HeroDevs
Visit NES for Spring Home Page

Spring Data JPA 3.5.x Release Notes

2 versions

Comprehensive release notes and changelog for Spring Data JPA 3.5.x, including security patches, bug fixes, and feature updates across all supported versions.

Aug 28, 2026
Latest: 3.5.15
1 Patched Vulnerability
VEX Statements

August 2026

3.5.15

Released Aug 28, 2026
CVE-2026-47834
Full Version: 
3.5.13-spring-data-jpa-3.5.15

Security Fixes

  • Unicode punctuation and formatting characters in an untrusted sort property can no longer reach a native query's ORDER BY clause, because QueryUtils now accepts only letters, digits, . and _ in a sort expression (medium severity, CVE-2026-47834).

Dependency Upgrades

  • Spring Data Build (NES) 3.5.13-spring-data-build-3.5.15
  • Spring Data Commons (NES) 3.5.13-spring-data-commons-3.5.15

July 2026

3.5.14

Released Jul 9, 2026
Full Version: 
3.5.13-spring-data-jpa-3.5.14

Notes

  • This release originates from the open‑source Spring Data JPA repository forked by HeroDevs. It encompasses modifications implemented by HeroDevs to ensure successful framework builds. This release contains no functional changes from Spring Data JPA 3.5.13.

Dependency Upgrades

  • Spring Data Build (NES) 3.5.13-spring-data-build-3.5.14
  • Spring Data Commons (NES) 3.5.13-spring-data-commons-3.5.14

Stay in the loop

~/herodevs-spring-framework-support

Open Source Support

When official support ends, we're just getting started.