HeroDevs
Visit NES for Spring Home Page

Spring GraphQL 1.3.x Release Notes

4 versions

Comprehensive release notes and changelog for Spring GraphQL 1.3.x, including security patches, bug fixes, and feature updates across all supported versions.

Jun 15, 2026
Latest: 1.3.11
8 Patched Vulnerabilities
VEX Statements

June 2026

1.3.11

Released Jun 15, 2026
CVE-2026-41699
CVE-2026-41700
CVE-2026-41856
Full Version: 
1.3.7-spring-graphql-1.3.11

Bug Fixes

  • Restricted JsonKeysetCursorStrategy to safe map types during cursor deserialization, preventing remote code execution from a crafted pagination cursor when gadget classes are present (CVE-2026-41699).
  • Added configurable Origin/CORS enforcement to the WebMVC and WebFlux GraphQlWebSocketHandler implementations, preventing Cross-Site WebSocket Hijacking of cookie-authenticated GraphQL sessions (CVE-2026-41700).
  • Fixed bridged-method parameter-type matching in HandlerMethod (using ResolvableType.toClass()) so @EnableMethodSecurity annotations on generic interface methods are no longer silently ignored at runtime (CVE-2026-41856).

Dependency Upgrades

  • Spring Data BOM (NES) 2024.0.13-spring-data-bom-2024.0.14
  • Spring Framework (NES) 6.1.21-spring-framework-6.1.28
  • Spring Security (NES) 6.3.10-spring-security-6.3.11

April 2026

1.3.10

Released Apr 28, 2026
Full Version: 
1.3.7-spring-graphql-1.3.10

Dependency Upgrades

  • Spring Data BOM (NES) 2024.0.13-spring-data-bom-2024.0.16
  • Spring Framework (NES) 6.1.21-spring-framework-6.1.27
  • Spring Security (NES) 6.3.10-spring-security-6.3.13

March 2026

1.3.9

Released Mar 25, 2026
Full Version: 
1.3.7-spring-graphql-1.3.9

Dependency Upgrades

  • Spring Data BOM (NES) 2024.0.13-spring-data-bom-2024.0.15
  • Spring Framework (NES) 6.1.21-spring-framework-6.1.26
  • Spring Security (NES) 6.3.10-spring-security-6.3.12

December 2025

1.3.8

Released Dec 17, 2025
Full Version: 
1.3.7-spring-graphql-1.3.8

Notes

  • This release originates from the open‑source Spring GraphQL repository forked by HeroDevs. It encompasses modifications implemented by HeroDevs to ensure successful framework builds. This release contains no functional changes from Spring GraphQL 1.3.7.

Dependency Upgrades

  • Spring Data BOM (NES) 2024.0.13-spring-data-bom-2024.0.14
  • Spring Framework (NES) 6.1.21-spring-framework-6.1.25
  • Spring Security (NES) 6.3.10-spring-security-6.3.11Full Version: 1.3.7-spring-graphql-1.3.8

Stay in the loop

~/herodevs-spring-framework-support

Open Source Support

When official support ends, we're just getting started.