HeroDevs
Visit NES for Spring Home Page

Spring Cloud Commons 4.1.x Release Notes

3 versions

Comprehensive release notes and changelog for Spring Cloud Commons 4.1.x, including security patches, bug fixes, and feature updates across all supported versions.

Sep 1, 2026
Latest: 4.1.9
1 Patched Vulnerability
VEX Statements

September 2026

4.1.9

Released Sep 1, 2026
CVE-2026-59284
Full Version: 
4.1.6-spring-cloud-commons-4.1.9

Security Fixes

  • A POST to the /env actuator endpoint can no longer set an arbitrary property key, because WritableEnvironmentEndpointWebExtension.write now rejects any key that does not match management.endpoint.env.post.valid-keys-regex and rejects every write while that property is unset (high severity, CVE-2026-59284).

Dependency Upgrades

  • Spring Cloud Build (NES) 4.1.6-spring-cloud-build-4.1.9
  • Spring Security RSA (NES) 1.1.5-spring-security-rsa-1.1.13

June 2026

4.1.8

Released Jun 17, 2026
Full Version: 
4.1.6-spring-cloud-commons-4.1.8

Dependency Upgrades

  • Spring Cloud Build (NES) 4.1.6-spring-cloud-build-4.1.8
  • Spring Security RSA (NES) 1.1.5-spring-security-rsa-1.1.12

September 2025

4.1.7

Released Sep 12, 2025
Full Version: 
4.1.6-spring-cloud-commons-4.1.7

Notes

  • This release originates from the open‑source Spring Cloud Commons repository forked by HeroDevs. It encompasses modifications implemented by HeroDevs to ensure successful framework builds. This release contains no functional changes from Spring Cloud Commons 4.1.6.

Dependency Upgrades

  • Spring Cloud Build (NES) 4.1.6-spring-cloud-build-4.1.7
  • Spring Security RSA (NES) 1.1.5-spring-security-rsa-1.1.7Full Version: 4.1.6-spring-cloud-commons-4.1.7

Stay in the loop

~/herodevs-spring-framework-support

Open Source Support

When official support ends, we're just getting started.