Spring Cloud Function 3.1.x Release Notes

Security Fixes

• Function message headers can no longer set or override sensitive HTTP response headers, since HeaderUtils now always ignores Set-Cookie, Authorization, Cache-Control, Content-Security-Policy, the proxy-authentication headers, and the CORS Access-Control-* family (low severity, CVE-2026-59298).
• CustomRuntimeEventLoop and CustomRuntimeInitializer no longer log the full AWS Lambda process environment at DEBUG, which now requires TRACE logging together with an explicit SPRING_ENV_DUMP_ALLOW opt-in (low severity, CVE-2026-59300).
• SimpleFunctionRegistry no longer caches an intermediate composition wrapper under a base function name, so mutated output-conversion state can no longer leak into unrelated function lookups (low severity, CVE-2026-59299).

Dependency Upgrades

• Spring Cloud Build (NES) 3.0.5-spring-cloud-build-3.0.8

Security Fixes

• Function registry cache bounded and recursive composition prevented to avoid OOM conditions (CVE-2026-40989).
• Function registry cache size limited to prevent unbounded memory growth from distinct function definitions (CVE-2026-40990).

Security Fixes

• This release patches the following:
  • Denial of service via caching issue in Function Catalog when interacting with lookup functionality (CVE-2022-22979).

Notes

• This release originates from the open‑source Spring Cloud Function repository forked by HeroDevs. It encompasses modifications implemented by HeroDevs to ensure successful framework builds. This release contains no functional changes from Spring Cloud Function 3.1.7.

Dependency Upgrades

• Spring Cloud Build (NES) 3.0.5-spring-cloud-build-3.0.6