HeroDevs
Visit NES for Spring Home Page

Spring Data REST 4.4.x Release Notes

4 versions

Comprehensive release notes and changelog for Spring Data REST 4.4.x, including security patches, bug fixes, and feature updates across all supported versions.

Jun 15, 2026
Latest: 4.4.17
21 Patched Vulnerabilities
VEX Statements

June 2026

4.4.17

Released Jun 15, 2026
CVE-2026-41728
CVE-2026-41729
CVE-2026-41730
CVE-2026-41837
Full Version: 
4.4.13-spring-data-rest-4.4.17

Bug Fixes

  • Tightened write-access checks in JsonPointerMapping so the JSON Patch implementation applies the write-access filter to intermediate path segments, preventing read-only nested properties from being mutated through multi-segment pointers (CVE-2026-41728).
  • Closed a SpEL expression injection vulnerability in JSON Patch processing of map-typed properties by rejecting invalid map keys in JSON Pointer expressions in JsonPointerMapping/SpelPath (CVE-2026-41729).
  • Stopped Spring Data REST from serializing the full exception cause chain into HTTP error response bodies, preventing disclosure of persistence-layer internals to HTTP clients (CVE-2026-41730).
  • Fixed the Querydsl integration to consider Jackson customizations before treating persistent property paths as filter keys, preventing Jackson-hidden persistent fields from being exposed as filterable properties (CVE-2026-41837).

Dependency Upgrades

  • Spring Data Build (NES) 3.4.13-spring-data-build-3.4.17
  • Spring Data Commons (NES) 3.4.13-spring-data-commons-3.4.17
  • Spring Data JPA (NES) 3.4.13-spring-data-jpa-3.4.17
  • Spring Data KeyValue (NES) 3.4.13-spring-data-keyvalue-3.4.17
  • Spring Data MongoDB (NES) 4.4.13-spring-data-mongodb-4.4.17

April 2026

4.4.16

Released Apr 23, 2026
Full Version: 
4.4.13-spring-data-rest-4.4.16

Dependency Upgrades

  • Spring Data Build (NES) 3.4.13-spring-data-build-3.4.16
  • Spring Data Commons (NES) 3.4.13-spring-data-commons-3.4.16
  • Spring Data JPA (NES) 3.4.13-spring-data-jpa-3.4.16
  • Spring Data KeyValue (NES) 3.4.13-spring-data-keyvalue-3.4.16
  • Spring Data MongoDB (NES) 4.4.13-spring-data-mongodb-4.4.16

March 2026

4.4.15

Released Mar 25, 2026
Full Version: 
4.4.13-spring-data-rest-4.4.15

Dependency Upgrades

  • Spring Data Build (NES) 3.4.13-spring-data-build-3.4.15
  • Spring Data Commons (NES) 3.4.13-spring-data-commons-3.4.15
  • Spring Data JPA (NES) 3.4.13-spring-data-jpa-3.4.15
  • Spring Data KeyValue (NES) 3.4.13-spring-data-keyvalue-3.4.15
  • Spring Data MongoDB (NES) 4.4.13-spring-data-mongodb-4.4.15

January 2026

4.4.14

Released Jan 28, 2026
Full Version: 
4.4.13-spring-data-rest-4.4.14

Notes

  • This release originates from the open‑source Spring Data REST repository forked by HeroDevs. It encompasses modifications implemented by HeroDevs to ensure successful framework builds. This release contains no functional changes from Spring Data REST 4.4.13.

Dependency Upgrades

  • Spring Data Build (NES) 3.4.13-spring-data-build-3.4.14
  • Spring Data Commons (NES) 3.4.13-spring-data-commons-3.4.14
  • Spring Data JPA (NES) 3.4.13-spring-data-jpa-3.4.14
  • Spring Data KeyValue (NES) 3.4.13-spring-data-keyvalue-3.4.14
  • Spring Data MongoDB (NES) 4.4.13-spring-data-mongodb-4.4.14

Stay in the loop

~/herodevs-spring-framework-support

Open Source Support

When official support ends, we're just getting started.