactor 2022.0.0 #​29465

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​ophiuhus and @​wilkinsona

---

Configuration

📅 Schedule: Branch creation - "" in timezone Europe/Zurich, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update. You will not get PRs for any future 6.x releases. But if you manually upgrade to 6.x then Renovate will re-enable minor and patch updates automatically.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.