[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
org.springframework:spring-expression	7.0.9 → 7.0.10

---

Release Notes

spring-projects/spring-framework (org.springframework:spring-expression)

v7.0.10

⭐ New Features

• Align DelegatingMessageSource fallback implementation with AbstractMessageSource #​37383
• HttpEntity(T, MultiValueMap) stores an HttpHeaders unchecked, causing IncompatibleClassChangeError inside RestTemplate #​37358
• Recognize relocated Mockito MockAccess interface in ProxyProcessorSupport #​37342
• Runtime compatibility with JPA 4.0 M7 and corresponding Hibernate 8.0 snapshots #​37315
• Avoid Kotlin reflection in MethodParameter for non-suspending functions #​37300
• Revise underscore naming fallback in SimplePropertyRowMapper #​37297
• Avoid useless queue ops in ConcurrentLruCache.clear() #​37292
• PathMatchingResourcePatternResolver misses jars on java.class.path whose path contains % #​37280
• Remove redundant whitespace in exception messages #​37277
• OpenInView does no longer work with HibernateTransactionManager #​37273
• Lazily handle setClientInfo/setNetworkTimeout in LazyConnectionDataSourceProxy #​37261
• Avoid redundant filtering in FilteredMap.size() #​37256
• Support NaN and inifinite float values in toString() for synthesized annotations #​37244
• Use ArrayList instead of LinkedList in CompositeRetryListener #​37231
• redirectedUrl() argument in MockMvcResultMatchers should be @Nullable #​37230
• Published Gradle module file is missing javadocElements and sourcesElements #​37209
• Introduce a builder for SpelParserConfiguration #​37187
• Protobuf support classes all implement getMessageBuilder() #​37147
• Allow null contextPath in ServerHttpRequest.Builder #​37099
• Log broker availability events as String messages #​36856

🐞 Bug Fixes

• Avoid unnecessary dependent-bean registration for autowire-by-type #​37424
• Handle zero readTimeout in JdkClientHttpConnector #​37412
• Race condition in PartGenerator.CreateFileState can lose the completion signal #​37409
• Paused executor with late shutdown leaks its worker thread (and the closed context) after close #​37406
• Fix hanging retries for Flux-returning methods with caching #​37403
• Avoid serving stale values after failed refill in AbstractIdentityColumnMaxValueIncrementer #​37402
• Copy cookies in RenderingResponse.from() #​37378
• Avoid phantom keys in LinkedCaseInsensitiveMap.computeIfAbsent #​37351
• Fix single-value adaptation for primitive array types in TypeMappedAnnotation #​37349
• CssLinkResourceTransformer fails for invalid CSS links #​37336
• Fix cached ID reuse after commit failure in MySQLMaxValueIncrementer #​37322
• Fix connection leak in MySQLMaxValueIncrementer #​37321
• @CacheEvict truncates Flux results to the first element #​37309
• ConcurrentLruCache.clear() can miss entries added while it's running #​37287
• Enforce disk usage limit when spilling part to disk #​37285
• Prevent double size decrement in ConcurrentLruCache #​37268
• LogAccessor.debug(CharSequence) eagerly renders LogMessage since spring-core 7 switched from spring-jcl to commons-logging #​37266
• WebFlux loses empty multipart file when the file part is not last. #​37264
• Complete empty Uni instances from the Mutiny reactive adapter #​37259
• DefaultAsyncServerResponse.writeAsync() discards previously configured AsyncWebRequest timeout #​37257
• Provide missing native image hints for proxied hibernate 8 query types #​37251
• Provide missing native image hint for StatelessSession proxy created by SharedEntityManagerCreator. #​37249
• Provide missing native image reflection hint for hibernate PersistenceUnitInfoDescriptor. #​37247
• Sort duplicate key codes in SQLErrorCodes #​37235
• Handle zero readTimeout in JdkClientHttpRequestFactory #​37234
• Wrong reconnection attempt count in ReactorNettyTcpClient #​37223
• Stored procedure OUT parameter values are lost outside a transaction as of 7.0.9 #​37221
• Avoid int overflow in expiration time calculations in MockMvc and FlashMap #​37208
• ScheduledAnnotationBeanPostProcessor doesn't correctly support bean destruction #​37207
• Normalize function return parameter lookup in CallMetaDataContext #​37206
• Fix out-of-bounds read for truncated percent-escape in opaque host #​37203
• ClassFileTransformerAdapter deadlocks between two persistence units under load-time weaving #​37199
• Fix Kotlin value class handling for suspending AOP methods #​37191
• Update to NullAway 0.14.0 and fix new warnings #​37188
• ProtobufJsonEncoder emits JSON array when media type is ndjson #​37158
• streamingMediaTypes in ProtobufJsonEncoder not a subset of encodableMimeTypes #​37154
• Align DataBufferUtils$WriteCompletionHandler exception handling with the read() side #​37145
• DataBufferUtils.read() with NettyDataBuffer on JDK 25 hangs indefinitely #​37143
• Release queued body token buffers on multipart cancel #​37115
• Preserve async API version resolver order #​37096
• ClientResponse.mutate() builder can modify originalResponse headers. #​37086
• Custom reason is overwritten by i18n message in ResponseStatusException.updateAndGetBody() #​36984
• Generate compilable code for non-finite floating-point values #​36965
• Render parameter type names in ClassFileMethodMetadata #​36919
• Honor sourceStart offset in AbstractXMLStreamReader#getTextCharacters #​36914
• Fix reserveMethodNames to reserve each supplied name #​36912
• Replace thread-unsafe SimpleDateFormat with DateTimeFormatter in AbstractMockHttpServletRequestBuilder #​36772
• MockHttpServletRequest.isRequestedSessionIdValid() does not follow Servlet 6.1 Javadoc #​36631
• Map version from @HttpExchange to RequestMappingInfo #​36602
• Ensure that ConversionService.canConvert(Enum) no longer throws an exception #​34532

📔 Documentation

• Fix incorrect class names in WebFlux and MVC docs #​37467
• Document the XXE threat model of SourceHttpMessageConverter #​37407
• Update instructions for importing projects into Eclipse IDE #​37397
• Fix syntax errors in the reference manual #​37392
• Fix Kotlin example in Spring MVC test docs #​37388
• Document usage of type attribute in JSP <form:input> tag #​37376
• Make CONTRIBUTING.md self-contained and add AGENTS.md #​37372
• Clarify ConcurrentReferenceHashMap reference semantics #​37357
• Add missing enclosing single quotes in Javadoc #​37338
• Fix MockMvc async requests example in documentation #​37318
• Add closing braces to examples #​37305
• Fix typos in Javadoc #​37229
• Further updates to Data Binding Content in Web Sections of Documentation #​37228
• Add missing closing parenthesis in WebFlux config reference example #​37163
• Use <<id,text>> instead of xref: for local links in reference docs #​37161
• Fix broken internal xref links in reference docs #​37152
• Fix Kotlin examples in the reference manual #​37101
• Document combining @Retryable with proxy-based features #​37005
• Update recommendations for web data binding #​36789

🔨 Dependency Upgrades

• Upgrade to Micrometer 1.16.8 #​37440
• Upgrade to Reactor 2025.0.8 #​37374

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​Gabriel-Gerhardt, @​Gimini-3, @​SebTardif, @​a-kogun, @​cj848, @​cookie-meringue, @​dmitrysulman, @​garvit-joshi, @​geonheeryu, @​guanchengang, @​hunseonglee, @​jhan0121, @​junhyeong9812, @​kodacme, @​lejuho, @​moonfruit, @​msridhar, @​ngocnhan-tran1996, @​noojung, @​renatomameli, @​rene-schakmann, @​shaggyinsomniac, @​timtebeek, and @​xoruddl

---

Configuration

📅 Schedule: (in timezone CET)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[hashicorp-vault-sonar-prod]

Renovate Jira issue ID: SONARJAVA-7250

[gitar-bot]

CI failed: Three unrelated infrastructure failures in the Spring Expression 7.0.10 bump PR: Artifactory returned 503s during Maven dependency resolution, and Vault returned HTTP 500 during authentication in two separate jobs. None are linked to the change.

Overview

Three distinct error templates were analyzed across three logs, all from the same commit 5695f96. All three point to infrastructure availability problems rather than code or test failures, and none were judged related to the PR.

Failures

Artifactory 503 during Maven dependency resolution (confidence: high)

• Type: infrastructure
• Affected jobs: 122098305416
• Related to change: no
• Root cause: Maven could not resolve several SonarSource artifacts (e.g. sonar-scanner-integration-tester:jar:<VER>.1412, sonarlint-core-test-utils, sonar-plugin-api, sonar-orchestrator-junit4, sonar-ws) from the sonarsource repository on repox-internal.dev.sonar.build, which returned 503 Service Temporarily Unavailable. The java-its modules (Scanner Integration Tests, Plugin, Custom Rules Example, Ruling) failed as a result. The log shows spring-expression-<VER>.jar was packaged successfully, so the version bump compiled and packaged; the 503s are unrelated.
• Suggested fix: Retry the build once Artifactory is healthy. If 503s persist, check the repository service and network/backend health. No source change is indicated.

Vault HTTP 500 during authentication (confidence: high)

• Type: infrastructure
• Affected jobs: 122100281476 (Ruling job, Windows runner on the same workflow)
• Related to change: no
• Root cause: The Vault login returned Response code 500 (Internal Server Error) on both the initial attempt and the automatic retry, so the job failed before the build. Network diagnostics showed the runner reached vault.dev.sonar.build:443 successfully and the secret capability check returned read access, which points to a server-side Vault failure rather than network or policy denial. The PR only changes the spring-expression dependency in pom.xml.
• Suggested fix: Check Vault service status and server-side logs for the failed login requests, then rerun the job. If it persists, escalate to the Vault/infrastructure support team.

Ruling job skipped-result handling (confidence: low)

• Type: other
• Affected jobs: 122100281476
• Related to change: unclear
• Root cause: The Ruling QA step reported Ruling QA result: skipped, failed=true because the upstream ruling-qa result was skipped, which is a consequence of the Vault failure above rather than an independent defect. The log does not confirm this is a separate problem.
• Suggested fix: Re-evaluate after the Vault failure is resolved; no independent fix is indicated by the evidence.

Summary

• Change-related failures: 0. No finding was marked related to the PR.
• Infrastructure/flaky failures: 3 findings: Artifactory 503 responses and Vault 500 errors, both transient service-side issues.
• Recommended action: Rerun the CI workflow after the Artifactory and Vault services recover. The Spring Expression version bump itself does not appear to be the cause.

Code Review ✅ Approved

🟡 Medium risk · Upgrading spring-expression from 7.0.9 to 7.0.10 changes runtime dependency behavior, which could affect expression evaluation or compatibility.

Bumps the org.springframework:spring-expression dependency from 7.0.9 to 7.0.10 via Renovate. No issues found.

Verification Rules 2/2 met

Functional validation No results

Rules 2 passed 1 not applicable

✅ Internal artifact registries
✅ Repository license compliance

Auto-approval Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Tip

Comment Gitar fix CI or enable auto-apply: gitar auto-apply:on

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[datadog-sonarsource]

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 5695f96 | Docs | View more details | Give us feedback!}

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube