← All reportsPublic report

spring-projects/spring-framework

Spring Framework

60k stars Java View on GitHubprofiled 11d ago
Try GitZoid
184PRs this week
21Contributors
0Deps scanned
0Issues found
01 · Repo overview

How spring-framework is put together

This repository is the Spring Framework itself: a modular, multi-project Java/Kotlin library (not an application) providing the foundational IoC container, AOP, data access, transaction, messaging, and web (MVC + reactive) stacks for the broader Spring ecosystem. It is built as a large Gradle multi-module build where every runtime module follows the 'spring-*' naming convention, shares a common enforced platform BOM ('framework-platform'), and applies shared build conventions from a custom 'buildSrc' plugin set (formatting, checkstyle, compiler flags, test setup, architecture checks). There is no deployable application or HTTP server here; the 'data flow' is that downstream applications depend on these published Maven artifacts. Documentation is authored as Antora/AsciiDoc under framework-docs and published alongside Javadoc generated via Dokka.

Languages

JavaKotlinGroovy (Gradle build scripts)AsciiDoc

Frameworks

Spring Framework (the product itself)Gradle (build)JUnit 5 / Mockito / AssertJ / MockK (test stack)Antora (documentation site generator)Dokka (Kotlin API docs)

Infrastructure

GitHub Actions CI (.github/workflows, e.g. build-and-deploy-snapshot.yml)Spring artifactory repositories (repo.spring.io milestone/snapshot)Develocity build scans (ge.spring.io)

Major components

spring-core

Foundational utilities, resource abstraction, databinding/codec support, and the core of the framework used by all other modules.

spring-beans / spring-context

The IoC container: bean definition, wiring, application context, eventing, and XML/annotation configuration support.

spring-aop / spring-aspects

AOP Alliance-based proxying, AspectJ integration, and the org.aopalliance API variant shipped by Spring.

spring-web / spring-webmvc / spring-webflux / spring-websocket / spring-messaging

HTTP client/server abstractions, servlet-based MVC, reactive WebFlux stack, WebSocket and STOMP messaging support.

spring-tx / spring-jdbc / spring-orm / spring-r2dbc / spring-jms / spring-oxm

Transaction management and data-access integrations for JDBC, ORM frameworks, R2DBC, JMS, and object/XML mapping.

spring-expression (SpEL)

The Spring Expression Language parser and evaluator used across context, security-adjacent, and web features.

spring-test / spring-core-test

TestContext framework, MockMvc/WebTestClient testing support, and shared test infrastructure for the framework's own tests.

buildSrc (org.springframework.build plugins)

Custom Gradle plugins enforcing compiler/toolchain settings, Checkstyle/Spring Java Format, nohttp scanning, ArchUnit rules, repository configuration, and multi-release JAR packaging.

Over the past five weeks, the Spring Framework team has been hardening the upcoming 7.x release, with a strong focus on the SpEL expression language (new builder APIs, safety limits, and documentation), Protobuf encoding support, and reliability fixes around file I/O and property handling. Infrastructure work included Gradle and dependency upgrades, release-train tooling, and branch preparation for milestone releases. Documentation also received steady attention, particularly around AOP proxies in tests and SpEL security guidance.

Week by week

2026-08-24A quiet week focused on polishing contributions and quieting a noisy CGLIB warning.latest3 changes

Fix

Quieter CGLIB lifecycle warnings

Suppressed a validation warning for CGLIB lifecycle callbacks so users no longer see unnecessary log noise.

Chore

Contribution polish

Refined and merged community contributions to keep the codebase tidy.

Chore

Branch maintenance

Merged the 7.0.x maintenance branch into main to stay current with bug fixes.

2026-08-17A busy week centered on SpEL improvements, Protobuf encoder fixes, and build upgrades.6 changes

Feature

Builder API for SpEL configuration

Introduced a builder for SpelParserConfiguration and deprecated the old constructors, making expression parser setup cleaner and more future-proof.

Fix

Safer SpEL array growth limits

Aligned SpEL's default maximum auto-grow size with Spring's data binding limits and improved array size checks to prevent runaway memory use.

Fix

Protobuf streaming support

Corrected ProtobufJsonEncoder so it properly supports streaming data, along with media type and decoder refinements.

Fix

File I/O error handling

Made asynchronous file reads and writes handle synchronous exceptions correctly instead of failing silently.

Fix

Record-style property names

Fixed property name resolution for record-style accessors so compact Java records work smoothly with Spring's property handling.

Chore

Build and dependency upgrades

Upgraded to Gradle 9.7.1 and refreshed internal dependencies, plus documentation link cleanups.

2026-08-10The week focused on stricter property validation, annotation performance, and dependency upgrades.6 changes

Fix

Stricter setter validation

Property instances now reject write methods that don't start with 'set', and SpEL uses verified property names for better correctness.

Refactor

Faster annotation lookups

Avoided unnecessarily synthesizing meta-annotations with attributes, reducing wasted work when reading annotations.

Fix

MockCookie validation alignment

Updated MockCookie's parse method validation to match its documented behavior after some back-and-forth revisions.

Docs

AOP proxy docs clarified

Improved documentation explaining how Bean Overrides interact with Spring AOP proxies in tests.

Chore

Dependency upgrades

Upgraded Jackson, Groovy, Jetty, Netty, Hibernate ORM, and Checkstyle to newer versions.

Fix

Optional converter fix

Corrected the applicability check for OptionalToObjectConverter so type conversions behave as expected.

2026-08-03Infrastructure-heavy week preparing internal branches and upgrading core dependencies.6 changes

Chore

Release infrastructure prep

Prepared internal snapshot branches and switched dependency versions to support the upcoming release cycle.

Chore

Milestone dependency upgrades

Upgraded to Reactor, Micrometer, and Tracing milestone releases alongside stable patch updates.

Feature

JTA read-only flag

Introduced an enforceReadOnly flag supporting JTA 2.1's read-only transaction mode.

Refactor

Leaner annotation metadata

Stopped retaining class files in annotation metadata, reducing memory footprint.

Docs

Bean Overrides AOP docs

Documented how AOP proxy semantics apply when overriding beans in tests.

Chore

Build tooling updates

Upgraded to Gradle 9.7 and fixed the build SNAPSHOT workflow.

2026-07-27A large week of web-layer refactoring, SpEL documentation, and dependency upgrades.6 changes

Refactor

CORS preflight handler replacement

Removed HandlerMappingIntrospector in favor of DefaultPreFlightRequestHandler, simplifying CORS preflight request processing.

Docs

SpEL documentation push

Centralized SpEL security documentation and added guidance on object design, lifecycle, and reuse contracts for expressions.

Feature

New WebClient exception type

Added WebClientResponseException.PreconditionFailed so HTTP 412 responses are easier to handle explicitly.

Refactor

Database connection efficiency

Avoided acquiring a connection lock when a database transaction already exists, improving concurrency.

Feature

Null contextPath support

Allowed null contextPath values in ServerHttpRequest.Builder for more flexible request construction.

Chore

Dependency upgrades

Upgraded Tomcat, Jetty, Hibernate ORM, Hibernate Validator, and Checkstyle to newer releases.

03 · Security check

Dependencies and code review

0 dependencies scanned

Dependency advisories

Security Watch

No known advisories across 0 scanned dependencies.

No known advisories in the scanned dependencies.

Code review

No concrete code-level issues confirmed.

Get this report every week for your repos.

GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.

$19 a month, flat · First 10 outputs free · No card required