The Model Context Protocol (MCP) standardizes how AI applications interact with external tools and resources. Spring joined the MCP ecosystem early as a key contributor, helping to develop and maintain the official MCP Java SDK that serves as the foundation for Java-based MCP implementations. Building on this contribution, Spring AI has embraced MCP with comprehensive support through dedicated Boot Starters and MCP Java Annotations, making it easier than ever to build sophisticated AI-powered applications that can seamlessly connect to external systems.

This blog introduces core MCP components and demonstrates building both MCP Servers and Clients using Spring AI, showcasing basic and advanced features. The complete source code is available at: MCP Weather Example…

In this 2nd blog post of the Road to GA series highlighting major features within the Spring portfolio for the next major versions to be released in November, I’m going to focus on the upcoming API Versioning support in Spring Framework 7.

Introduction

API versioning is a challenging topic. Most articles list various ways to do it, but offer no advice. When advice is offered, it ranges widely. For example, Roy Fielding advises against it. It is a common and widely used practice, and yet there is no standard or agreement on how to or whether to do it.

Furthermore, different applications have…

On behalf of the team and everyone who has contributed, I am pleased to announce the availability of Spring Security 6.4.10 and 6.5.4.

Spring Security 6.4.10 ships with 4 fixes and several dependency upgrades. This version will be shipped this week with Spring Boot 3.4.10.

Spring Security 6.5.4 ships with 4 fixes and several dependency upgrades. This version will be shipped this week with Spring Boot 3.5.6.

These two releases also address CVE-2025-41248, which was announced in conjunction with CVE-2025-41249.

See Spring Security and Spring Framework Release Fixes for CVE-2025-41248 and CVE-2025-41249 for further…

The Spring Security and Spring Framework teams have collaborated to release fixes for the following CVEs.

• CVE-2025-41248: Spring Security authorization bypass for method security annotations on parameterized types
• CVE-2025-41249: Spring Framework Annotation Detection Vulnerability

Both of these CVE reports pertain to vulnerabilities that may be encountered when using security annotations on methods within type hierarchies with a parameterized super type with unbounded generics. See the individual CVE reports for further details.

CVE-2025-41248

The Spring Security 6.4.10 and 6.5.4 open source releases address CVE-2025-41248…

On behalf of the team and everyone who contributed, I am pleased to announce the fifth Milstone for 4.0.0 of Spring AMQP.

The patch versions 3.2.7 also has been released with bug fixes and dependency upgrades.

The most notable change in this milestone is a breaking migration from Spring Retry API to the one provided now in the Spring Framework Core.

See the Release Notes and [What's New][https://docs.spring.io/spring-amqp/reference/4.0/whats-new.html] for more information.

This is the last milestone before Release Candidate in October, so don't hesitate to reach us out in GitHub issues with…

On behalf of the community, I am pleased to announce that the Milestone 2 (M2) of the Spring Cloud 2025.1 (aka Oakwood) Release Train is available today. The release can be found in Maven Central. You can check out the 2025.1 release notes for more information.

Notable Changes in the 2025.1.0-M2 Release

Spring Cloud 2025.0.0-M2 depends on Spring Boot 4.0.0-M2. See all issues and pull requests that are part of the release here.

The following modules were updated as part of 2025.0.0-M1:

On behalf of the team and everyone who has contributed, I’m pleased to announce the availability of 2025.0.4 and 2024.1.10 service releases. These releases ship with dependency upgrades, fixes for regressions and selected improvements.

The upcoming Spring Boot releases will pick up the above releases by next week.

2025.0.4

• Spring Data Commons 3.5.4 - Javadoc - Documentation - Changelog
• Spring Data JPA 3.5.4 - Javadoc - Documentation - Changelog
• Spring Data Neo4j 7.5.4 - Javadoc - Documentation - Changelog
• Spring Data for Apache Cassandra 4.5.4 - Javadoc - Documentation - Changelog
• Spring Data MongoDB 4.5.4 - Javadoc - Documentation - Changelog
• Spring Data KeyValue 3.5.4 - Javadoc - Documentation - Changelog
• Spring Data LDAP 3.5.4 - Javadoc - Documentation - Changelog
• Spring Data REST 4.5.4 - Javadoc - Documentation - Changelog
• Spring Data Redis 3.5.4 - Javadoc - Documentation - Changelog
• Spring Data Elasticsearch 5.5.4 - Javadoc - Documentation - …

On behalf of the team and everyone who has contributed, I am pleased to announce the sixth and last milestone for the next Spring Data generation. This milestone continues delivering new features, refinements, and dependency upgrades.

Removed MongoDB UUID and BigDecimal Defaults

Spring Data MongoDB now aligns with the MongoDB Java Driver and no longer defaults to a representation for UUID values. Instead, you need to explicitly configure the desired representation through driver settings.

We're also no longer providing a default configuration value for BigInteger and resort the default for BigDecimal to Decimal128 in accordance with MongoDB's default codecs. This is a much safer approach that prevents you your application from accidentally switching representations when upgrading to the new major version. Please make sure to configure formats for big numbers through MongoCustomConversions…