On behalf of the Spring AI team and everyone who has contributed, I'm happy to announce that Spring AI 2.0.1 has been released and is now available from Maven Central!

Release notes | Upgrade notes | Reference documentation | Javadoc

2.0.1 is the first maintenance release on top of the 2.0.0 GA foundations. It is a large one: more than 80 issues and pull requests, most of them driven by feedback from teams who moved their applications onto 2.0 in the past weeks. Alongside the fixes, it adds a handful of capabilities that were frequently requested since GA.

CVEs fixed in this release

• CVE-2026-47851 - Unbounded recursion over attacker-controlled PDF outline tree in Spring AI PDF Document Reader
• CVE-2026-47852 - Predictable cache directory location allows local ONNX model substitution in Spring AI
• CVE-2026-59279 - Unbounded persistent session allocation via repeated initialize requests
• CVE-2026-59294 - Arbitrary File Write via Path Traversal in ResourceCacheService
• CVE-2026-59308 - Semantic Cache Cross-Tenant Isolation Bypass via SHA-256 Truncation
• CVE-2026-59319 - RediSearch Tag Injection in RedisChatMemoryRepository Allows Cross-Conversation Data Exposure
• CVE-2026-59318 - DefaultToolCallingManager Global Resolver Fallback Allows Unadvertised Tool Dispatch via Prompt Injection

Before you upgrade

Most applications can move from 2.0.0 to 2.0.1 by bumping the version, but a few changes need attention. The upgrade notes cover them in detail, and were themselves expanded for this release:

• Deprecated Mistral AI chat models were retired (#6772). If you still reference them by constant, switch to a currently supported model name.
• The Redis chat memory auto-configuration module was renamed (#6416) for consistency with the rest of the spring-ai-autoconfigure-* naming. Update the artifact id in your build file.
• OpenAI tool-calling strict mode now defaults to false (#6755). The generated tool schemas mark optional parameters by omitting them from required, which strict mode rejects — so any tool with an optional parameter failed with a 400 error. Strict mode is now opt-in, matching the OpenAI API default; enable it explicitly if your schemas conform to its rules.
• Media builders use typed data overloads (#6481), which makes the accepted payload types explicit instead of accepting Object.
• DeepSeekApi was revised (#6428) to bring it in line with the conventions the other API clients follow.
• The Couchbase vector store now uses the Spring Boot-managed Couchbase client (#6583) rather than creating its own, so it participates in the cluster configuration your application already declares.

New in this release

Tool call limits

An agentic loop that never terminates is an expensive failure mode. ToolCallingAdvisor now accepts a configurable limit on the number of tool calls per request, and raises ToolCallLimitExceededException when the limit is reached. The exception path returns a single Generation so error handling stays the same shape as a normal response. Related to this, tool resolution fallback is now configurable: you decide whether an unresolvable tool name fails fast or falls back.

OpenAI audio

OpenAiAudioSpeechModel supports audio streaming and exposes the instructions option for steering voice and delivery. On the transcription side, options and responses were enriched to cover more of the OpenAI API surface.

Google GenAI

Google GenAI gains ToolChoice support, letting you force, disable, or leave tool selection to the model, and image generation support through the standard ImageModel abstraction.

Document reading

PagePdfDocumentReader accepts page ranges, so you can ingest a section of a large document instead of all of it. TokenTextSplitter now validates its builder arguments instead of failing later with a confusing error.

AWS region resolution

Two long-standing reports are finally closed: Spring AI now follows the AWS SDK's default region resolution rules and no longer logs a confusing WARN while resolving the region. If you relied on environment or profile-based region configuration for Bedrock, it now behaves the way the rest of your AWS stack does.

Reliability

Streaming and tool calling

Streaming responses received the bulk of the attention in this release. OpenAiChatModel now merges streaming tool call deltas by index and handles empty tool_calls chunks, and a report of zero token usage in OpenAI streaming mode is resolved. Cancelling a stream no longer leaks the underlying HTTP response, both for chat and for audio transcription. ToolCallingAdvisor's streaming loop no longer drops doBeforeStream mutations, token usage is accumulated across tool-calling iterations rather than reporting only the last one, and tool call observations get the correct parent span in blocking mode.

Also fixed: shared mutable state in chat options builder clone() and its Anthropic counterpart, ToolContext parameter detection, strict mode payload placement, PDF media mapping in OpenAiChatModel, Optional unwrapping in OpenAiChatModel#buildGeneration, reasoningContent metadata when calling DeepSeek through the OpenAI API, AnthropicChatOptions.timeout(Duration) being ignored outside model construction, OllamaChatModel prompt options not inheriting the configured model, Google GenAI thinking-level validation, null fields in Mistral AI moderation results, Microsoft Foundry URL path handling for proxy hosts, and Azure OpenAI authentication behind a TLS-inspecting proxy.

The tool-search advisor introduced in 2.0.0 is now included in the BOM — it was missing, which made it awkward to depend on — with fixes for auto-configuration ordering and reference extraction for parallel tool calls.

Chat memory

The Redis ChatMemoryRepository was hardened on three fronts: timestamps are reserved atomically so concurrent writers cannot collide, clear() actually clears, and metadata values are escaped in queries so values containing special characters no longer break the query. The documentation now also explains how conversation IDs are scoped.

Vector stores

Milvus received three fixes: group precedence in the filter expression converter, integer metadata values deserialized as Long instead of Double, and filters against a custom metadata field. Elsewhere, OpenSearchVectorStore deserializes documents correctly, PgVectorStore validates its table schema after initialization instead of failing on the first query, and CouchbaseSearchVectorStore.Builder no longer asserts the wrong conditions.

MCP

MCP annotations work under GraalVM native image again. @McpTool exception handling is aligned with the @Tool contract, stdio connections without arguments work, HTTP client request customizer beans are applied, and the Streamable HTTP WebClient transport accepts SSE frames without an event field as the specification allows. Servers can now cap their session state with maxSessions and sessionIdleTimeout.

Robustness

Several fixes make Spring AI better behaved when handling untrusted or unexpected input: resolved resource paths are validated, caches use a temporary directory, full-length hashes replace truncated ones, malformed PDFs are handled instead of propagating raw parser failures, and MarkdownCodeBlockCleaner validates text length and no longer discards single-line fenced blocks. String case conversion on wire and protocol values now uses Locale.ROOT, which fixes the classic Turkish-locale i bug, and TransformersEmbeddingModel closes its native resources.

Documentation, dependencies, and build

The structured output and tool calling reference documentation were restructured, the CosmosDBChatMemoryRepository section was restored, and the Pinecone free-tier namespace notes were brought up to date.

On the dependency side, Milvus moves to 2.6.21, Pinecone to 6.2.0, and Qdrant to 1.18.0. The build now delegates Maven plugin versions and gRPC version management to the Spring Boot BOM, and drops explicit protobuf-java version properties — fewer places where Spring AI can disagree with the versions Spring Boot manages for you. The fastjson2 dependency was removed from spring-ai-azure-store.

Contributors

Thank you to everyone who worked on this release:

@DragonFSKY, @EvanYao826, @JamesBLewis, @MKP999, @OneZero-Y, @OreOreDa, @Seol-JY, @TimurRakhmatullin86, @YashRL, @ZhangDT-sky, @angus-guo, @chaechaepower, @chemicL, @dimitarproynov, @ericbottard, @gaoxiaolei-s59, @gh7035, @guanxuc, @hutiefang76, @ilayaperumalg, @iuliiasobolevska, @jewoodev, @kamalcis, @kezhenxu94, @leeworms, @liushenling2001, @nicolaskrier, @prachipanditrao, @pyg410, @quaff, @rea9r, @sdeleuze, @sdudzin, @seeun0210, @sobychacko, @strogiyotec, @subhashpolisetti, @thjanssen, @tzolov, @ultramancode, and @yyyCode

Get started

Upgrade your application, or start a new one on start.spring.io. As always, we would like to hear how it goes — open an issue if something is broken, or start a discussion to tell us what you would like to see next.

Cheers!

Resources

Project Page | GitHub | Issues | Reference documentation