HeroDevs
Visit NES for Spring Home Page

Spring Data Commons 2.7.x Release Notes

9 versions

Comprehensive release notes and changelog for Spring Data Commons 2.7.x, including security patches, bug fixes, and feature updates across all supported versions.

Jun 15, 2026
Latest: 2.7.27
16 Patched Vulnerabilities
VEX Statements

June 2026

2.7.27

Released Jun 15, 2026
CVE-2026-41711
CVE-2026-41716
CVE-2026-41721
Full Version: 
2.7.18-spring-data-commons-2.7.27

Bug Fixes

  • Bounded recursion in PropertyPath resolution by consistently applying a maximum traversal depth, preventing a StackOverflowError denial of service when parsing Sort parameters (CVE-2026-41711).
  • Replaced the unbounded per-type property cache used by QuerydslPredicateArgumentResolver and @ProjectedPayload binding with a one-pass fixed-size map in TypeDiscoverer, preventing heap exhaustion from attacker-supplied property names (CVE-2026-41716).
  • Initialized MapDataBinder with a collection limit and tightened the proxying handler-method argument resolver, preventing excessive memory allocation when Spring Data Web Support is used together with a @ProjectedPayload controller method (CVE-2026-41721).

Dependency Upgrades

  • Spring Data Build (NES) 2.7.18-spring-data-build-2.7.27

April 2026

2.7.26

Released Apr 23, 2026
Full Version: 
2.7.18-spring-data-commons-2.7.26

Dependency Upgrades

  • Spring Data Build (NES) 2.7.18-spring-data-build-2.7.26

March 2026

2.7.25

Released Mar 25, 2026
Full Version: 
2.7.18-spring-data-commons-2.7.25

Dependency Upgrades

  • Spring Data Build (NES) 2.7.18-spring-data-build-2.7.25

October 2025

2.7.24

Released Oct 23, 2025
Full Version: 
2.7.18-spring-data-commons-2.7.24

Dependency Upgrades

  • Spring Data Build (NES) 2.7.18-spring-data-build-2.7.24

September 2025

2.7.23

Released Sep 23, 2025
Full Version: 
2.7.18-spring-data-commons-2.7.23

Dependency Upgrades

  • Spring Data Build (NES) 2.7.18-spring-data-build-2.7.23

August 2025

2.7.22

Released Aug 25, 2025
Full Version: 
2.7.18-spring-data-commons-2.7.22

Dependency Upgrades

  • Spring Data Build (NES) 2.7.18-spring-data-build-2.7.22

May 2025

2.7.21

Released May 19, 2025
Full Version: 
2.7.18-spring-data-commons-2.7.21

Dependency Upgrades

  • Spring Data Build (NES) 2.7.18-spring-data-build-2.7.21

February 2025

2.7.20

Released Feb 24, 2025
Full Version: 
2.7.18-spring-data-commons-2.7.20

Notes

  • Publish Spring Data Commons under the org.springframework.data group ID instead of com.herodevs.nes.springframework.data

Dependency Upgrades

  • Spring Data Build: 2.7.18-spring-data-build-2.7.20

August 2024

2.7.19

Released Aug 30, 2024
Full Version: 
2.7.18-spring-data-commons-2.7.19

Notes

  • This release originates from the open‑source Spring Data Commons repository forked by HeroDevs. It encompasses modifications implemented by HeroDevs to ensure successful framework builds. This release contains no functional changes from Spring Data Commons 2.7.18. Full Version: 2.7.18-spring-data-commons-2.7.19

Stay in the loop

~/herodevs-spring-framework-support

Open Source Support

When official support ends, we're just getting started.