Spring Data REST 3.5.x Release Notes

Security Fixes

• An immutable aggregate PUT body can no longer replace persisted identifier and version values in DomainObjectReader.readPut, so optimistic-lock checks can no longer be bypassed (medium severity, CVE-2026-47850).
• JSON Patch write pointers can no longer target identifier or version properties, which MappedProperties now reports as non-writable, so authenticated clients can no longer overwrite persistence metadata (high severity, CVE-2026-47849).

Dependency Upgrades

• Spring Data Build (NES) 2.5.12-spring-data-build-2.5.17
• Spring Data for Apache Cassandra (NES) 3.2.12-spring-data-cassandra-3.2.17
• Spring Data Commons (NES) 2.5.12-spring-data-commons-2.5.17
• Spring Data JPA (NES) 2.5.12-spring-data-jpa-2.5.17
• Spring Data KeyValue (NES) 2.5.12-spring-data-keyvalue-2.5.17
• Spring Data MongoDB (NES) 3.2.12-spring-data-mongodb-3.2.17
• Spring Framework (NES) 5.3.39-spring-framework-5.3.54

Security Fixes

• Tightened write-access checks in JsonPointerMapping so the JSON Patch implementation applies the write-access filter to intermediate path segments, preventing read-only nested properties from being mutated through multi-segment pointers (CVE-2026-41728).
• Closed a SpEL expression injection vulnerability in JSON Patch processing of map-typed properties by rejecting invalid map keys in JSON Pointer expressions in JsonPointerMapping/SpelPath (CVE-2026-41729).
• Stopped Spring Data REST from serializing the full exception cause chain into HTTP error response bodies, preventing disclosure of persistence-layer internals to HTTP clients (CVE-2026-41730).
• Fixed the Querydsl integration to consider Jackson customizations before treating persistent property paths as filter keys, preventing Jackson-hidden persistent fields from being exposed as filterable properties (CVE-2026-41837).

Dependency Upgrades

• Spring Data Build (NES) 2.5.12-spring-data-build-2.5.16
• Spring Data Commons (NES) 2.5.12-spring-data-commons-2.5.16
• Spring Data JPA (NES) 2.5.12-spring-data-jpa-2.5.16
• Spring Data KeyValue (NES) 2.5.12-spring-data-keyvalue-2.5.16
• Spring Data MongoDB (NES) 3.2.12-spring-data-mongodb-3.2.16
• Spring Data for Apache Cassandra (NES) 3.2.12-spring-data-cassandra-3.2.16
• Spring Framework (NES) 5.3.39-spring-framework-5.3.52

Security Fixes

• Information disclosure vulnerability (CVE-2022-31679).

Notes

• This release originates from the open‑source Spring Data REST repository forked by HeroDevs. It encompasses modifications implemented by HeroDevs to ensure successful framework builds. This release contains no functional changes from Spring Data REST 3.5.12.

Dependency Upgrades

• Spring Data Build (NES) 2.5.12-spring-data-build-2.5.13
• Spring Data Commons (NES) 2.5.12-spring-data-commons-2.5.13
• Spring Data JPA (NES) 2.5.12-spring-data-jpa-2.5.13
• Spring Data KeyValue (NES) 2.5.12-spring-data-keyvalue-2.5.13
• Spring Data MongoDB (NES) 3.2.12-spring-data-mongodb-3.2.13
• Spring Data for Apache Cassandra (NES) 3.2.12-spring-data-cassandra-3.2.13