HeroDevs
Visit NES for Spring Home Page

Spring HATEOAS 2.3.x Release Notes

4 versions

Comprehensive release notes and changelog for Spring HATEOAS 2.3.x, including security patches, bug fixes, and feature updates across all supported versions.

Jun 15, 2026
Latest: 2.3.8
7 Patched Vulnerabilities
VEX Statements

June 2026

2.3.8

Released Jun 15, 2026
CVE-2026-41006
CVE-2026-41007
Full Version: 
2.3.4-spring-hateoas-2.3.8

Bug Fixes

  • Fixed PropertyUtils.createObjectFromProperties, used by the Collection+JSON and UBER media type deserializers, to consult Jackson access-control annotations so properties that should be ignored can no longer be set during deserialization (CVE-2026-41006).
  • Bounded the static StringLinkRelation cache to prevent memory exhaustion via endpoints that deserialize untrusted hypermedia or process client-supplied Link headers (CVE-2026-41007).

Dependency Upgrades

  • Spring Framework (NES) 6.1.21-spring-framework-6.1.28

April 2026

2.3.7

Released Apr 23, 2026
Full Version: 
2.3.4-spring-hateoas-2.3.7

Dependency Upgrades

  • Spring Framework (NES) 6.1.21-spring-framework-6.1.27

March 2026

2.3.6

Released Mar 25, 2026
Full Version: 
2.3.4-spring-hateoas-2.3.6

Dependency Upgrades

  • Spring Framework (NES) 6.1.21-spring-framework-6.1.26

December 2025

2.3.5

Released Dec 10, 2025
Full Version: 
2.3.4-spring-hateoas-2.3.5

Notes

  • This release originates from the open‑source Spring HATEOAS repository forked by HeroDevs. It encompasses modifications implemented by HeroDevs to ensure successful framework builds. This release contains no functional changes from Spring HATEOAS 2.3.4.

Dependency Upgrades

  • Spring Framework (NES) 6.1.21-spring-framework-6.1.25Full Version: 2.3.4-spring-hateoas-2.3.5

Stay in the loop

~/herodevs-spring-framework-support

Open Source Support

When official support ends, we're just getting started.