Release Spring Framework 7.0.9

Closes gh-37103

.github/actions/await-http-resource/action.yml

@@ -1,20 +0,0 @@
-name: Await HTTP Resource
-description: 'Waits for an HTTP resource to be available (a HEAD request succeeds)'
-inputs:
-  url:
-    description: 'URL of the resource to await'
-    required: true
-runs:
-  using: composite
-  steps:
-    - name: Await HTTP resource
-      shell: bash
-      run: |
-        url=${{ inputs.url }}
-        echo "Waiting for $url"
-        until curl --fail --head --silent ${{ inputs.url }} > /dev/null
-        do
-          echo "."
-          sleep 60
-        done
-        echo "$url is available"

.github/actions/build/action.yml

@@ -1,6 +1,18 @@
 name: 'Build'
 description: 'Builds the project, optionally publishing it to a local deployment repository'
 inputs:
+  commercial-release-repository-url:
+    description: 'URL of the release repository'
+    required: false
+  commercial-repository-password:
+    description: 'Password for authentication with the commercial repository'
+    required: false
+  commercial-repository-username:
+    description: 'Username for authentication with the commercial repository'
+    required: false
+  commercial-snapshot-repository-url:
+    description: 'URL of the snapshot repository'
+    required: false
   develocity-access-key:
     description: 'Access key for authentication with ge.spring.io'
     required: false
@@ -46,11 +58,21 @@ runs:
       id: build
       if: ${{ inputs.publish == 'false' }}
       shell: bash
+      env:
+        COMMERCIAL_RELEASE_REPO_URL: ${{ inputs.commercial-release-repository-url }}
+        COMMERCIAL_REPO_PASSWORD: ${{ inputs.commercial-repository-password }}
+        COMMERCIAL_REPO_USERNAME: ${{ inputs.commercial-repository-username }}
+        COMMERCIAL_SNAPSHOT_REPO_URL: ${{ inputs.commercial-snapshot-repository-url }}
       run: ./gradlew check antora
     - name: Publish
       id: publish
       if: ${{ inputs.publish == 'true' }}
       shell: bash
+      env:
+        COMMERCIAL_RELEASE_REPO_URL: ${{ inputs.commercial-release-repository-url }}
+        COMMERCIAL_REPO_PASSWORD: ${{ inputs.commercial-repository-password }}
+        COMMERCIAL_REPO_USERNAME: ${{ inputs.commercial-repository-username }}
+        COMMERCIAL_SNAPSHOT_REPO_URL: ${{ inputs.commercial-snapshot-repository-url }}
       run: ./gradlew -PdeploymentRepository=$(pwd)/deployment-repository build publishAllPublicationsToDeploymentRepository
     - name: Read Version From gradle.properties
       id: read-version

.github/actions/create-github-release/action.yml

@@ -1,6 +1,13 @@
 name: Create GitHub Release
 description: 'Create the release on GitHub with a changelog'
 inputs:
+  commercial:
+    description: 'Whether to generate the changelog for the commercial release'
+    required: true
+  latest:
+    description: 'Whether the release is the latest release'
+    required: false
+    default: 'false'
   milestone:
     description: 'Name of the GitHub milestone for which a release will be created'
     required: true
@@ -15,13 +22,13 @@ runs:
   using: composite
   steps:
     - name: Generate Changelog
-      uses: spring-io/github-changelog-generator@86958813a62af8fb223b3fd3b5152035504bcb83 #v0.0.12
+      uses: spring-io/github-changelog-generator@f7d7a87a3e7c627ecb8c26cf086c38ac5a939721 #v0.0.14
       with:
-        config-file: .github/actions/create-github-release/changelog-generator.yml
+        config-file: ${{ inputs.commercial && '.github/actions/create-github-release/changelog-generator-commercial.yml' || '.github/actions/create-github-release/changelog-generator-oss.yml' }}
         milestone: ${{ inputs.milestone }}
         token: ${{ inputs.token }}
     - name: Create GitHub Release
       shell: bash
       env:
         GITHUB_TOKEN: ${{ inputs.token }}
-      run: gh release create ${{ format('v{0}', inputs.milestone) }} --notes-file changelog.md ${{ inputs.pre-release == 'true' && '--prerelease' || '' }}
+      run: gh release create ${{ format('v{0}', inputs.milestone) }} --notes-file changelog.md ${{ inputs.pre-release == 'true' && '--prerelease' || format('--latest={0}', inputs.latest) }}

.github/actions/create-github-release/changelog-generator-commercial.yml

@@ -0,0 +1,33 @@
+changelog:
+  repository: spring-projects/spring-framework-commercial
+  sections:
+    - title: ":warning: Attention Required"
+      labels:
+        - "for: upgrade-attention"
+      summary:
+        mode: "member-comment"
+        config:
+          prefix: "Attention Required:"
+    - title: ":star: New Features"
+      labels:
+        - "type: enhancement"
+    - title: ":lady_beetle: Bug Fixes"
+      labels:
+        - "type: bug"
+        - "type: regression"
+    - title: ":notebook_with_decorative_cover: Documentation"
+      labels:
+        - "type: documentation"
+    - title: ":hammer: Dependency Upgrades"
+      sort: "title"
+      labels:
+        - "type: dependency-upgrade"
+  contributors:
+    exclude:
+      names:
+        - "bclozel"
+        - "jhoeller"
+        - "rstoyanchev"
+        - "sbrannen"
+        - "sdeleuze"
+        - "snicoll"

.github/actions/create-github-release/changelog-generator-oss.yml

@@ -27,9 +27,7 @@ changelog:
       names:
         - "bclozel"
         - "jhoeller"
-        - "poutsma"
         - "rstoyanchev"
         - "sbrannen"
         - "sdeleuze"
-        - "simonbasle"
         - "snicoll"

.github/actions/prepare-gradle-build/action.yml

@@ -29,27 +29,25 @@ runs:
         distribution: ${{ inputs.java-early-access == 'true' && 'temurin' || (inputs.java-distribution || 'liberica') }}
         java-version: |
           ${{ inputs.java-early-access == 'true' && format('{0}-ea', inputs.java-version) || inputs.java-version }}
-          ${{ inputs.java-toolchain == 'true' && '17' || '' }}
-          25
+          ${{ inputs.java-toolchain == 'true' && '25' || '' }}
     - name: Set Up Gradle
-      uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
+      uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # 6.2.0
       with:
+        cache-provider: basic
         cache-read-only: false
         develocity-access-key: ${{ inputs.develocity-access-key }}
         develocity-token-expiry: 4
     - name: Configure Gradle Properties
       shell: bash
       run: |
-        mkdir -p $HOME/.gradle
-        echo 'systemProp.user.name=spring-builds+github' >> $HOME/.gradle/gradle.properties
-        echo 'systemProp.org.gradle.internal.launcher.welcomeMessageEnabled=false' >> $HOME/.gradle/gradle.properties
-        echo 'org.gradle.daemon=false' >> $HOME/.gradle/gradle.properties
-        echo 'org.gradle.daemon=4' >> $HOME/.gradle/gradle.properties
+        echo 'systemProp.user.name=spring-builds+github' >> $GRADLE_USER_HOME/gradle.properties
+        echo 'systemProp.org.gradle.internal.launcher.welcomeMessageEnabled=false' >> $GRADLE_USER_HOME/gradle.properties
+        echo 'org.gradle.daemon=false' >> $GRADLE_USER_HOME/gradle.properties
     - name: Configure Toolchain Properties
       if: ${{ inputs.java-toolchain == 'true' }}
       shell: bash
       run: |
-        echo toolchainVersion=${{ inputs.java-version }} >> $HOME/.gradle/gradle.properties
-        echo systemProp.org.gradle.java.installations.auto-detect=false >> $HOME/.gradle/gradle.properties
-        echo systemProp.org.gradle.java.installations.auto-download=false >> $HOME/.gradle/gradle.properties
-        echo systemProp.org.gradle.java.installations.paths=${{ format('$JAVA_HOME_{0}_X64', inputs.java-version) }} >> $HOME/.gradle/gradle.properties
+        echo toolchainVersion=${{ inputs.java-version }} >> $GRADLE_USER_HOME/gradle.properties
+        echo systemProp.org.gradle.java.installations.auto-detect=false >> $GRADLE_USER_HOME/gradle.properties
+        echo systemProp.org.gradle.java.installations.auto-download=false >> $GRADLE_USER_HOME/gradle.properties
+        echo systemProp.org.gradle.java.installations.paths=${{ format('$JAVA_HOME_{0}_X64', inputs.java-version) }} >> $GRADLE_USER_HOME/gradle.properties

.github/actions/release-train-build/action.yml

@@ -0,0 +1,7 @@
+name: Build Release
+runs:
+  using: composite
+  steps:
+    - name: Build Release
+      shell: bash
+      run:  ./gradlew -PdeploymentRepository=$(pwd)/deployment-repository publishAllPublicationsToDeploymentRepository

.github/actions/release-train-build/deployment-spec.yml

@@ -0,0 +1,16 @@
+artifactory:
+  artifacts:
+    - pattern: "/**/framework-api-*.zip"
+      properties:
+        zip.deployed: "false"
+        zip.name: "spring-framework"
+    - pattern: "/**/framework-api-*-docs.zip"
+      properties:
+        zip.type: "docs"
+    - pattern: "/**/framework-api-*-schema.zip"
+      properties:
+        zip.type: "schema"
+maven-central:
+  excludes:
+    - "org/springframework/framework-api/**"
+    - "org/springframework/framework-docs/**"

.github/actions/release-train-test/action.yml

@@ -0,0 +1,7 @@
+name: Test Release
+runs:
+  using: composite
+  steps:
+    - name: Test Release
+      shell: bash
+      run:  ./gradlew check

.github/actions/sync-to-maven-central/action.yml

@@ -1,34 +0,0 @@
-name: Sync to Maven Central
-description: 'Syncs a release to Maven Central and waits for it to be available for use'
-inputs:
-  central-token-password:
-    description: 'Password for authentication with central.sonatype.com'
-    required: true
-  central-token-username:
-    description: 'Username for authentication with central.sonatype.com'
-    required: true
-  jfrog-cli-config-token:
-    description: 'Config token for the JFrog CLI'
-    required: true
-  spring-framework-version:
-    description: 'Version of Spring Framework that is being synced to Central'
-    required: true
-runs:
-  using: composite
-  steps:
-    - name: Set Up JFrog CLI
-      uses: jfrog/setup-jfrog-cli@5b06f730cc5a6f55d78b30753f8583454b08c0aa # v4.8.1
-      env:
-        JF_ENV_SPRING: ${{ inputs.jfrog-cli-config-token }}
-    - name: Download Release Artifacts
-      shell: bash
-      run: jf rt download --spec ${{ format('{0}/artifacts.spec', github.action_path) }} --spec-vars 'buildName=${{ format('spring-framework-{0}', inputs.spring-framework-version) }};buildNumber=${{ github.run_number }}'
-    - name: Sync
-      uses: spring-io/central-publish-action@0c03960e9b16fdfe70e2443e1d5393cbc3a35622 # v0.3.0
-      with:
-        token: ${{ inputs.central-token-password }}
-        token-name: ${{ inputs.central-token-username }}
-    - name: Await
-      uses: ./.github/actions/await-http-resource
-      with:
-        url: ${{ format('https://repo.maven.apache.org/maven2/org/springframework/spring-context/{0}/spring-context-{0}.jar', inputs.spring-framework-version) }}

.github/actions/sync-to-maven-central/artifacts.spec

@@ -1,20 +0,0 @@
-{
-  "files": [
-    {
-      "aql": {
-        "items.find": {
-          "$and": [
-            {
-              "@build.name": "${buildName}",
-              "@build.number": "${buildNumber}",
-              "path": {
-                "$nmatch": "org/springframework/framework-api/*"
-              }
-            }
-          ]
-        }
-      },
-      "target": "nexus/"
-    }
-  ]
-}

.github/workflow-generator.yml

@@ -0,0 +1,18 @@
+workflow:
+  generator:
+    project:
+      java:
+        versions:
+          primary: 25
+    workflows:
+      release-train:
+        build:
+          env:
+            COMMERCIAL_REPO_USERNAME: secrets.COMMERCIAL_ARTIFACTORY_USERNAME
+            COMMERCIAL_REPO_PASSWORD: secrets.COMMERCIAL_ARTIFACTORY_PASSWORD
+            COMMERCIAL_RELEASE_REPO_URL: vars.COMMERCIAL_RELEASE_REPO_URL
+        test:
+          env:
+            COMMERCIAL_REPO_USERNAME: secrets.COMMERCIAL_ARTIFACTORY_USERNAME
+            COMMERCIAL_REPO_PASSWORD: secrets.COMMERCIAL_ARTIFACTORY_PASSWORD
+            COMMERCIAL_RELEASE_REPO_URL: vars.COMMERCIAL_RELEASE_REPO_URL

.github/workflows/backport-bot.yml

@@ -7,27 +7,15 @@ on:
   push:
     branches:
       - '*.x'
-permissions:
-  contents: read
 jobs:
-  build:
+  backport-issue:
     permissions:
       contents: read
       issues: write
       pull-requests: write
     runs-on: ubuntu-latest
     steps:
-      - name: Check out code
-        uses: actions/checkout@v6
-      - name: Set up Java
-        uses: actions/setup-java@v5
+      - name: Create Backport Issue
+        uses: spring-io/backport-bot@v0.0.2
         with:
-          distribution: 'liberica'
-          java-version: 17
-      - name: Download BackportBot
-        run: wget https://github.com/spring-io/backport-bot/releases/download/latest/backport-bot-0.0.1-SNAPSHOT.jar
-      - name: Backport
-        env:
-          GITHUB_EVENT: ${{ toJSON(github.event) }}
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: java -jar backport-bot-0.0.1-SNAPSHOT.jar --github.accessToken="$GITHUB_TOKEN" --github.event_name "$GITHUB_EVENT_NAME" --github.event "$GITHUB_EVENT"
+          token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/build-and-deploy-snapshot.yml

@@ -2,23 +2,27 @@ name: Build and Deploy Snapshot
 on:
   push:
     branches:
-      - main
+      - '7.0.x-internal'
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
   build-and-deploy-snapshot:
     name: Build and Deploy Snapshot
-    if: ${{ github.repository == 'spring-projects/spring-framework' }}
-    runs-on: ubuntu-latest
+    if: ${{ github.repository == 'spring-projects/spring-framework' || github.repository == 'spring-projects/spring-framework-commercial' }}
+    runs-on: ${{ vars.UBUNTU_MEDIUM || 'ubuntu-latest' }}
     timeout-minutes: 60
     steps:
       - name: Check Out Code
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Build and Publish
         id: build-and-publish
         uses: ./.github/actions/build
         with:
-          develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
+          commercial-release-repository-url: ${{ vars.COMMERCIAL_RELEASE_REPO_URL }}
+          commercial-repository-password: ${{ secrets.COMMERCIAL_ARTIFACTORY_PASSWORD }}
+          commercial-repository-username: ${{ secrets.COMMERCIAL_ARTIFACTORY_USERNAME }}
+          commercial-snapshot-repository-url: ${{ vars.COMMERCIAL_SNAPSHOT_REPO_URL }}
+          #develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
           publish: true
       - name: Deploy
         uses: spring-io/artifactory-deploy-action@926d7f7cc810569395346bf3a4d91b380b3e355b # v0.0.4
@@ -27,32 +31,47 @@ jobs:
             /**/framework-api-*.zip::zip.name=spring-framework,zip.deployed=false
             /**/framework-api-*-docs.zip::zip.type=docs
             /**/framework-api-*-schema.zip::zip.type=schema
-          build-name: 'spring-framework-7.0.x'
+          build-name: ${{ vars.COMMERCIAL && format('spring-framework-commercial-{0}', '7.0.x') || format('spring-framework-{0}', '7.0.x') }}
           folder: 'deployment-repository'
-          password: ${{ secrets.ARTIFACTORY_PASSWORD }}
-          repository: 'libs-snapshot-local'
+          project: ${{ vars.COMMERCIAL && 'spring' }}
+          repository: ${{ vars.COMMERCIAL && 'spring-enterprise-maven-dev-local' || 'libs-snapshot-local' }}
+          uri: ${{ vars.COMMERCIAL_DEPLOY_REPO_URL || 'https://repo.spring.io' }}
+          username: ${{ vars.COMMERCIAL && secrets.COMMERCIAL_ARTIFACTORY_USERNAME || secrets.ARTIFACTORY_USERNAME }}
+          password: ${{ vars.COMMERCIAL && secrets.COMMERCIAL_ARTIFACTORY_PASSWORD || secrets.ARTIFACTORY_PASSWORD }}
           signing-key: ${{ secrets.GPG_PRIVATE_KEY }}
           signing-passphrase: ${{ secrets.GPG_PASSPHRASE }}
-          uri: 'https://repo.spring.io'
-          username: ${{ secrets.ARTIFACTORY_USERNAME }}
       - name: Send Notification
         if: always()
         uses: ./.github/actions/send-notification
         with:
           build-scan-url: ${{ steps.build-and-publish.outputs.build-scan-url }}
-          run-name: ${{ format('{0} | Linux | Java 17', github.ref_name) }}
+          run-name: ${{ format('{0} | Linux | Java 25', github.ref_name) }}
           status: ${{ job.status }}
           webhook-url: ${{ secrets.GOOGLE_CHAT_WEBHOOK_URL }}
     outputs:
       version: ${{ steps.build-and-publish.outputs.version }}
+  trigger-docs-build:
+    name: Trigger Docs Build
+    needs: build-and-deploy-snapshot
+    if: ${{ !vars.COMMERCIAL }} # remove when commercial support
+    permissions:
+      actions: write
+    runs-on: ${{ vars.UBUNTU_SMALL || 'ubuntu-latest' }}
+    steps:
+      - name: Run Deploy Docs Workflow
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: gh workflow run deploy-docs.yml --repo ${{ github.repository }} -r docs-build -f build-refname=${{ github.ref_name }}
   verify:
     name: Verify
     needs: build-and-deploy-snapshot
     uses: ./.github/workflows/verify.yml
     secrets:
+      commercial-repository-password: ${{ secrets.COMMERCIAL_ARTIFACTORY_PASSWORD }}
+      commercial-repository-username: ${{ secrets.COMMERCIAL_ARTIFACTORY_USERNAME }}
       google-chat-webhook-url: ${{ secrets.GOOGLE_CHAT_WEBHOOK_URL }}
-      repository-password: ${{ secrets.ARTIFACTORY_PASSWORD }}
-      repository-username: ${{ secrets.ARTIFACTORY_USERNAME }}
+      opensource-repository-password: ${{ secrets.ARTIFACTORY_PASSWORD }}
+      opensource-repository-username: ${{ secrets.ARTIFACTORY_USERNAME }}
       token: ${{ secrets.GH_ACTIONS_REPO_TOKEN }}
     with:
       version: ${{ needs.build-and-deploy-snapshot.outputs.version }}

.github/workflows/build-pull-request.yml

@@ -7,10 +7,9 @@ jobs:
     name: Build Pull Request
     if: ${{ github.repository == 'spring-projects/spring-framework' }}
     runs-on: ubuntu-latest
-    timeout-minutes: 60
     steps:
       - name: Check Out Code
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Build
         id: build
         uses: ./.github/actions/build
@@ -19,7 +18,7 @@ jobs:
         uses: ./.github/actions/print-jvm-thread-dumps
       - name: Upload Build Reports
         if: failure()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: build-reports
-          path: '**/build/reports/'
+          path: '**/build/reports/'

.github/workflows/ci.yml

@@ -2,31 +2,33 @@ name: CI
 on:
   schedule:
     - cron: '30 9 * * *'
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
+permissions:
+  contents: read
 jobs:
   ci:
     name: '${{ matrix.os.name}} | Java ${{ matrix.java.version}}'
-    if: ${{ github.repository == 'spring-projects/spring-framework' }}
+    if: ${{ github.repository == 'spring-projects/spring-framework' || github.repository == 'spring-projects/spring-framework-commercial' }}
     runs-on: ${{ matrix.os.id }}
     timeout-minutes: 60
     strategy:
       matrix:
         os:
-          - id: ubuntu-latest
+          - id: ${{ vars.UBUNTU_MEDIUM || 'ubuntu-latest' }}
             name: Linux
         java:
           - version: 17
-            toolchain: false
+            toolchain: true
           - version: 21
             toolchain: true
           - version: 25
+            toolchain: false
+          - version: 26
             toolchain: true
         exclude:
           - os:
               name: Linux
             java:
-              version: 17
+              version: 25
     steps:
       - name: Prepare Windows runner
         if: ${{ runner.os == 'Windows' }}
@@ -35,11 +37,15 @@ jobs:
           git config --global core.longPaths true
           Stop-Service -name Docker
       - name: Check Out Code
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Build
         id: build
         uses: ./.github/actions/build
         with:
+          commercial-release-repository-url: ${{ vars.COMMERCIAL_RELEASE_REPO_URL }}
+          commercial-repository-password: ${{ secrets.COMMERCIAL_ARTIFACTORY_PASSWORD }}
+          commercial-repository-username: ${{ secrets.COMMERCIAL_ARTIFACTORY_USERNAME }}
+          commercial-snapshot-repository-url: ${{ vars.COMMERCIAL_SNAPSHOT_REPO_URL }}
           develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
           java-early-access: ${{ matrix.java.early-access || 'false' }}
           java-distribution: ${{ matrix.java.distribution }}

.github/workflows/deploy-docs.yml

@@ -1,35 +0,0 @@
-name: Deploy Docs
-on:
-  push:
-    branches:
-      - 'main'
-      - '*.x'
-      - '!gh-pages'
-    tags:
-      - 'v*'
-  repository_dispatch:
-    types: request-build-reference # legacy
-  workflow_dispatch:
-permissions:
-  actions: write
-jobs:
-  build:
-    name: Dispatch docs deployment
-    if: github.repository_owner == 'spring-projects'
-    runs-on: ubuntu-latest
-    steps:
-    - name: Check out code
-      uses: actions/checkout@v6
-      with:
-        fetch-depth: 1
-        ref: docs-build
-    - name: Dispatch (partial build)
-      if: github.ref_type == 'branch'
-      env:
-        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      run: gh workflow run deploy-docs.yml -r $(git rev-parse --abbrev-ref HEAD) -f build-refname=${{ github.ref_name }}
-    - name: Dispatch (full build)
-      if: github.ref_type == 'tag'
-      env:
-        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      run: gh workflow run deploy-docs.yml -r $(git rev-parse --abbrev-ref HEAD)

.github/workflows/publish-milestone.yml

@@ -0,0 +1,39 @@
+name: Release Milestone
+on:
+  push:
+    tags:
+      - v7.0.0-M[1-9]
+      - v7.0.0-RC[1-9]
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+jobs:
+  trigger-docs-build:
+    name: Trigger Docs Build
+    permissions:
+      actions: write
+    runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.version.outputs.version }}
+    steps:
+      - name: Determine Version
+        id: version
+        run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"
+      - name: Run Deploy Docs Workflow
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: gh workflow run deploy-docs.yml --repo ${{ github.repository }} -r docs-build -f build-refname=${{ github.ref_name }}
+  create-github-release:
+    name: Create GitHub Release
+    needs:
+      - trigger-docs-build
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check Out Code
+        uses: actions/checkout@v6
+      - name: Create GitHub Release
+        uses: ./.github/actions/create-github-release
+        with:
+          commercial: ${{ vars.COMMERCIAL }}
+          milestone: ${{ needs.trigger-docs-build.outputs.version }}
+          pre-release: true
+          token: ${{ secrets.GH_ACTIONS_REPO_TOKEN }}

.github/workflows/publish-release.yml

@@ -0,0 +1,38 @@
+name: Release
+on:
+  push:
+    tags:
+      - v7.0.[0-9]+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+jobs:
+  trigger-docs-build:
+    name: Trigger Docs Build
+    permissions:
+      actions: write
+    runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.version.outputs.version }}
+    steps:
+      - name: Determine Version
+        id: version
+        run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"
+      - name: Run Deploy Docs Workflow
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: gh workflow run deploy-docs.yml --repo ${{ github.repository }} -r docs-build -f build-refname=${{ github.ref_name }}
+  create-github-release:
+    name: Create GitHub Release
+    needs:
+      - trigger-docs-build
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check Out Code
+        uses: actions/checkout@v6
+      - name: Create GitHub Release
+        uses: ./.github/actions/create-github-release
+        with:
+          commercial: ${{ vars.COMMERCIAL }}
+          latest: true
+          milestone: ${{ needs.trigger-docs-build.outputs.version }}
+          token: ${{ secrets.GH_ACTIONS_REPO_TOKEN }}

.github/workflows/release-milestone.yml

@@ -1,95 +0,0 @@
-name: Release Milestone
-on:
-  push:
-    tags:
-      - v7.0.0-M[1-9]
-      - v7.0.0-RC[1-9]
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-jobs:
-  build-and-stage-release:
-    name: Build and Stage Release
-    if: ${{ github.repository == 'spring-projects/spring-framework' }}
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check Out Code
-        uses: actions/checkout@v6
-      - name: Build and Publish
-        id: build-and-publish
-        uses: ./.github/actions/build
-        with:
-          develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
-          publish: true
-      - name: Stage Release
-        uses: spring-io/artifactory-deploy-action@926d7f7cc810569395346bf3a4d91b380b3e355b # v0.0.4
-        with:
-          artifact-properties: |
-            /**/framework-api-*.zip::zip.name=spring-framework,zip.deployed=false
-            /**/framework-api-*-docs.zip::zip.type=docs
-            /**/framework-api-*-schema.zip::zip.type=schema
-          build-name: ${{ format('spring-framework-{0}', steps.build-and-publish.outputs.version)}}
-          folder: 'deployment-repository'
-          password: ${{ secrets.ARTIFACTORY_PASSWORD }}
-          repository: 'libs-staging-local'
-          signing-key: ${{ secrets.GPG_PRIVATE_KEY }}
-          signing-passphrase: ${{ secrets.GPG_PASSPHRASE }}
-          uri: 'https://repo.spring.io'
-          username: ${{ secrets.ARTIFACTORY_USERNAME }}
-    outputs:
-      version: ${{ steps.build-and-publish.outputs.version }}
-  verify:
-    name: Verify
-    needs: build-and-stage-release
-    uses: ./.github/workflows/verify.yml
-    secrets:
-      google-chat-webhook-url: ${{ secrets.GOOGLE_CHAT_WEBHOOK_URL }}
-      repository-password: ${{ secrets.ARTIFACTORY_PASSWORD }}
-      repository-username: ${{ secrets.ARTIFACTORY_USERNAME }}
-      token: ${{ secrets.GH_ACTIONS_REPO_TOKEN }}
-    with:
-      staging: true
-      version: ${{ needs.build-and-stage-release.outputs.version }}
-  sync-to-maven-central:
-    name: Sync to Maven Central
-    needs:
-      - build-and-stage-release
-      - verify
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check Out Code
-        uses: actions/checkout@v6
-      - name: Sync to Maven Central
-        uses: ./.github/actions/sync-to-maven-central
-        with:
-          central-token-password: ${{ secrets.CENTRAL_TOKEN_PASSWORD }}
-          central-token-username: ${{ secrets.CENTRAL_TOKEN_USERNAME }}
-          jfrog-cli-config-token: ${{ secrets.JF_ARTIFACTORY_SPRING }}
-          spring-framework-version: ${{ needs.build-and-stage-release.outputs.version }}
-  promote-release:
-    name: Promote Release
-    needs:
-      - build-and-stage-release
-      - sync-to-maven-central
-    runs-on: ubuntu-latest
-    steps:
-      - name: Set up JFrog CLI
-        uses: jfrog/setup-jfrog-cli@5b06f730cc5a6f55d78b30753f8583454b08c0aa # v4.8.1
-        env:
-          JF_ENV_SPRING: ${{ secrets.JF_ARTIFACTORY_SPRING }}
-      - name: Promote build
-        run: jfrog rt build-promote ${{ format('spring-framework-{0}', needs.build-and-stage-release.outputs.version)}} ${{ github.run_number }} libs-milestone-local
-  create-github-release:
-    name: Create GitHub Release
-    needs:
-      - build-and-stage-release
-      - promote-release
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check Out Code
-        uses: actions/checkout@v6
-      - name: Create GitHub Release
-        uses: ./.github/actions/create-github-release
-        with:
-          milestone: ${{ needs.build-and-stage-release.outputs.version }}
-          pre-release: true
-          token: ${{ secrets.GH_ACTIONS_REPO_TOKEN }}

.github/workflows/release-train-build.yml

@@ -0,0 +1,93 @@
+# This file was auto-generated by github-actions-workflow-generator 0.0.6. Do not edit.
+# To update it, modify .github/workflow-generator.yml as needed and re-run the generator.
+
+name: "Release Train – Build"
+run-name: "${{ inputs.callback-ref }} – Build"
+"on":
+  workflow_dispatch:
+    inputs:
+      callback:
+        description: "Repository to which a callback should be made upon completion"
+        required: true
+        type: "string"
+      callback-ref:
+        description: "Ref in the callback repository to which a callback should be made upon completion"
+        required: true
+        type: "string"
+      release-train-maven-repository-url:
+        description: "URL of a Maven repository to be used to resolve artifacts of projects earlier in the train"
+        required: true
+        type: "string"
+permissions:
+  contents: "read"
+concurrency:
+  group: "${{ github.workflow }}-${{ github.ref }}"
+jobs:
+  build-release:
+    name: "Build Release"
+    runs-on: "ubuntu22-2-8"
+    steps:
+    - name: "Prevent Re-runs"
+      id: "prevent-re-runs"
+      run: |-
+        if [ "$GITHUB_RUN_ATTEMPT" -gt 1 ]; then
+          echo "Re-runs are prohibited. Use the 'Release Train – Retry' workflow to retry build failures"
+          exit 1
+        fi
+    - name: "Set up Java"
+      id: "set-up-java"
+      uses: "actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95" # v5.6.0
+      with:
+        distribution: "liberica"
+        java-version: "25"
+    - name: "Check Out Code"
+      id: "check-out-code"
+      uses: "actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0" # v7.0.0
+    - name: "Build Release"
+      id: "build-release"
+      uses: "./.github/actions/release-train-build"
+      env:
+        COMMERCIAL_RELEASE_REPO_URL: "${{ vars.COMMERCIAL_RELEASE_REPO_URL }}"
+        COMMERCIAL_REPO_PASSWORD: "${{ secrets.COMMERCIAL_ARTIFACTORY_PASSWORD }}"
+        COMMERCIAL_REPO_USERNAME: "${{ secrets.COMMERCIAL_ARTIFACTORY_USERNAME }}"
+        RELEASE_TRAIN_MAVEN_REPOSITORY_PASSWORD: "${{ secrets.RELEASE_TRAIN_PARTICIPANT_MAVEN_REPOSITORY_PASSWORD }}"
+        RELEASE_TRAIN_MAVEN_REPOSITORY_URL: "${{ inputs.release-train-maven-repository-url }}"
+        RELEASE_TRAIN_MAVEN_REPOSITORY_USERNAME: "${{ secrets.RELEASE_TRAIN_PARTICIPANT_MAVEN_REPOSITORY_USERNAME }}"
+    - name: "Upload Deployment Repository"
+      id: "upload-deployment-repository"
+      uses: "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a" # v7.0.1
+      with:
+        name: "deployment-repository"
+        path: "deployment-repository/**"
+    - name: "Upload Deployment Spec"
+      id: "upload-deployment-spec"
+      uses: "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a" # v7.0.1
+      with:
+        archive: "false"
+        if-no-files-found: "ignore"
+        name: "deployment-spec"
+        path: ".github/actions/release-train-build/deployment-spec.yml"
+    - name: "Save Build System Caches"
+      id: "save-build-system-caches"
+      uses: "actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9" # v6.1.0
+      with:
+        key: "release-train-${{ inputs.callback-ref }}-${{ github.ref_name }}"
+        path: |-
+          ~/.gradle/caches
+          ~/.gradle/wrapper
+    - name: "Send Callback"
+      id: "send-callback"
+      if: "${{ !cancelled() }}"
+      env:
+        GH_TOKEN: "${{ secrets.RELEASE_TRAIN_PARTICIPANT_GITHUB_TOKEN }}"
+      run: |-
+        gh workflow run callback \
+        --repo ${{ inputs.callback }} \
+        --ref ${{ inputs.callback-ref }} \
+        --field commit-hash=${{ steps.check-out-code.outputs.commit }} \
+        --field deployment-repository-artifact-identifier=${{ steps.upload-deployment-repository.outputs.artifact-id }} \
+        --field deployment-spec-artifact-identifier=${{ steps.upload-deployment-spec.outputs.artifact-id }} \
+        --field release-branch=${{ github.ref_name }} \
+        --field release-repository=${{ github.repository }} \
+        --field result=${{ job.status == 'success' && 'built' || 'build-failed' }} \
+        --field workflow-run-url=${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}

.github/workflows/release-train-join.yml

@@ -0,0 +1,55 @@
+# This file was auto-generated by github-actions-workflow-generator 0.0.6. Do not edit.
+# To update it, modify .github/workflow-generator.yml as needed and re-run the generator.
+
+name: "Release Train – Join"
+run-name: "${{ inputs.release-train }} – Join"
+"on":
+  workflow_dispatch:
+    inputs:
+      deployment-destination:
+        description: "Destination to which the release should be deployed"
+        options:
+        - "Maven Central"
+        - "Spring Enterprise"
+        required: true
+        type: "choice"
+      release-train:
+        description: "Release train"
+        required: true
+        type: "string"
+      release-train-repository:
+        default: "spring-io/release-train"
+        description: "Release train repository"
+        required: true
+        type: "string"
+permissions:
+  contents: "none"
+jobs:
+  join-release-train:
+    name: "Join Release Train"
+    runs-on: "ubuntu-latest"
+    steps:
+    - name: "Join Release Train"
+      id: "join-release-train"
+      env:
+        GH_TOKEN: "${{ secrets.RELEASE_TRAIN_PARTICIPANT_GITHUB_TOKEN }}"
+      run: |-
+        run_url=$(
+          gh workflow run join \
+          --repo ${{ inputs.release-train-repository }} \
+          --ref ${{ inputs.release-train }} \
+          --field commit-hash=${{ github.sha }} \
+          --field deployment-destination=${{ inputs.deployment-destination == 'Maven Central' && 'maven-central' || 'spring-enterprise' }} \
+          --field release-branch=${{ github.ref_name }} \
+          --field release-repository=${{ github.repository }}
+        )
+        echo "Dispatched workflow run. Waiting for $run_url to complete."
+        run_id=${run_url##*/}
+        watch_exit_code=0
+        gh run watch $run_id --repo ${{ inputs.release-train-repository }} --exit-status --interval=3 > /dev/null 2>&1 || watch_exit_code=$?
+        if [[ $watch_exit_code -eq 0 ]]; then
+          echo "Workflow run succeeded."
+        else
+          echo "Workflow run failed."
+        fi
+        exit $watch_exit_code

.github/workflows/release-train-leave.yml

@@ -0,0 +1,46 @@
+# This file was auto-generated by github-actions-workflow-generator 0.0.6. Do not edit.
+# To update it, modify .github/workflow-generator.yml as needed and re-run the generator.
+
+name: "Release Train – Leave"
+run-name: "${{ inputs.release-train }} – Leave"
+"on":
+  workflow_dispatch:
+    inputs:
+      release-train:
+        description: "Release train"
+        required: true
+        type: "string"
+      release-train-repository:
+        default: "spring-io/release-train"
+        description: "Release train repository"
+        required: true
+        type: "string"
+permissions:
+  contents: "none"
+jobs:
+  leave:
+    name: "Leave"
+    runs-on: "ubuntu-latest"
+    steps:
+    - name: "Leave"
+      id: "leave"
+      env:
+        GH_TOKEN: "${{ secrets.RELEASE_TRAIN_PARTICIPANT_GITHUB_TOKEN }}"
+      run: |-
+        run_url=$(
+          gh workflow run leave \
+          --repo ${{ inputs.release-train-repository }} \
+          --ref ${{ inputs.release-train }} \
+          --field release-branch=${{ github.ref_name }} \
+          --field release-repository=${{ github.repository }}
+        )
+        echo "Dispatched workflow run. Waiting for $run_url to complete."
+        run_id=${run_url##*/}
+        watch_exit_code=0
+        gh run watch $run_id --repo ${{ inputs.release-train-repository }} --exit-status --interval=3 > /dev/null 2>&1 || watch_exit_code=$?
+        if [[ $watch_exit_code -eq 0 ]]; then
+          echo "Workflow run succeeded."
+        else
+          echo "Workflow run failed."
+        fi
+        exit $watch_exit_code

.github/workflows/release-train-ready.yml

@@ -0,0 +1,47 @@
+# This file was auto-generated by github-actions-workflow-generator 0.0.6. Do not edit.
+# To update it, modify .github/workflow-generator.yml as needed and re-run the generator.
+
+name: "Release Train – Ready"
+run-name: "${{ inputs.release-train }} – Ready"
+"on":
+  workflow_dispatch:
+    inputs:
+      release-train:
+        description: "Release train"
+        required: true
+        type: "string"
+      release-train-repository:
+        default: "spring-io/release-train"
+        description: "Release train repository"
+        required: true
+        type: "string"
+permissions:
+  contents: "none"
+jobs:
+  ready:
+    name: "Ready"
+    runs-on: "ubuntu-latest"
+    steps:
+    - name: "Ready"
+      id: "ready"
+      env:
+        GH_TOKEN: "${{ secrets.RELEASE_TRAIN_PARTICIPANT_GITHUB_TOKEN }}"
+      run: |-
+        run_url=$(
+          gh workflow run ready \
+          --repo ${{ inputs.release-train-repository }} \
+          --ref ${{ inputs.release-train }} \
+          --field commit-hash=${{ github.sha }} \
+          --field release-branch=${{ github.ref_name }} \
+          --field release-repository=${{ github.repository }}
+        )
+        echo "Dispatched workflow run. Waiting for $run_url to complete."
+        run_id=${run_url##*/}
+        watch_exit_code=0
+        gh run watch $run_id --repo ${{ inputs.release-train-repository }} --exit-status --interval=3 > /dev/null 2>&1 || watch_exit_code=$?
+        if [[ $watch_exit_code -eq 0 ]]; then
+          echo "Workflow run succeeded."
+        else
+          echo "Workflow run failed."
+        fi
+        exit $watch_exit_code

.github/workflows/release-train-retry.yml

@@ -0,0 +1,34 @@
+# This file was auto-generated by github-actions-workflow-generator 0.0.6. Do not edit.
+# To update it, modify .github/workflow-generator.yml as needed and re-run the generator.
+
+name: "Release Train – Retry"
+run-name: "${{ inputs.release-train }} – Retry"
+"on":
+  workflow_dispatch:
+    inputs:
+      release-train:
+        description: "Release train"
+        required: true
+        type: "string"
+      release-train-repository:
+        default: "spring-io/release-train"
+        description: "Release train repository"
+        required: true
+        type: "string"
+permissions:
+  contents: "none"
+jobs:
+  trigger-retry:
+    name: "Trigger Retry"
+    runs-on: "ubuntu-latest"
+    steps:
+    - name: "Trigger Retry"
+      id: "trigger-retry"
+      env:
+        GH_TOKEN: "${{ secrets.RELEASE_TRAIN_PARTICIPANT_GITHUB_TOKEN }}"
+      run: |-
+        gh workflow run retry \
+        --repo ${{ inputs.release-train-repository }} \
+        --ref ${{ inputs.release-train }} \
+        --field release-branch=${{ github.ref_name }} \
+        --field release-repository=${{ github.repository }}

.github/workflows/release-train-test.yml

@@ -0,0 +1,84 @@
+# This file was auto-generated by github-actions-workflow-generator 0.0.6. Do not edit.
+# To update it, modify .github/workflow-generator.yml as needed and re-run the generator.
+
+name: "Release Train – Test"
+run-name: "${{ inputs.callback-ref }} – Test"
+"on":
+  workflow_dispatch:
+    inputs:
+      callback:
+        description: "Repository to which a callback should be made upon completion"
+        required: true
+        type: "string"
+      callback-ref:
+        description: "Ref in the callback repository to which a callback should be made upon completion"
+        required: true
+        type: "string"
+      release-train-maven-repository-url:
+        description: "URL of a Maven repository to be used to resolve artifacts of projects earlier in the train"
+        required: true
+        type: "string"
+permissions:
+  contents: "read"
+concurrency:
+  group: "${{ github.workflow }}-${{ github.ref }}"
+jobs:
+  test-release:
+    name: "Test Release"
+    runs-on: "ubuntu22-2-8"
+    steps:
+    - name: "Prevent Re-runs"
+      id: "prevent-re-runs"
+      run: |-
+        if [ "$GITHUB_RUN_ATTEMPT" -gt 1 ]; then
+          echo "Re-runs are prohibited. Use the 'Release Train – Retry' workflow to retry test failures"
+          exit 1
+        fi
+    - name: "Set up Java"
+      id: "set-up-java"
+      uses: "actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95" # v5.6.0
+      with:
+        distribution: "liberica"
+        java-version: "25"
+    - name: "Check Out Code"
+      id: "check-out-code"
+      uses: "actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0" # v7.0.0
+    - name: "Restore Build System Caches"
+      id: "restore-build-system-caches"
+      uses: "actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9" # v6.1.0
+      with:
+        key: "release-train-${{ inputs.callback-ref }}-${{ github.ref_name }}"
+        path: |-
+          ~/.gradle/caches
+          ~/.gradle/wrapper
+    - name: "Test Release"
+      id: "test-release"
+      uses: "./.github/actions/release-train-test"
+      env:
+        COMMERCIAL_RELEASE_REPO_URL: "${{ vars.COMMERCIAL_RELEASE_REPO_URL }}"
+        COMMERCIAL_REPO_PASSWORD: "${{ secrets.COMMERCIAL_ARTIFACTORY_PASSWORD }}"
+        COMMERCIAL_REPO_USERNAME: "${{ secrets.COMMERCIAL_ARTIFACTORY_USERNAME }}"
+        RELEASE_TRAIN_MAVEN_REPOSITORY_PASSWORD: "${{ secrets.RELEASE_TRAIN_PARTICIPANT_MAVEN_REPOSITORY_PASSWORD }}"
+        RELEASE_TRAIN_MAVEN_REPOSITORY_URL: "${{ inputs.release-train-maven-repository-url }}"
+        RELEASE_TRAIN_MAVEN_REPOSITORY_USERNAME: "${{ secrets.RELEASE_TRAIN_PARTICIPANT_MAVEN_REPOSITORY_USERNAME }}"
+    - name: "Send Callback"
+      id: "send-callback"
+      if: "${{ !cancelled() }}"
+      env:
+        GH_TOKEN: "${{ secrets.RELEASE_TRAIN_PARTICIPANT_GITHUB_TOKEN }}"
+      run: |-
+        gh workflow run callback \
+        --repo ${{ inputs.callback }} \
+        --ref ${{ inputs.callback-ref }} \
+        --field commit-hash=${{ steps.check-out-code.outputs.commit }} \
+        --field release-branch=${{ github.ref_name }} \
+        --field release-repository=${{ github.repository }} \
+        --field result=${{ job.status == 'success' && 'tested' || 'test-failed' }} \
+        --field workflow-run-url=${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+    - name: "Upload Build System Reports"
+      id: "upload-build-system-reports"
+      if: "${{ failure() }}"
+      uses: "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a" # v7.0.1
+      with:
+        name: "build-system-reports"
+        path: "**/build/reports"

.github/workflows/release.yml

@@ -1,93 +0,0 @@
-name: Release
-on:
-  push:
-    tags:
-      - v7.0.[0-9]+
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-jobs:
-  build-and-stage-release:
-    name: Build and Stage Release
-    if: ${{ github.repository == 'spring-projects/spring-framework' }}
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check Out Code
-        uses: actions/checkout@v6
-      - name: Build and Publish
-        id: build-and-publish
-        uses: ./.github/actions/build
-        with:
-          develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
-          publish: true
-      - name: Stage Release
-        uses: spring-io/artifactory-deploy-action@926d7f7cc810569395346bf3a4d91b380b3e355b # v0.0.4
-        with:
-          artifact-properties: |
-            /**/framework-api-*.zip::zip.name=spring-framework,zip.deployed=false
-            /**/framework-api-*-docs.zip::zip.type=docs
-            /**/framework-api-*-schema.zip::zip.type=schema
-          build-name: ${{ format('spring-framework-{0}', steps.build-and-publish.outputs.version)}}
-          folder: 'deployment-repository'
-          password: ${{ secrets.ARTIFACTORY_PASSWORD }}
-          repository: 'libs-staging-local'
-          signing-key: ${{ secrets.GPG_PRIVATE_KEY }}
-          signing-passphrase: ${{ secrets.GPG_PASSPHRASE }}
-          uri: 'https://repo.spring.io'
-          username: ${{ secrets.ARTIFACTORY_USERNAME }}
-    outputs:
-      version: ${{ steps.build-and-publish.outputs.version }}
-  verify:
-    name: Verify
-    needs: build-and-stage-release
-    uses: ./.github/workflows/verify.yml
-    secrets:
-      google-chat-webhook-url: ${{ secrets.GOOGLE_CHAT_WEBHOOK_URL }}
-      repository-password: ${{ secrets.ARTIFACTORY_PASSWORD }}
-      repository-username: ${{ secrets.ARTIFACTORY_USERNAME }}
-      token: ${{ secrets.GH_ACTIONS_REPO_TOKEN }}
-    with:
-      staging: true
-      version: ${{ needs.build-and-stage-release.outputs.version }}
-  sync-to-maven-central:
-    name: Sync to Maven Central
-    needs:
-      - build-and-stage-release
-      - verify
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check Out Code
-        uses: actions/checkout@v6
-      - name: Sync to Maven Central
-        uses: ./.github/actions/sync-to-maven-central
-        with:
-          central-token-password: ${{ secrets.CENTRAL_TOKEN_PASSWORD }}
-          central-token-username: ${{ secrets.CENTRAL_TOKEN_USERNAME }}
-          jfrog-cli-config-token: ${{ secrets.JF_ARTIFACTORY_SPRING }}
-          spring-framework-version: ${{ needs.build-and-stage-release.outputs.version }}
-  promote-release:
-    name: Promote Release
-    needs:
-      - build-and-stage-release
-      - sync-to-maven-central
-    runs-on: ubuntu-latest
-    steps:
-      - name: Set up JFrog CLI
-        uses: jfrog/setup-jfrog-cli@5b06f730cc5a6f55d78b30753f8583454b08c0aa # v4.8.1
-        env:
-          JF_ENV_SPRING: ${{ secrets.JF_ARTIFACTORY_SPRING }}
-      - name: Promote build
-        run: jfrog rt build-promote ${{ format('spring-framework-{0}', needs.build-and-stage-release.outputs.version)}} ${{ github.run_number }} libs-release-local
-  create-github-release:
-    name: Create GitHub Release
-    needs:
-      - build-and-stage-release
-      - promote-release
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check Out Code
-        uses: actions/checkout@v6
-      - name: Create GitHub Release
-        uses: ./.github/actions/create-github-release
-        with:
-          milestone: ${{ needs.build-and-stage-release.outputs.version }}
-          token: ${{ secrets.GH_ACTIONS_REPO_TOKEN }}

.github/workflows/update-antora-ui-spring.yml

@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        branch: [ '6.2.x', 'main' ]
+        branch: [ '6.2.x', '7.0.x', 'main' ]
     steps:
       - uses: spring-io/spring-doc-actions/update-antora-spring-ui@5a57bcc6a0da2a1474136cf29571b277850432bc
         name: Update

.github/workflows/verify.yml

@@ -12,31 +12,39 @@ on:
         required: true
         type: string
     secrets:
+      commercial-repository-password:
+        description: 'Password for authentication with the commercial repository'
+        required: false
+      commercial-repository-username:
+        description: 'Username for authentication with the commercial repository'
+        required: false
       google-chat-webhook-url:
         description: 'Google Chat Webhook URL'
         required: true
-      repository-password:
-        description: 'Password for authentication with the repository'
+      opensource-repository-password:
+        description: 'Password for authentication with the open-source repository'
         required: false
-      repository-username:
-        description: 'Username for authentication with the repository'
+      opensource-repository-username:
+        description: 'Username for authentication with the open-source repository'
         required: false
       token:
         description: 'Token to use for authentication with GitHub'
         required: true
+permissions:
+  contents: read
 jobs:
   verify:
     name: Verify
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.UBUNTU_SMALL || 'ubuntu-latest' }}
     steps:
       - name: Check Out Release Verification Tests
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          ref: 'v0.0.2'
+          ref: 'v0.0.3'
           repository: spring-projects/spring-framework-release-verification
           token: ${{ secrets.token }}
       - name: Check Out Send Notification Action
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           path: send-notification
           sparse-checkout: .github/actions/send-notification
@@ -46,8 +54,9 @@ jobs:
           distribution: 'liberica'
           java-version: 17
       - name: Set Up Gradle
-        uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
+        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
         with:
+          cache-provider: basic
           cache-read-only: false
       - name: Configure Gradle Properties
         shell: bash
@@ -56,15 +65,17 @@ jobs:
           echo 'org.gradle.daemon=false' >> $HOME/.gradle/gradle.properties
       - name: Run Release Verification Tests
         env:
-          RVT_OSS_REPOSITORY_PASSWORD: ${{ secrets.repository-password }}
-          RVT_OSS_REPOSITORY_USERNAME: ${{ secrets.repository-username }}
-          RVT_RELEASE_TYPE: oss
+          RVT_COMMERCIAL_REPOSITORY_PASSWORD: ${{ secrets.commercial-repository-password }}
+          RVT_COMMERCIAL_REPOSITORY_USERNAME: ${{ secrets.commercial-repository-username }}
+          RVT_OSS_REPOSITORY_PASSWORD: ${{ secrets.opensource-repository-password }}
+          RVT_OSS_REPOSITORY_USERNAME: ${{ secrets.opensource-repository-username }}
+          RVT_RELEASE_TYPE: ${{ vars.COMMERCIAL && 'commercial' || 'oss' }}
           RVT_STAGING: ${{ inputs.staging }}
           RVT_VERSION: ${{ inputs.version }}
         run: ./gradlew spring-framework-release-verification-tests:test
       - name: Upload Build Reports on Failure
         if: failure()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: build-reports
           path: '**/build/reports/'

.gitignore

@@ -9,6 +9,7 @@ ivy-cache
 argfile*
 activemq-data/
 classes/
+.cursor/
 
 # Log files
 jxl.log

build.gradle

@@ -6,7 +6,7 @@ plugins {
 	id 'com.github.bjornvester.xjc' version '1.8.2' apply false
 	id 'com.gradleup.shadow' version "9.2.2" apply false
 	id 'me.champeau.jmh' version '0.7.2' apply false
-	id 'io.spring.nullability' version '0.0.11' apply false
+	id 'io.spring.nullability' version '0.0.14' apply false
 }
 
 ext {
@@ -18,16 +18,8 @@ description = "Spring Framework"
 
 configure(allprojects) { project ->
 	apply plugin: "org.springframework.build.localdev"
+    apply plugin: "org.springframework.build.repositories"
 	group = "org.springframework"
-	repositories {
-		mavenCentral()
-		if (version.contains('-')) {
-			maven { url = "https://repo.spring.io/milestone" }
-		}
-		if (version.endsWith('-SNAPSHOT')) {
-			maven { url = "https://repo.spring.io/snapshot" }
-		}
-	}
 	configurations.all {
 		resolutionStrategy {
 			cacheChangingModulesFor 0, "seconds"
@@ -61,7 +53,9 @@ configure([rootProject] + javaProjects) { project ->
 		testImplementation("org.junit.platform:junit-platform-suite")
 		testImplementation("org.mockito:mockito-core")
 		testImplementation("org.mockito:mockito-junit-jupiter")
-		testImplementation("io.mockk:mockk")
+		testImplementation("io.mockk:mockk") {
+			exclude group: 'junit', module: 'junit'
+		}
 		testImplementation("org.assertj:assertj-core")
 		testRuntimeOnly("org.junit.platform:junit-platform-launcher")
 		testRuntimeOnly("org.apache.logging.log4j:log4j-core")
@@ -72,7 +66,7 @@ configure([rootProject] + javaProjects) { project ->
 		//"https://jakarta.ee/specifications/platform/11/apidocs/",
 		"https://docs.hibernate.org/orm/7.2/javadocs/",
 		"https://www.quartz-scheduler.org/api/2.3.0/",
-		"https://hc.apache.org/httpcomponents-client-5.6.x/current/httpclient5/apidocs/",
+		"https://hc.apache.org/httpcomponents-client-5.6.x/5.6/httpclient5/apidocs/",
 		"https://projectreactor.io/docs/core/release/api/",
 		"https://projectreactor.io/docs/test/release/api/",
 		"https://junit.org/junit4/javadoc/4.13.2/",

buildSrc/build.gradle

@@ -50,6 +50,10 @@ gradlePlugin {
 			id = "org.springframework.build.multiReleaseJar"
 			implementationClass = "org.springframework.build.multirelease.MultiReleaseJarPlugin"
 		}
+        repositoriesPlugin {
+            id = "org.springframework.build.repositories"
+            implementationClass = "org.springframework.build.RepositoriesPlugin"
+        }
 		optionalDependenciesPlugin {
 			id = "org.springframework.build.optional-dependencies"
 			implementationClass = "org.springframework.build.optional.OptionalDependenciesPlugin"

buildSrc/src/main/java/org/springframework/build/CheckstyleConventions.java

@@ -50,7 +50,7 @@ public class CheckstyleConventions {
 			project.getPlugins().apply(CheckstylePlugin.class);
 			project.getTasks().withType(Checkstyle.class).forEach(checkstyle -> checkstyle.getMaxHeapSize().set("1g"));
 			CheckstyleExtension checkstyle = project.getExtensions().getByType(CheckstyleExtension.class);
-			checkstyle.setToolVersion("13.3.0");
+			checkstyle.setToolVersion("13.10.0");
 			checkstyle.getConfigDirectory().set(project.getRootProject().file("src/checkstyle"));
 			String version = SpringJavaFormatPlugin.class.getPackage().getImplementationVersion();
 			DependencySet checkstyleDependencies = project.getConfigurations().getByName("checkstyle").getDependencies();

buildSrc/src/main/java/org/springframework/build/RepositoriesPlugin.java

@@ -0,0 +1,98 @@
+/*
+ * Copyright 2002-present the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.build;
+
+import org.gradle.api.Plugin;
+import org.gradle.api.Project;
+
+/**
+ * Plugin that configures the OSS, commercial and release train repositories in the build.
+ *
+ * @author Brian Clozel
+ */
+public class RepositoriesPlugin implements Plugin <Project> {
+
+	@Override
+	public void apply(Project project) {
+		configureOssRepositories(project);
+		configureCommercialRepositories(project);
+		configureReleaseTrainRepository(project);
+	}
+
+	private void configureOssRepositories(Project project) {
+		project.getRepositories().mavenCentral();
+		if (project.getVersion().toString().contains("-")) {
+			project.getRepositories().maven(repository -> {
+				repository.setName("spring-oss-milestone");
+				repository.setUrl("https://repo.spring.io/milestone/");
+			});
+		}
+		if (project.getVersion().toString().endsWith("-SNAPSHOT")) {
+			project.getRepositories().maven(repository -> {
+				repository.setName("spring-oss-snapshot");
+				repository.setUrl("https://repo.spring.io/snapshot/");
+			});
+		}
+	}
+
+	private void configureCommercialRepositories(Project project) {
+		String releaseRepositoryUrl = getEnv("COMMERCIAL_RELEASE_REPO_URL");
+		if (releaseRepositoryUrl != null) {
+			project.getRepositories().maven((repository) -> {
+				repository.setName("spring-commercial-release");
+				repository.setUrl(releaseRepositoryUrl);
+				repository.credentials((creds) -> {
+					creds.setUsername(System.getenv("COMMERCIAL_REPO_USERNAME"));
+					creds.setPassword(System.getenv("COMMERCIAL_REPO_PASSWORD"));
+				});
+			});
+		}
+		String snapshotRepositoryUrl = getEnv("COMMERCIAL_SNAPSHOT_REPO_URL");
+		if (snapshotRepositoryUrl != null && project.getVersion().toString().endsWith("-SNAPSHOT")) {
+			project.getRepositories().maven((repository) -> {
+				repository.setName("spring-commercial-snapshot");
+				repository.setUrl(snapshotRepositoryUrl);
+				repository.credentials((creds) -> {
+					creds.setUsername(System.getenv("COMMERCIAL_REPO_USERNAME"));
+					creds.setPassword(System.getenv("COMMERCIAL_REPO_PASSWORD"));
+				});
+			});
+		}
+	}
+
+	private void configureReleaseTrainRepository(Project project) {
+		String releaseTrainRepositoryUrl = getEnv("RELEASE_TRAIN_MAVEN_REPOSITORY_URL");
+		if (releaseTrainRepositoryUrl != null) {
+			project.getRepositories().maven(repository -> {
+				repository.setName("spring-release-train");
+				repository.setUrl(releaseTrainRepositoryUrl);
+				repository.credentials((creds) -> {
+					creds.setUsername(System.getenv("RELEASE_TRAIN_MAVEN_REPOSITORY_USERNAME"));
+					creds.setPassword(System.getenv("RELEASE_TRAIN_MAVEN_REPOSITORY_PASSWORD"));
+				});
+			});
+		}
+	}
+
+	/**
+	 * Returns the environment variable's value, or {@code null} if it is unset or blank.
+	 */
+	private static String getEnv(String name) {
+		String value = System.getenv(name);
+		return (value != null && !value.isBlank()) ? value : null;
+	}
+}

buildSrc/src/main/java/org/springframework/build/TestConventions.java

@@ -71,7 +71,7 @@ class TestConventions {
 				"junit.platform.discovery.issue.severity.critical", "INFO"
 		));
 		if (project.hasProperty("testGroups")) {
-			test.systemProperty("testGroups", project.getProperties().get("testGroups"));
+			test.systemProperty("testGroups", project.findProperty("testGroups"));
 		}
 		test.jvmArgs(
 				"--add-opens=java.base/java.lang=ALL-UNNAMED",
@@ -82,7 +82,7 @@ class TestConventions {
 
 	private void configureByteBuddyAgent(Project project) {
 		if (project.hasProperty("byteBuddyVersion")) {
-			String byteBuddyVersion = (String) project.getProperties().get("byteBuddyVersion");
+			String byteBuddyVersion = (String) project.findProperty("byteBuddyVersion");
 			Configuration byteBuddyAgentConfig = project.getConfigurations().create("byteBuddyAgentConfig");
 			byteBuddyAgentConfig.setTransitive(false);
 			Dependency byteBuddyAgent = project.getDependencies().create("net.bytebuddy:byte-buddy-agent:" + byteBuddyVersion);

framework-api/framework-api.gradle

@@ -15,8 +15,8 @@ repositories {
 }
 
 dependencies {
-	moduleProjects.each { moduleProject ->
-		javadoc moduleProject
+	rootProject.ext.moduleProjects.each { moduleProject ->
+		javadoc project(moduleProject.path)
 	}
 }
 
@@ -52,7 +52,7 @@ javadoc {
 			// ensure the javadoc process can resolve types compiled from .aj sources
 			springAspectsOutput
 		)
-		classpath += files(moduleProjects.collect { it.sourceSets.main.compileClasspath })
+		classpath += files(rootProject.ext.moduleProjects.collect { it.sourceSets.main.compileClasspath })
 	}
 }
 
@@ -96,7 +96,7 @@ tasks.register('schemaZip', Zip) {
 	description = "Builds -${archiveClassifier} archive containing all " +
 			"XSDs for deployment at https://springframework.org/schema."
 	duplicatesStrategy = DuplicatesStrategy.EXCLUDE
-	moduleProjects.each { module ->
+	rootProject.ext.moduleProjects.each { module ->
 		def Properties schemas = new Properties();
 
 		module.sourceSets.main.resources.find {

framework-bom/framework-bom.gradle

@@ -8,7 +8,7 @@ group = "org.springframework"
 dependencies {
 	constraints {
 		parent.moduleProjects.sort { "$it.name" }.each {
-			api it
+			api project(it.path)
 		}
 	}
 }

framework-docs/antora-playbook.yml

@@ -15,8 +15,8 @@ content:
     # https://docs.antora.org/antora/latest/playbook/content-refname-matching/
     # branches: We include snapshots for main, 6.2.x, and 7.0.x to 9.*.x.
     branches: ['main', '6.2.x', '{7..9}.+({0..9}).x']
-    # tags: We effectively include all releases from 6.0.9 to 9.*.*.
-    tags: ['v{6..9}.+({0..9}).+({0..9})?(-{RC,M}*)', '!(v6.0.{0..8})', '!(v6.0.0-{RC,M}{0..9})']
+    # tags: include all releases from 6.2.0 to 9.*.*.
+    tags: ['v6.2.+({0..9})', 'v{7..9}.+({0..9}).+({0..9})?(-{RC,M}*)']
     start_path: framework-docs
 asciidoc:
   extensions:
@@ -38,4 +38,4 @@ runtime:
     failure_level: warn
 ui:
   bundle:
-    url: https://github.com/spring-io/antora-ui-spring/releases/download/v0.4.25/ui-bundle.zip
+    url: https://github.com/spring-io/antora-ui-spring/releases/download/v0.4.26/ui-bundle.zip

framework-docs/antora.yml

@@ -31,7 +31,7 @@ asciidoc:
     spring-org: 'spring-projects'
     spring-github-org: "https://github.com/{spring-org}"
     spring-framework-github: "https://github.com/{spring-org}/spring-framework"
-    spring-framework-code: '{spring-framework-github}/tree/main'
+    spring-framework-code: '{spring-framework-github}/tree/7.0.x'
     spring-framework-issues: '{spring-framework-github}/issues'
     spring-framework-wiki: '{spring-framework-github}/wiki'
     # Docs

framework-docs/framework-docs.gradle

@@ -20,6 +20,10 @@ antora {
 	]
 }
 
+node {
+	version = '24.15.0'
+}
+
 tasks.named("generateAntoraYml") {
 	asciidocAttributes = project.provider( {
 		return  ["spring-version": project.version ]

framework-docs/modules/ROOT/nav.adoc

@@ -198,6 +198,7 @@
 *** xref:web/webmvc/mvc-uri-building.adoc[]
 *** xref:web/webmvc/mvc-ann-async.adoc[]
 *** xref:web/webmvc/mvc-range.adoc[]
+*** xref:web/webmvc/mvc-data-binding.adoc[]
 *** xref:web/webmvc-cors.adoc[]
 *** xref:web/webmvc-versioning.adoc[]
 *** xref:web/webmvc/mvc-ann-rest-exceptions.adoc[]
@@ -295,6 +296,7 @@
 *** xref:web/webflux-functional.adoc[]
 *** xref:web/webflux/uri-building.adoc[]
 *** xref:web/webflux/range.adoc[]
+*** xref:web/webflux/data-binding.adoc[]
 *** xref:web/webflux-cors.adoc[]
 *** xref:web/webflux-versioning.adoc[]
 *** xref:web/webflux/ann-rest-exceptions.adoc[]

framework-docs/modules/ROOT/pages/appendix.adoc

@@ -74,6 +74,17 @@ expressions used in XML bean definitions, `@Value`, etc.
 | The mode to use when compiling expressions for the
 xref:core/expressions/evaluation.adoc#expressions-compiler-configuration[Spring Expression Language].
 
+| `spring.expression.maxBigPowerBits`
+| The default maximum number of bits permitted in the result of a `BigDecimal` or
+`BigInteger` power operation within a
+xref:core/expressions/evaluation.adoc#expressions-parser-configuration[Spring Expression Language]
+expression.
+
+| `spring.expression.maxOperations`
+| The default maximum number of operations permitted during
+xref:core/expressions/evaluation.adoc#expressions-parser-configuration[Spring Expression Language]
+expression evaluation.
+
 | `spring.getenv.ignore`
 | Instructs Spring to ignore operating system environment variables if a Spring
 `Environment` property -- for example, a placeholder in a configuration String -- isn't
@@ -138,6 +149,11 @@ xref:testing/testcontext-framework/ctx-management/context-pausing.adoc[Context P
 in the _Spring TestContext Framework_. See
 xref:testing/testcontext-framework/ctx-management/failure-threshold.adoc[Context Failure Threshold].
 
+| `spring.test.extension.context.scope`
+| The default _extension context scope_ used by the `SpringExtension` in `@Nested` test
+class hierarchies. See
+xref:testing/annotations/integration-junit-jupiter.adoc#integration-testing-annotations-springextensionconfig[`@SpringExtensionConfig`].
+
 | `spring.test.enclosing.configuration`
 | The default _enclosing configuration inheritance mode_ to use if
 `@NestedTestConfiguration` is not present on a test class. See

framework-docs/modules/ROOT/pages/core/aot.adoc

@@ -378,7 +378,7 @@ The container also supports creating a bean with {spring-framework-api}++/beans/
 
 . The custom arguments require dynamic introspection of a matching constructor or factory method.
 Those arguments cannot be detected by AOT, so the necessary reflection hints will have to be provided manually.
-. By-passing the instance supplier means that all other optimizations after creation are skipped as well.
+. Bypassing the instance supplier means that all other optimizations after creation are skipped as well.
 For instance, autowiring on fields and methods will be skipped as they are handled in the instance supplier.
 
 Rather than having prototype-scoped beans created with custom arguments, we recommend a manual factory pattern where a bean is responsible for the creation of the instance.

framework-docs/modules/ROOT/pages/core/beans/annotation-config/autowired-qualifiers.adoc

@@ -274,7 +274,7 @@ Kotlin::
 Next, you can provide the information for the candidate bean definitions. You can add
 `<qualifier/>` tags as sub-elements of the `<bean/>` tag and then specify the `type` and
 `value` to match your custom qualifier annotations. The type is matched against the
-fully-qualified class name of the annotation. Alternately, as a convenience if no risk of
+fully-qualified class name of the annotation. Alternatively, as a convenience if no risk of
 conflicting names exists, you can use the short class name. The following example
 demonstrates both approaches:
 

framework-docs/modules/ROOT/pages/core/beans/context-introduction.adoc

@@ -575,7 +575,7 @@ Kotlin::
 ----
 ======
 
-NOTE: Do not define such beans to be lazy as the `ApplicationContext` will honour that and will not register the method to listen to events.
+NOTE: Do not define such beans to be lazy as the `ApplicationContext` will honor that and will not register the method to listen to events.
 
 The method signature once again declares the event type to which it listens,
 but, this time, with a flexible name and without implementing a specific listener interface.

framework-docs/modules/ROOT/pages/core/beans/java/composing-configuration-classes.adoc

@@ -610,6 +610,19 @@ Kotlin::
 See the {spring-framework-api}/context/annotation/Conditional.html[`@Conditional`]
 javadoc for more detail.
 
+[NOTE]
+====
+A `@Conditional` annotation declared on an enclosing `@Configuration` class is only
+applied to the registration of a nested `@Configuration` class if the nested class is
+reached through the parser's recursion from its enclosing class, or via `@Import`. If a
+nested class is discovered independently of its enclosing class — for example, via
+`@ComponentScan` or by directly registering it against the application context — it is
+processed using only its own `@Conditional` annotations. Thus, if you wish to ensure that
+the same `@Conditional` annotations apply in such scenarios, you must redeclare the
+relevant annotations on the nested class, or extract them into a composed annotation
+which you apply to both the enclosing class and the nested class.
+====
+
 
 [[beans-java-combining]]
 == Combining Java and XML Configuration

framework-docs/modules/ROOT/pages/core/expressions/evaluation.adoc

@@ -253,6 +253,175 @@ properties. Alternatively, configure custom accessors via
 `SimpleEvaluationContext.forPropertyAccessors(...)`, potentially disable assignment, and
 optionally activate method resolution and/or a type converter through the builder.
 
+[[expressions-evaluation-context-security]]
+=== Security Considerations
+
+SpEL is a powerful expression language that can invoke constructors and methods, read and
+write properties and fields, and reference beans – all backed by reflection. Because of
+this power, evaluating a SpEL expression obtained from an untrusted source is inherently
+dangerous and should generally be avoided, since doing so can effectively grant that
+source the ability to execute arbitrary code within the application, regardless of which
+`EvaluationContext` implementation is used.
+
+Throughout this section, a source of a SpEL expression is considered "trusted" only if it
+is a developer of the application or an administrator responsible for configuring or
+operating the application. Any other source of a SpEL expression must be treated as
+untrusted – for example, an expression supplied by an end user of the application or
+received from an external system.
+
+[WARNING]
+====
+`StandardEvaluationContext` exposes the complete SpEL language and must *never* be used
+to evaluate an expression obtained from an untrusted source.
+====
+
+Although `SimpleEvaluationContext` restricts the SpEL language to a subset of its
+features, that restriction is provided on a best-effort basis and does not guarantee that
+expression evaluation is safe. Since an expression can potentially invoke any property,
+method, or function reachable via the configured root object, property accessors, method
+resolvers, variables, and functions, care must be taken if you choose to evaluate
+expressions from an untrusted source. It is therefore the responsibility of the code that
+configures an `EvaluationContext` – for example, by supplying a root object or by
+registering property accessors, resolvers, variables, or functions – to ensure that none
+of the objects reachable via the context expose operations that would be dangerous if
+invoked by an expression from an untrusted source.
+
+Furthermore, a property "getter" reachable from an expression is not necessarily a pure,
+side-effect-free read operation. A JavaBean-style accessor (such as `getName()` or
+`isActive()`) and a plain accessor method used to support data classes such as Java
+records and Kotlin data classes (such as `name()`) are indistinguishable from a method
+that performs an action and happens to return a value (that is, a method which is
+*accessor-shaped*). For example, the `public boolean delete()` method in `java.io.File`
+looks like a plain accessor method to SpEL. Specifically, neither
+`ReflectivePropertyAccessor` nor `DataBindingPropertyAccessor` can determine whether such
+a method is free of side effects. Moreover, restricting a `SimpleEvaluationContext` to
+read-only data binding governs only whether *assignment* to a property is permitted: it
+does not verify that reading a property is side-effect-free. When exposing a root object
+or other reachable object to an untrusted expression, you must ensure that none of its
+accessor-shaped methods perform an action that would be unsafe if triggered by that
+expression.
+
+[NOTE]
+.What makes a method "accessor-shaped"?
+====
+A method is accessor-shaped if it is `public`, takes no arguments, and returns a value –
+the same shape that `ReflectivePropertyAccessor` and `DataBindingPropertyAccessor` look
+for when resolving a property "getter" by name. That shape says nothing about whether
+invoking the method is actually free of side effects. For example, the following methods
+are all accessor-shaped, but only some of them are safe to invoke as a property read.
+
+Side-effect-free (safe to expose as properties):
+
+* `getName()` and `isActive()`: conventional JavaBean-style accessors.
+* `name()` and `active()`: plain accessor methods used by data classes such as Java
+  records and Kotlin data classes.
+
+Side-effecting (unsafe to expose as properties, despite the identical shape):
+
+* `java.io.File#delete()`: deletes the underlying file and returns whether the deletion
+  succeeded.
+* `java.util.Queue#poll()`: removes and returns the head element, mutating the queue.
+* `java.util.concurrent.atomic.AtomicInteger#incrementAndGet()`: increments and returns
+  a counter, mutating it.
+
+If an untrusted expression can reference `someFile.delete`, `someQueue.poll`, or
+`someCounter.incrementAndGet` as a property, SpEL invokes the corresponding method just
+as readily as it would invoke a genuine getter.
+====
+
+[[expressions-evaluation-context-object-design]]
+=== Object Design
+
+Similar to the design guidance for
+xref:web/webmvc/mvc-data-binding.adoc#mvc-data-binding-design[web data binding], you
+should carefully design any object that may be reached from a SpEL expression evaluated
+against untrusted input. This applies not only to the root object supplied to an
+`EvaluationContext` but also to every object that such an expression can navigate to from
+that root object – for example, an object returned by a property, a method, an index
+operation, a variable, or a function.
+
+When exposing an object to expressions from an untrusted source, consider the following
+recommendations.
+
+Use a dedicated type::
+  Prefer a dedicated type, designed specifically to be evaluated against untrusted
+  expressions, over passing an existing domain or infrastructure type "as is". A
+  dedicated type lets you control exactly which properties and methods are reachable from
+  an expression, rather than exposing the full surface area of a class such as a JPA
+  entity, `java.io.File`, or a JDBC `Connection` – most of which were never designed with
+  SpEL evaluation in mind.
+
+Prefer immutability::
+  An immutable type – for example, a Java record or a Kotlin data class exposing only
+  `val` properties – rules out property writes and eliminates any concern that a "getter"
+  might mutate state as a side effect, since there is no mutable state to affect.
+  Immutability does not, on its own, rule out an accessor-shaped method with an external
+  side effect (such as a network call or a file system operation), but it removes an
+  entire class of risk.
+
+Limit scope::
+  Expose only the properties and methods that the expression is expected to use, and
+  nothing more. Because a `PropertyAccessor` cannot restrict access to specific
+  properties or methods on a per-expression basis, every accessor-shaped method reachable
+  on an exposed object is reachable by any expression that can reach that object –
+  regardless of which property or method the application intended the expression to use.
+
+Audit accessor-shaped methods::
+  Review every accessor-shaped method exposed by a type before making it reachable from
+  an untrusted expression, keeping the <<expressions-evaluation-context-security,
+  security considerations>> discussed above in mind. None of the reachable methods should
+  perform an action that would be unsafe if triggered by that expression.
+
+[WARNING]
+====
+These recommendations apply transitively. If the root object exposes a property or method
+that returns another object, and an untrusted expression can navigate to it (for example,
+`rootObject.child.grandchild`), the nested object is just as reachable as the root object
+itself and must meet the same design requirements. The same is true for an object reached
+via indexing (for example, `rootObject.items[0]` or `rootObject.items['key']`): whatever
+is returned by the index operation is just as reachable as any other nested object.
+====
+
+[[expressions-evaluation-context-lifecycle]]
+=== Lifecycle and Reuse
+
+For performance, the AST nodes that make up a parsed `Expression` may cache the specific
+`PropertyAccessor`, `IndexAccessor`, `MethodExecutor`, or `ConstructorExecutor` that
+satisfied a previous evaluation, so that later evaluations of the same node can avoid
+asking every registered accessor or resolver in turn. Understanding this caching behavior
+is essential to using `Expression` and `EvaluationContext` correctly, in addition to the
+<<expressions-evaluation-context-security,security considerations>> discussed previously.
+
+A parsed `Expression` is designed to be created once and evaluated repeatedly, and doing
+so is both supported and encouraged. In particular:
+
+* A parsed `Expression` may be evaluated against different root objects, and against
+  different `EvaluationContext` instances of the *same type and with equivalent
+  configuration* – for example, several `StandardEvaluationContext` instances each
+  registering the same kind of custom `PropertyAccessor`. Changing the accessors or
+  resolvers registered with a context between evaluations of the same expression is
+  atypical and generally not advised, but is expected to work correctly: the registered
+  state of the *current* context is what is consulted, not a snapshot taken during an
+  earlier evaluation.
+* A parsed `Expression` must *not* be evaluated first against a context with one set of
+  security implications and later against a context with different, typically more
+  restrictive, security implications – for example, first against a
+  `StandardEvaluationContext` and later against a `SimpleEvaluationContext`. Doing so is
+  analogous to executing a database query on behalf of an administrator, caching the
+  resulting administrator-privileged execution plan, and then reusing that cached plan for
+  a lower-privileged user while expecting the lower-privileged user's restrictions to
+  apply: cached state from the first, more permissive evaluation may be reused during the
+  second, and the second context's restrictions cannot be reliably enforced as a result.
+  If the same expression string must be evaluated under contexts with different security
+  implications, parse it into *distinct* `Expression` instances, one per context.
+
+[WARNING]
+====
+Reusing a single parsed `Expression` across `EvaluationContext` instances with different
+security implications is not a supported usage pattern and must be avoided, regardless of
+which `EvaluationContext` implementations are involved.
+====
+
 [[expressions-type-conversion]]
 === Type Conversion
 
@@ -395,6 +564,29 @@ set a JVM system property or Spring property named `spring.context.expression.ma
 to the maximum expression length needed by your application (see
 xref:appendix.adoc#appendix-spring-properties[Supported Spring Properties]).
 
+Similarly, the number of operations performed during the evaluation of a SpEL expression
+cannot exceed 10,000 by default; however, the `maxOperations` value is configurable. If
+you create a `SpelExpressionParser` programmatically (the recommend approach), you can
+specify a custom `maxOperations` value when creating the `SpelParserConfiguration` that
+you provide to the `SpelExpressionParser`. If you are not able to configure an explicit
+value for `maxOperations` via `SpelParserConfiguration`, you can set a JVM system
+property or Spring property named `spring.expression.maxOperations` to the maximum number
+of operations required by your application (see
+xref:appendix.adoc#appendix-spring-properties[Supported Spring Properties]).
+
+In addition, the result of a `BigDecimal` or `BigInteger` power operation within a SpEL
+expression cannot exceed 1,000,000 bits by default – approximately equivalent to a
+decimal number with 300,000 digits. Power operations involving large base values or large
+exponents can be computationally expensive, and this limit ensures that evaluations
+remain bounded; however, the `maximumBigPowerBits` value is configurable. If you create a
+`SpelExpressionParser` programmatically (the recommended approach), you can specify a
+custom `maximumBigPowerBits` value when creating the `SpelParserConfiguration` that you
+provide to the `SpelExpressionParser`. To remove this limit entirely, pass
+`Integer.MAX_VALUE` as the `maximumBigPowerBits` value. If you are not able to configure
+an explicit value for `maximumBigPowerBits` via `SpelParserConfiguration`, you can set a
+JVM system property or Spring property named `spring.expression.maxBigPowerBits` to the
+maximum result size in bits (see xref:appendix.adoc#appendix-spring-properties[Supported
+Spring Properties]).
 
 [[expressions-spel-compilation]]
 == SpEL Compilation

framework-docs/modules/ROOT/pages/core/expressions/language-ref.adoc

@@ -2,4 +2,12 @@
 = Language Reference
 :page-section-summary-toc: 1
 
-This section describes how the Spring Expression Language works.
+Spring Expression Language (SpEL) expressions are composed of a sequence of tokens such
+as literals, operators, method invocations, and so forth.
+
+Whitespace can be used freely between tokens to format and improve the readability of
+expressions. Specifically, the `\s` (space), `\t` (tab), `\r` (carriage return), and `\n`
+(newline) characters are all valid separators between tokens. However, whitespace is
+ignored by the expression parser unless it is part of a string literal.
+
+The following sections describe the features and syntax of SpEL.

framework-docs/modules/ROOT/pages/core/expressions/language-ref/properties-arrays.adoc

@@ -270,7 +270,7 @@ is applicable for typical implementations of indexed structures.
 NOTE: `ReflectiveIndexAccessor` also implements `CompilableIndexAccessor` in order to
 support xref:core/expressions/evaluation.adoc#expressions-spel-compilation[compilation]
 to bytecode for read access. Note, however, that the configured read-method must be
-invokable via a `public` class or `public` interface for compilation to succeed.
+invocable via a `public` class or `public` interface for compilation to succeed.
 
 The following code listings define a `Color` enum and `FruitMap` type that behaves like a
 map but does not implement the `java.util.Map` interface. Thus, if you want to index into

framework-docs/modules/ROOT/pages/core/resilience.adoc

@@ -25,7 +25,8 @@ public void sendNotification() {
 
 By default, the method invocation will be retried for any exception thrown: with at most
 3 retry attempts (`maxRetries = 3`) after an initial failure, and a delay of 1 second
-between attempts.
+between attempts. If all attempts have failed and the retry policy has been exhausted,
+the last original exception from the target method will be propagated to the caller.
 
 [NOTE]
 ====
@@ -69,17 +70,24 @@ Or for 4 retry attempts and an exponential back-off strategy with a bit of jitte
 [source,java,indent=0,subs="verbatim,quotes"]
 ----
 @Retryable(
-  includes = MessageDeliveryException.class,
-  maxRetries = 4,
-  delay = 100,
-  jitter = 10,
-  multiplier = 2,
-  maxDelay = 1000)
+        includes = MessageDeliveryException.class,
+        maxRetries = 4,
+        delay = 100,
+        jitter = 10,
+        multiplier = 2,
+        maxDelay = 1000)
 public void sendNotification() {
     this.jmsClient.destination("notifications").send(...);
 }
 ----
 
+[NOTE]
+====
+When `delay` is `0` combined with a positive `jitter`, the delay never grows
+regardless of any configured `multiplier`, so the full configured `jitter` is
+applied directly as a random delay in the range from `0` to `min(jitter, maxDelay)`.
+====
+
 Last but not least, `@Retryable` also works for reactive methods with a reactive return
 type, decorating the pipeline with Reactor's retry capabilities:
 
@@ -99,6 +107,13 @@ TIP: Several attributes in `@Retryable` have `String` variants that provide prop
 placeholder and SpEL support, as an alternative to the specifically typed annotation
 attributes used in the above examples.
 
+[TIP]
+====
+During `@Retryable` processing, Spring publishes a `MethodRetryEvent` for every exception
+coming out of the target method. This can be used to track/log all original exceptions
+whereas the caller of the `@Retryable` method will only ever see the last exception.
+====
+
 
 [[resilience-annotations-concurrencylimit]]
 == `@ConcurrencyLimit`
@@ -174,7 +189,7 @@ configured {spring-framework-api}/core/retry/RetryPolicy.html[`RetryPolicy`].
 ----
     var retryTemplate = new RetryTemplate(); // <1>
 
-    retryTemplate.execute(
+    retryTemplate.invoke(
             () -> jmsClient.destination("notifications").send(...));
 ----
 <1> Implicitly uses `RetryPolicy.withDefaults()`.
@@ -200,7 +215,7 @@ If you only need to customize the number of retry attempts, you can use the
 ----
     var retryTemplate = new RetryTemplate(RetryPolicy.withMaxRetries(4)); // <1>
 
-    retryTemplate.execute(
+    retryTemplate.invoke(
             () -> jmsClient.destination("notifications").send(...));
 ----
 <1> Explicitly uses `RetryPolicy.withMaxRetries(4)`.
@@ -218,7 +233,7 @@ matched against an exception thrown by a failed operation as well as nested caus
 
     var retryTemplate = new RetryTemplate(retryPolicy);
 
-    retryTemplate.execute(
+    retryTemplate.invoke(
             () -> jmsClient.destination("notifications").send(...));
 ----
 <1> Specify one or more exception types to include.
@@ -251,21 +266,108 @@ and an exponential back-off strategy with a bit of jitter.
 
     var retryTemplate = new RetryTemplate(retryPolicy);
 
-    retryTemplate.execute(
+    retryTemplate.invoke(
             () -> jmsClient.destination("notifications").send(...));
 ----
 
-[TIP]
+[NOTE]
 ====
-A {spring-framework-api}/core/retry/RetryListener.html[`RetryListener`] can be registered
-with a `RetryTemplate` to react to events published during key retry phases (before a
-retry attempt, after a retry attempt, etc.), and you can compose multiple listeners via a
-{spring-framework-api}/core/retry/support/CompositeRetryListener.html[`CompositeRetryListener`].
+When `delay` is zero combined with a positive `jitter`, the delay never grows
+regardless of any configured `multiplier`, so the full configured `jitter` is
+applied directly as a random delay in the range from zero to `min(jitter, maxDelay)`.
 ====
 
+[TIP]
+====
 Although the factory methods and builder API for `RetryPolicy` cover most common
 configuration scenarios, you can implement a custom `RetryPolicy` for complete control
 over the types of exceptions that should trigger a retry as well as the
-{spring-framework-api}/util/backoff/BackOff.html[`BackOff`] strategy to use. Note that you
-can also configure a customized `BackOff` strategy via the `backOff()` method in the
-`RetryPolicy.Builder`.
+{spring-framework-api}/util/backoff/BackOff.html[`BackOff`] strategy to use. Note that
+you can also configure a customized `BackOff` strategy via the `backOff()` method in
+the `RetryPolicy.Builder`.
+====
+
+Note that the examples above apply a pattern similar to `@Retryable` method invocations
+where the last original exception will be propagated to the caller, using the `invoke`
+variants on `RetryTemplate` which are available with and without a return value.
+The callback may throw unchecked exceptions, the last one of which is exposed for
+direct handling on the caller side:
+
+[source,java,indent=0,subs="verbatim,quotes"]
+----
+    try {
+        retryTemplate.invoke(
+                () -> jmsClient.destination("notifications").send(...));
+    }
+    catch (MessageDeliveryException ex) {
+        // coming out of the original JmsClient send method
+    }
+----
+
+[source,java,indent=0,subs="verbatim,quotes"]
+----
+    try {
+        var result = retryTemplate.invoke(() -> {
+            jmsClient.destination("notifications").send(...);
+            return "result";
+        });
+    }
+    catch (MessageDeliveryException ex) {
+        // coming out of the original JmsClient send method
+    }
+----
+
+`RetryTemplate` instances are very light and can be created on the fly,
+potentially with a specific retry policy to use for a given invocation:
+
+[source,java,indent=0,subs="verbatim,quotes"]
+----
+    try {
+        new RetryTemplate(RetryPolicy.withMaxRetries(4)).invoke(
+                () -> jmsClient.destination("notifications").send(...));
+    }
+    catch (MessageDeliveryException ex) {
+        // coming out of the original JmsClient send method
+    }
+----
+
+For deeper interaction, you may use RetryTemplate's `execute` method. The caller will
+have to handle the checked `RetryException` thrown by `RetryTemplate`, exposing the
+outcome of all attempts:
+
+[source,java,indent=0,subs="verbatim,quotes"]
+----
+    try {
+        var result = retryTemplate.execute(() -> {
+            jmsClient.destination("notifications").send(...);
+            return "result";
+        });
+    }
+    catch (RetryException ex) {
+        // ex.getExceptions() / ex.getLastException() ...
+    }
+----
+
+A {spring-framework-api}/core/retry/RetryListener.html[`RetryListener`] can be registered
+with a `RetryTemplate` to react to key retry steps (before or after a retry attempt etc.)
+or simply to every invocation attempt, being able to track all exceptions coming out of
+the callback and all retry outcomes (exhaustion, interruption, timeout). This is
+particularly useful when using `invoke` where no retry state other than the last
+original exception is exposed otherwise:
+
+[source,java,indent=0,subs="verbatim,quotes"]
+----
+    var retryTemplate = new RetryTemplate();
+    retryTemplate.setRetryListener(new RetryListener() {
+        @Override
+        public void onRetryableExecution(RetryPolicy retryPolicy, Retryable<?> retryable, RetryState retryState) {
+            ...
+        }
+    });
+
+    retryTemplate.invoke(
+            () -> jmsClient.destination("notifications").send(...));
+----
+
+You can also compose multiple listeners via a
+{spring-framework-api}/core/retry/support/CompositeRetryListener.html[`CompositeRetryListener`].

framework-docs/modules/ROOT/pages/core/validation/data-binding.adoc

@@ -347,10 +347,10 @@ recognized and used as the `PropertyEditor` for `Something`-typed properties.
 [literal,subs="verbatim,quotes"]
 ----
 com
-  chank
-    pop
-      Something
-      SomethingEditor // the PropertyEditor for the Something class
+└── example
+    └── things
+        ├── *Something*
+        └── *SomethingEditor* // the PropertyEditor for the Something class
 ----
 
 Note that you can also use the standard `BeanInfo` JavaBeans mechanism here as well
@@ -362,10 +362,10 @@ following example uses the `BeanInfo` mechanism to explicitly register one or mo
 [literal,subs="verbatim,quotes"]
 ----
 com
-  chank
-    pop
-      Something
-      SomethingBeanInfo // the BeanInfo for the Something class
+└── example
+    └── things
+        ├── *Something*
+        └── *SomethingBeanInfo* // the BeanInfo for the Something class
 ----
 
 The following Java source code for the referenced `SomethingBeanInfo` class

framework-docs/modules/ROOT/pages/data-access/transaction/declarative/tx-propagation.adoc

@@ -22,7 +22,7 @@ where all the underlying resources have to participate in the service-level tran
 
 NOTE: By default, a participating transaction joins the characteristics of the outer scope,
 silently ignoring the local isolation level, timeout value, or read-only flag (if any).
-Consider switching the `validateExistingTransactions` flag to `true` on your transaction
+Consider switching the `validateExistingTransaction` flag to `true` on your transaction
 manager if you want isolation level declarations to be rejected when participating in
 an existing transaction with a different isolation level. This non-lenient mode also
 rejects read-only mismatches (that is, an inner read-write transaction that tries to participate

framework-docs/modules/ROOT/pages/integration/observability.adoc

@@ -1,10 +1,15 @@
 [[observability]]
 = Observability Support
 
+With https://docs.micrometer.io/micrometer/reference/concepts.html[Micrometer], developers can instrument libraries and applications for metrics (timers, gauges, counters)
+that collect statistics about their runtime behavior. Metrics can help you to track error rates, usage patterns, performance, and more.
+https://docs.micrometer.io/tracing/reference/[Micrometer can also produce traces], giving you a holistic view of an entire system, crossing application boundaries; you can zoom in on particular user requests and follow their entire completion across applications.
+
 Micrometer defines an {micrometer-docs}/observation.html[Observation concept that enables both Metrics and Traces] in applications.
-Metrics support offers a way to create timers, gauges, or counters for collecting statistics about the runtime behavior of your application.
-Metrics can help you to track error rates, usage patterns, performance, and more.
-Traces provide a holistic view of an entire system, crossing application boundaries; you can zoom in on particular user requests and follow their entire completion across applications.
+Each observation will produce:
+
+* https://docs.micrometer.io/micrometer/reference/observation/components.html#micrometer-observation-default-meter-handler[several metrics - a timer, a long task timer and many counters]
+* a https://docs.micrometer.io/tracing/reference/glossary.html[span for the current trace]
 
 Spring Framework instruments various parts of its own codebase to publish observations if an `ObservationRegistry` is configured.
 You can learn more about {spring-boot-docs-ref}/actuator/observability.html[configuring the observability infrastructure in Spring Boot].

framework-docs/modules/ROOT/pages/integration/rest-clients.adoc

@@ -1179,7 +1179,7 @@ built-in decorators to suppress 404 exceptions and return a `ResponseEntity` wit
 [source,java,indent=0,subs="verbatim,quotes"]
 ----
 	// For RestClient
-	HttpServiceProxyFactory factory = HttpServiceProxyFactory.builderFor(restCqlientAdapter)
+	HttpServiceProxyFactory factory = HttpServiceProxyFactory.builderFor(restClientAdapter)
 			.exchangeAdapterDecorator(NotFoundRestClientAdapterDecorator::new)
 			.build();
 

framework-docs/modules/ROOT/pages/testing/annotations/integration-junit-jupiter.adoc

@@ -3,7 +3,7 @@
 
 The following annotations are supported when used in conjunction with the
 xref:testing/testcontext-framework/support-classes.adoc#testcontext-junit-jupiter-extension[`SpringExtension`]
-and JUnit Jupiter (that is, the programming model in JUnit):
+and the JUnit Jupiter testing framework:
 
 * xref:testing/annotations/integration-junit-jupiter.adoc#integration-testing-annotations-springextensionconfig[`@SpringExtensionConfig`]
 * xref:testing/annotations/integration-junit-jupiter.adoc#integration-testing-annotations-junit-jupiter-springjunitconfig[`@SpringJUnitConfig`]
@@ -30,30 +30,39 @@ developer wishes to switch to test-class scoped semantics — the `SpringExtensi
 configured to use a test-class scoped `ExtensionContext` by annotating a top-level test
 class with `@SpringExtensionConfig(useTestClassScopedExtensionContext = true)`.
 
+Alternatively, you can change the global default by setting the
+`spring.test.extension.context.scope` property to `test_class`. The property is resolved
+first via the xref:appendix.adoc#appendix-spring-properties[`SpringProperties`] mechanism
+which also supports JVM system properties — for example,
+`-Dspring.test.extension.context.scope=test_class`. If the Spring property has not been
+set, the `SpringExtension` will attempt to resolve the property as a
+https://docs.junit.org/current/running-tests/configuration-parameters.html[JUnit Platform configuration parameter]
+as a fallback mechanism. If the property has not been set via either of those mechanisms,
+the `SpringExtension` will use a test-method scoped extension context by default. Note,
+however, that a `@SpringExtensionConfig` declaration always takes precedence over this
+property.
+
 [TIP]
 ====
-If your top-level test class is configured to use JUnit Jupiter's
-`@TestInstance(Lifecycle.PER_CLASS)` semantics, the `SpringExtension` will always use a
-test-class scoped `ExtensionContext`, and there is no need to declare
-`@SpringExtensionConfig(useTestClassScopedExtensionContext = true)`.
+If a test class uses JUnit Jupiter's `@TestInstance(Lifecycle.PER_CLASS)` semantics, the
+`SpringExtension` will always use a test-class scoped `ExtensionContext`, and
+configuration via `@SpringExtensionConfig(useTestClassScopedExtensionContext = true)` or
+the `spring.test.extension.context.scope` property will have no effect for that test
+class.
 ====
 
 [NOTE]
 ====
 This annotation is currently only applicable to `@Nested` test class hierarchies and
 should be applied to the top-level enclosing class of a `@Nested` test class hierarchy.
-
 Consequently, there is no need to declare this annotation on a test class that does not
 contain `@Nested` test classes.
-====
 
-[NOTE]
-====
+In addition,
 xref:testing/annotations/integration-junit-jupiter.adoc#integration-testing-annotations-nestedtestconfiguration[`@NestedTestConfiguration`]
-does not apply to this annotation.
-
-`@SpringExtensionConfig` will always be detected within a `@Nested` test class hierarchy,
-effectively disregarding any `@NestedTestConfiguration(OVERRIDE)` declarations.
+does not apply to this annotation. `@SpringExtensionConfig` will always be detected
+within a `@Nested` test class hierarchy, effectively disregarding any
+`@NestedTestConfiguration(OVERRIDE)` declarations.
 ====
 
 [[integration-testing-annotations-junit-jupiter-springjunitconfig]]

framework-docs/modules/ROOT/pages/testing/annotations/integration-spring/annotation-activeprofiles.adoc

@@ -72,6 +72,13 @@ bean definition profiles programmatically by implementing a custom
 xref:testing/testcontext-framework/ctx-management/env-profiles.adoc#testcontext-ctx-management-env-profiles-ActiveProfilesResolver[`ActiveProfilesResolver`]
 and registering it by using the `resolver` attribute of `@ActiveProfiles`.
 
+NOTE: When `@ActiveProfiles` is declared on a test class, the `spring.profiles.active`
+property (whether configured as a JVM system property or environment variable) is not
+taken into account by the TestContext Framework when determining active profiles. If
+you need to allow `spring.profiles.active` to override the profiles configured via
+`@ActiveProfiles`, you can implement a custom `ActiveProfilesResolver` as described in
+xref:testing/testcontext-framework/ctx-management/env-profiles.adoc[Context Configuration with Environment Profiles].
+
 See xref:testing/testcontext-framework/ctx-management/env-profiles.adoc[Context Configuration with Environment Profiles],
 xref:testing/testcontext-framework/support-classes.adoc#testcontext-junit-jupiter-nested-test-configuration[`@Nested` test class configuration], and the
 {spring-framework-api}/test/context/ActiveProfiles.html[`@ActiveProfiles`] javadoc for

framework-docs/modules/ROOT/pages/testing/annotations/integration-spring/annotation-mockitobean.adoc

@@ -68,12 +68,22 @@ The `@MockitoBean` annotation uses the `REPLACE_OR_CREATE`
 xref:testing/testcontext-framework/bean-overriding.adoc#testcontext-bean-overriding-strategy[strategy for bean overrides].
 If a corresponding bean does not exist, a new bean will be created. However, you can
 switch to the `REPLACE` strategy by setting the `enforceOverride` attribute to `true` –
-for example, `@MockitoBean(enforceOverride = true)`.
+for example, `@MockitoBean(enforceOverride = true)`. Because this strategy replaces the
+bean directly, bypassing the container's normal bean post-processing, the resulting mock
+is a bare object: it is never wrapped in a Spring AOP proxy, even if the original bean
+would have been — for example, due to `@Transactional`, `@Cacheable`, or `@Retryable`. See
+xref:testing/testcontext-framework/bean-overriding.adoc#testcontext-bean-overriding-aop-proxies[Bean
+Overrides and Spring AOP Proxies] for details.
 
 The `@MockitoSpyBean` annotation uses the `WRAP`
-xref:testing/testcontext-framework/bean-overriding.adoc#testcontext-bean-overriding-strategy[strategy],
-and the original instance is wrapped in a Mockito spy. This strategy requires that
-exactly one candidate bean exists.
+xref:testing/testcontext-framework/bean-overriding.adoc#testcontext-bean-overriding-strategy[strategy]:
+an early instance of the original bean is captured and used to create a Mockito spy.
+This strategy requires that exactly one candidate bean exists. In contrast to
+`@MockitoBean`, if the original bean would have been wrapped in a Spring AOP proxy, that
+proxy is still created — but it now wraps the spy instead of the original bean. See
+<<spring-testing-annotation-beanoverriding-mockitospybean-aop-proxies,`@MockitoSpyBean` and Spring AOP Proxies>>
+for a diagram and further details on the consequences this has for stubbing and
+verification.
 
 [TIP]
 ====
@@ -140,6 +150,21 @@ Java::
 	}
 ----
 <1> Replace the bean with type `CustomService` with a Mockito mock.
+
+Kotlin::
++
+[source,kotlin,indent=0,subs="verbatim,quotes"]
+----
+	@SpringJUnitConfig(TestConfig::class)
+	class BeanOverrideTests {
+
+		@MockitoBean // <1>
+		lateinit var customService: CustomService
+
+		// tests...
+	}
+----
+<1> Replace the bean with type `CustomService` with a Mockito mock.
 ======
 
 In the example above, we are creating a mock for `CustomService`. If more than one bean
@@ -168,6 +193,22 @@ Java::
 	}
 ----
 <1> Replace the bean named `service` with a Mockito mock.
+
+Kotlin::
++
+[source,kotlin,indent=0,subs="verbatim,quotes"]
+----
+	@SpringJUnitConfig(TestConfig::class)
+	class BeanOverrideTests {
+
+		@MockitoBean("service") // <1>
+		lateinit var customService: CustomService
+
+		// tests...
+
+	}
+----
+<1> Replace the bean named `service` with a Mockito mock.
 ======
 
 The following `@SharedMocks` annotation registers two mocks by-type and one mock by-name.
@@ -187,6 +228,19 @@ Java::
 ----
 <1> Register `OrderService` and `UserService` mocks by-type.
 <2> Register `PrintingService` mock by-name.
+
+Kotlin::
++
+[source,kotlin,indent=0,subs="verbatim,quotes"]
+----
+	@Target(AnnotationTarget.CLASS)
+	@Retention(AnnotationRetention.RUNTIME)
+	@MockitoBean(types = [OrderService::class, UserService::class]) // <1>
+	@MockitoBean(name = "ps1", types = [PrintingService::class]) // <2>
+	annotation class SharedMocks
+----
+<1> Register `OrderService` and `UserService` mocks by-type.
+<2> Register `PrintingService` mock by-name.
 ======
 
 The following demonstrates how `@SharedMocks` can be used on a test class.
@@ -217,6 +271,34 @@ Java::
 ----
 <1> Register common mocks via the custom `@SharedMocks` annotation.
 <2> Optionally inject mocks to _stub_ or _verify_ them.
+
+Kotlin::
++
+[source,kotlin,indent=0,subs="verbatim,quotes"]
+----
+	@SpringJUnitConfig(TestConfig::class)
+	@SharedMocks // <1>
+	class BeanOverrideTests {
+
+		@Autowired
+		lateinit var orderService: OrderService // <2>
+
+		@Autowired
+		lateinit var userService: UserService // <2>
+
+		@Autowired
+		lateinit var ps1: PrintingService // <2>
+
+		// Inject other components that rely on the mocks.
+
+		@Test
+		fun testThatDependsOnMocks() {
+			// ...
+		}
+	}
+----
+<1> Register common mocks via the custom `@SharedMocks` annotation.
+<2> Optionally inject mocks to _stub_ or _verify_ them.
 ======
 
 TIP: The mocks can also be injected into `@Configuration` classes or other test-related
@@ -246,6 +328,21 @@ Java::
 	}
 ----
 <1> Wrap the bean with type `CustomService` with a Mockito spy.
+
+Kotlin::
++
+[source,kotlin,indent=0,subs="verbatim,quotes"]
+----
+	@SpringJUnitConfig(TestConfig::class)
+	class BeanOverrideTests {
+
+		@MockitoSpyBean // <1>
+		lateinit var customService: CustomService
+
+		// tests...
+	}
+----
+<1> Wrap the bean with type `CustomService` with a Mockito spy.
 ======
 
 In the example above, we are wrapping the bean with type `CustomService`. If more than
@@ -271,6 +368,21 @@ Java::
 	}
 ----
 <1> Wrap the bean named `service` with a Mockito spy.
+
+Kotlin::
++
+[source,kotlin,indent=0,subs="verbatim,quotes"]
+----
+	@SpringJUnitConfig(TestConfig::class)
+	class BeanOverrideTests {
+
+		@MockitoSpyBean("service") // <1>
+		lateinit var customService: CustomService
+
+		// tests...
+	}
+----
+<1> Wrap the bean named `service` with a Mockito spy.
 ======
 
 The following `@SharedSpies` annotation registers two spies by-type and one spy by-name.
@@ -290,6 +402,19 @@ Java::
 ----
 <1> Register `OrderService` and `UserService` spies by-type.
 <2> Register `PrintingService` spy by-name.
+
+Kotlin::
++
+[source,kotlin,indent=0,subs="verbatim,quotes"]
+----
+	@Target(AnnotationTarget.CLASS)
+	@Retention(AnnotationRetention.RUNTIME)
+	@MockitoSpyBean(types = [OrderService::class, UserService::class]) // <1>
+	@MockitoSpyBean(name = "ps1", types = [PrintingService::class]) // <2>
+	annotation class SharedSpies
+----
+<1> Register `OrderService` and `UserService` spies by-type.
+<2> Register `PrintingService` spy by-name.
 ======
 
 The following demonstrates how `@SharedSpies` can be used on a test class.
@@ -320,8 +445,317 @@ Java::
 ----
 <1> Register common spies via the custom `@SharedSpies` annotation.
 <2> Optionally inject spies to _stub_ or _verify_ them.
+
+Kotlin::
++
+[source,kotlin,indent=0,subs="verbatim,quotes"]
+----
+	@SpringJUnitConfig(TestConfig::class)
+	@SharedSpies // <1>
+	class BeanOverrideTests {
+
+		@Autowired
+		lateinit var orderService: OrderService // <2>
+
+		@Autowired
+		lateinit var userService: UserService // <2>
+
+		@Autowired
+		lateinit var ps1: PrintingService // <2>
+
+		// Inject other components that rely on the spies.
+
+		@Test
+		fun testThatDependsOnMocks() {
+			// ...
+		}
+	}
+----
+<1> Register common spies via the custom `@SharedSpies` annotation.
+<2> Optionally inject spies to _stub_ or _verify_ them.
 ======
 
 TIP: The spies can also be injected into `@Configuration` classes or other test-related
 components in the `ApplicationContext` in order to configure them with Mockito's stubbing
 APIs.
+
+
+[[spring-testing-annotation-beanoverriding-mockitospybean-aop-proxies]]
+== `@MockitoSpyBean` and Spring AOP Proxies
+
+As explained in
+xref:testing/testcontext-framework/bean-overriding.adoc#testcontext-bean-overriding-aop-proxies[Bean
+Overrides and Spring AOP Proxies], if the bean being spied on would normally be wrapped in
+a Spring AOP proxy — for example, due to `@Transactional`, `@Cacheable`, or `@Retryable`
+— that proxy is still created, with the spy as its target. The bean injected into the
+test class and into other beans in the `ApplicationContext` is therefore the proxy, not
+the spy itself.
+
+Verification via Mockito's `verify()` API is unaffected by this and works transparently,
+regardless of whether it is invoked on the proxy or on the underlying spy.
+
+[[spring-testing-annotation-beanoverriding-mockitospybean-aop-proxies-stubbing]]
+=== Stubbing Through the Proxy
+
+Stubbing requires more care than verification, since `Mockito.doReturn(...).when(...)`,
+`Mockito.doThrow(...).when(...)`, and similar methods behave differently depending on the
+nature of the AOP advice involved when invoked on the proxy.
+
+NOTE: Since `when` is a reserved keyword in Kotlin, the Kotlin examples below use the
+`given(...)`, `willReturn(...)`, and `willThrow(...)` methods from `BDDMockito` instead
+of `Mockito.doReturn(...).when(...)` and `Mockito.doThrow(...).when(...)`.
+
+Advice that does not retain state between invocations — such as
+xref:core/resilience.adoc#resilience-annotations-retryable[`@Retryable`] — has no adverse
+effect on stubbing. The following stubbing sequence, invoked on the proxy, behaves exactly
+as it would on the underlying spy directly, including triggering a retry when the thrown
+exception is encountered.
+
+[tabs]
+======
+Java::
++
+[source,java,indent=0,subs="verbatim,quotes"]
+----
+	doReturn("ok")
+		.doThrow(new RuntimeException("Message delivery failed"))
+		.doReturn("ok again")
+		.when(clientService).sendMessage(any()); // <1>
+----
+<1> `clientService` is the injected proxy. Since `@Retryable` advice is a stateless
+    pass-through, each call — including the one that throws — reaches the spy directly.
+
+Kotlin::
++
+[source,kotlin,indent=0,subs="verbatim,quotes"]
+----
+	willReturn("ok")
+		.willThrow(RuntimeException("Message delivery failed"))
+		.willReturn("ok again")
+		.given(clientService).sendMessage(any()) // <1>
+----
+<1> `clientService` is the injected proxy. Since `@Retryable` advice is a stateless
+    pass-through, each call — including the one that throws — reaches the spy directly.
+======
+
+Advice that caches or otherwise memoizes the outcome of an invocation — such as
+`@Cacheable` — does not behave the same way. While a `doReturn(...)`, `doThrow(...)`, or
+similar declaration is being recorded, Mockito does not invoke the spy's real or
+previously stubbed behavior; instead, the invocation used to declare the stubbing returns
+an empty value (for example, `null`). If that invocation is made on the proxy, the caching
+advice caches this empty value, which then permanently shadows the spy for that
+combination of arguments — including for the very invocation that was supposed to
+configure the stubbing.
+
+[tabs]
+======
+Java::
++
+[source,java,indent=0,subs="verbatim,quotes"]
+----
+	doReturn(1L).when(dateService).getDate(false); // <1>
+	dateService.getDate(false); // <2>
+----
+<1> `dateService` is the injected proxy. This invocation is intercepted by Mockito's
+    stubbing infrastructure before it reaches the spy, so the caching advice ends up
+    caching an empty value for argument `false`.
+<2> Returns the empty value cached by the previous invocation — not `1L` — because the
+    cache was already populated.
+
+Kotlin::
++
+[source,kotlin,indent=0,subs="verbatim,quotes"]
+----
+	willReturn(1L).given(dateService).getDate(false) // <1>
+	dateService.getDate(false) // <2>
+----
+<1> `dateService` is the injected proxy. This invocation is intercepted by Mockito's
+    stubbing infrastructure before it reaches the spy, so the caching advice ends up
+    caching an empty value for argument `false`.
+<2> Returns the empty value cached by the previous invocation — not `1L` — because the
+    cache was already populated.
+======
+
+To avoid this, stub directly on the spy instead of on the proxy, by unwrapping the proxy
+with
+{spring-framework-api}/test/util/AopTestUtils.html#getUltimateTargetObject(java.lang.Object)[`AopTestUtils.getUltimateTargetObject(...)`].
+
+[tabs]
+======
+Java::
++
+[source,java,indent=0,subs="verbatim,quotes"]
+----
+	DateService spy = AopTestUtils.getUltimateTargetObject(dateService);
+	doReturn(1L).when(spy).getDate(false);
+----
+
+Kotlin::
++
+[source,kotlin,indent=0,subs="verbatim,quotes"]
+----
+	val spy = AopTestUtils.getUltimateTargetObject<DateService>(dateService)
+	willReturn(1L).given(spy).getDate(false)
+----
+======
+
+[[spring-testing-annotation-beanoverriding-mockitospybean-aop-proxies-disabling]]
+=== Disabling AOP Advice for Tests
+
+Rather than working around the proxy as shown above, you may instead prefer to disable
+the underlying AOP advice for the duration of the test, while keeping `@Retryable`,
+`@Cacheable`, or similar annotations in place in production code. Common reasons include
+avoiding retry delays that slow down the test suite, or avoiding caching altogether so
+that every invocation reaches the spy directly — which also sidesteps the stubbing
+pitfall described above, without having to unwrap the proxy at all.
+
+The general technique is to externalize whatever controls the advice's effective behavior
+— for example, the number of retry attempts or the `CacheManager` backing `@Cacheable`
+— and override that configuration for tests only, typically by using a bean override or a
+test-specific property. The proxy and its advice are still created, but their behavior is
+simply made a no-op or pure pass-through for the test.
+
+For `@Retryable`, bind the `maxRetriesString` attribute to a property placeholder with a
+sensible default (so that production configuration is unaffected if the property is not
+set), and override that property in the test with
+xref:testing/annotations/integration-spring/annotation-testpropertysource.adoc[`@TestPropertySource`]
+so that no retries are attempted.
+
+[tabs]
+======
+Java::
++
+[source,java,indent=0,subs="verbatim,quotes"]
+----
+	@Retryable(maxRetriesString = "${sendMessage.maxRetries:3}", delay = 10)
+	public String sendMessage(String request) {
+		// ...
+	}
+----
+
+Kotlin::
++
+[source,kotlin,indent=0,subs="verbatim,quotes"]
+----
+	@Retryable(maxRetriesString = "\${sendMessage.maxRetries:3}", delay = 10)
+	fun sendMessage(request: String): String {
+		// ...
+	}
+----
+======
+
+[tabs]
+======
+Java::
++
+[source,java,indent=0,subs="verbatim,quotes"]
+----
+	@SpringJUnitConfig
+	@TestPropertySource(properties = "sendMessage.maxRetries = 0") // <1>
+	class ClientServiceTests {
+
+		@MockitoSpyBean
+		ClientService clientService;
+
+		// test case body...
+	}
+----
+<1> With no retries permitted, the first (and only) attempt is made, and a thrown
+    exception propagates immediately, so the spy's stubbing chain behaves exactly as
+    declared, including for `doThrow(...)` answers.
+
+Kotlin::
++
+[source,kotlin,indent=0,subs="verbatim,quotes"]
+----
+	@SpringJUnitConfig
+	@TestPropertySource(properties = ["sendMessage.maxRetries = 0"]) // <1>
+	class ClientServiceTests {
+
+		@MockitoSpyBean
+		lateinit var clientService: ClientService
+
+		// test case body...
+	}
+----
+<1> With no retries permitted, the first (and only) attempt is made, and a thrown
+    exception propagates immediately, so the spy's stubbing chain behaves exactly as
+    declared, including for `doThrow(...)` answers.
+======
+
+For `@Cacheable`, Spring provides
+{spring-framework-api}/cache/support/NoOpCacheManager.html[`NoOpCacheManager`] — a
+`CacheManager` that accepts cache entries but never actually stores them, so every
+invocation results in a cache miss and therefore an invocation of the target method.
+Overriding the `CacheManager` bean with a `NoOpCacheManager` — for example, with
+xref:testing/annotations/integration-spring/annotation-testbean.adoc[`@TestBean`] —
+effectively disables caching for the test without touching the `@Cacheable` annotation in
+production code.
+
+[tabs]
+======
+Java::
++
+[source,java,indent=0,subs="verbatim,quotes"]
+----
+	@SpringJUnitConfig
+	class DateServiceTests {
+
+		@MockitoSpyBean
+		DateService dateService;
+
+		@TestBean // <1>
+		CacheManager cacheManager;
+
+		static CacheManager cacheManager() { // <2>
+			return new NoOpCacheManager();
+		}
+
+		@Test
+		void test() {
+			doReturn(1L).when(dateService).getDate(false);
+			assertThat(dateService.getDate(false)).isEqualTo(1L);
+
+			doReturn(2L).when(dateService).getDate(false);
+			assertThat(dateService.getDate(false)).isEqualTo(2L); // <3>
+		}
+	}
+----
+<1> Override the `CacheManager` bean for this test.
+<2> Replace it with a `NoOpCacheManager`, so `@Cacheable` never actually caches anything.
+<3> No longer masked by a stale cache entry, since every call reaches the spy.
+
+Kotlin::
++
+[source,kotlin,indent=0,subs="verbatim,quotes"]
+----
+	@SpringJUnitConfig
+	class DateServiceTests {
+
+		@MockitoSpyBean
+		lateinit var dateService: DateService
+
+		@TestBean // <1>
+		lateinit var cacheManager: CacheManager
+
+		companion object {
+			@JvmStatic
+			fun cacheManager(): CacheManager { // <2>
+				return NoOpCacheManager()
+			}
+		}
+
+		@Test
+		fun test() {
+			willReturn(1L).given(dateService).getDate(false)
+			assertThat(dateService.getDate(false)).isEqualTo(1L)
+
+			willReturn(2L).given(dateService).getDate(false)
+			assertThat(dateService.getDate(false)).isEqualTo(2L) // <3>
+		}
+	}
+----
+<1> Override the `CacheManager` bean for this test.
+<2> Replace it with a `NoOpCacheManager`, so `@Cacheable` never actually caches anything.
+<3> No longer masked by a stale cache entry, since every call reaches the spy.
+======

framework-docs/modules/ROOT/pages/testing/annotations/integration-spring/annotation-testbean.adoc

@@ -73,6 +73,27 @@ Java::
 ----
 <1> Mark a field for overriding the bean with type `CustomService`.
 <2> The result of this static method will be used as the instance and injected into the field.
+
+Kotlin::
++
+[source,kotlin,indent=0,subs="verbatim,quotes"]
+----
+	class OverrideBeanTests {
+		@TestBean // <1>
+		lateinit var customService: CustomService
+
+		// test case body...
+
+		companion object {
+			@JvmStatic
+			fun customService(): CustomService { // <2>
+				return MyFakeCustomService()
+			}
+		}
+	}
+----
+<1> Mark a field for overriding the bean with type `CustomService`.
+<2> The result of this static method will be used as the instance and injected into the field.
 ======
 
 In the example above, we are overriding the bean with type `CustomService`. If more than
@@ -102,6 +123,28 @@ Java::
 <1> Mark a field for overriding the bean with name `service`, and specify that the
     factory method is named `createCustomService`.
 <2> The result of this static method will be used as the instance and injected into the field.
+
+Kotlin::
++
+[source,kotlin,indent=0,subs="verbatim,quotes"]
+----
+	class OverrideBeanTests {
+		@TestBean(name = "service", methodName = "createCustomService") // <1>
+		lateinit var customService: CustomService
+
+		// test case body...
+
+		companion object {
+			@JvmStatic
+			fun createCustomService(): CustomService { // <2>
+				return MyFakeCustomService()
+			}
+		}
+	}
+----
+<1> Mark a field for overriding the bean with name `service`, and specify that the
+    factory method is named `createCustomService`.
+<2> The result of this static method will be used as the instance and injected into the field.
 ======
 
 [TIP]
@@ -128,3 +171,15 @@ Similarly, when overriding a bean created by a `FactoryBean`, the `FactoryBean`
 replaced with a singleton bean corresponding to the value returned from the `@TestBean`
 factory method.
 ====
+
+[NOTE]
+====
+`@TestBean` uses the `REPLACE` or `REPLACE_OR_CREATE`
+xref:testing/testcontext-framework/bean-overriding.adoc#testcontext-bean-overriding-strategy[strategy
+for bean overrides], which registers the value returned from the factory method directly
+as the bean, bypassing the container's normal bean post-processing. Consequently, none of
+the Spring AOP advice that would otherwise apply to the original bean (for example,
+`@Transactional`, `@Cacheable`, or `@Retryable`) is present on the override instance. See
+xref:testing/testcontext-framework/bean-overriding.adoc#testcontext-bean-overriding-aop-proxies[Bean
+Overrides and Spring AOP Proxies] for details.
+====

framework-docs/modules/ROOT/pages/testing/mockmvc/htmlunit/webdriver.adoc

@@ -3,7 +3,7 @@
 
 In the previous sections, we have seen how to use MockMvc in conjunction with the raw
 HtmlUnit APIs. In this section, we use additional abstractions within the Selenium
-https://docs.seleniumhq.org/projects/webdriver/[WebDriver] to make things even easier.
+https://www.selenium.dev/documentation/webdriver/[WebDriver] to make things even easier.
 
 [[mockmvc-server-htmlunit-webdriver-why]]
 == Why WebDriver and MockMvc?
@@ -12,8 +12,8 @@ We can already use HtmlUnit and MockMvc, so why would we want to use WebDriver?
 Selenium WebDriver provides a very elegant API that lets us easily organize our code. To
 better show how it works, we explore an example in this section.
 
-NOTE: Despite being a part of https://docs.seleniumhq.org/[Selenium], WebDriver does not
-require a Selenium Server to run your tests.
+NOTE: Despite being a part of https://www.selenium.dev/documentation/[Selenium],
+WebDriver does not require a Selenium Server to run your tests.
 
 Suppose we need to ensure that a message is created properly. The tests involve finding
 the HTML form input elements, filling them out, and making various assertions.
@@ -308,7 +308,7 @@ interested. These are of type `WebElement`. WebDriver's
 https://github.com/SeleniumHQ/selenium/wiki/PageFactory[`PageFactory`] lets us remove a
 lot of code from the HtmlUnit version of `CreateMessagePage` by automatically resolving
 each `WebElement`. The
-https://seleniumhq.github.io/selenium/docs/api/java/org/openqa/selenium/support/PageFactory.html#initElements-org.openqa.selenium.WebDriver-java.lang.Class-[`PageFactory#initElements(WebDriver,Class<T>)`]
+https://www.selenium.dev/selenium/docs/api/java/org/openqa/selenium/support/PageFactory.html#initElements-org.openqa.selenium.WebDriver-java.lang.Class-[`PageFactory#initElements(WebDriver,Class<T>)`]
 method automatically resolves each `WebElement` by using the field name and looking it up
 by the `id` or `name` of the element within the HTML page.
 <3> We can use the
@@ -352,7 +352,7 @@ interested. These are of type `WebElement`. WebDriver's
 https://github.com/SeleniumHQ/selenium/wiki/PageFactory[`PageFactory`] lets us remove a
 lot of code from the HtmlUnit version of `CreateMessagePage` by automatically resolving
 each `WebElement`. The
-https://seleniumhq.github.io/selenium/docs/api/java/org/openqa/selenium/support/PageFactory.html#initElements-org.openqa.selenium.WebDriver-java.lang.Class-[`PageFactory#initElements(WebDriver,Class<T>)`]
+https://www.selenium.dev/selenium/docs/api/java/org/openqa/selenium/support/PageFactory.html#initElements-org.openqa.selenium.WebDriver-java.lang.Class-[`PageFactory#initElements(WebDriver,Class<T>)`]
 method automatically resolves each `WebElement` by using the field name and looking it up
 by the `id` or `name` of the element within the HTML page.
 <3> We can use the

framework-docs/modules/ROOT/pages/testing/testcontext-framework/bean-overriding.adoc

@@ -90,3 +90,67 @@ Alternatively, the user can directly provide the bean name in the custom annotat
 `BeanOverrideProcessor` implementations may also internally compute a bean name based on
 a convention or some other method.
 ====
+
+[[testcontext-bean-overriding-aop-proxies]]
+== Bean Overrides and Spring AOP Proxies
+
+Beans in a Spring `ApplicationContext` are frequently wrapped in an AOP proxy — for
+example, to support `@Transactional`, `@Cacheable`, or `@Retryable` semantics. Whether an
+overridden bean retains such a proxy depends on the `BeanOverrideStrategy` used to create
+the override.
+
+* Overrides that use the `REPLACE` or `REPLACE_OR_CREATE` strategy (such as `@TestBean`
+  and `@MockitoBean`) register their override instance directly as a manual singleton,
+  which bypasses the container's normal bean post-processing. Consequently, the override
+  instance is a bare object: none of the AOP advice that would otherwise apply to the
+  original bean (`@Transactional`, `@Cacheable`, `@Retryable`, method security, and so
+  on) is present.
+* Overrides that use the `WRAP` strategy (such as `@MockitoSpyBean`) capture an early
+  reference to the original bean and use it to create the override instance, before the
+  rest of the container's post-processors — including the one responsible for creating
+  AOP proxies — have run. Consequently, if the original bean would have been proxied,
+  that proxy is still created, but it now wraps the override instance instead of the
+  original bean. The bean that ends up in the `ApplicationContext`, and that is injected
+  into collaborating beans and test classes, is therefore the AOP proxy, with the
+  override instance as its target — not the bare override instance itself.
+
+The following diagrams illustrate the resulting shape of the bean for each strategy, from
+the perspective of a caller invoking a method on the injected bean.
+
+With the `REPLACE` or `REPLACE_OR_CREATE` strategy, there is no AOP proxy at all: the
+caller invokes the override instance directly.
+
+[source]
+----
+caller
+  │
+  ▼
+[ override instance ]
+----
+
+With the `WRAP` strategy, any AOP proxy that would normally have wrapped the original
+bean is still created, but now wraps the override instance instead:
+
+[source]
+----
+caller
+  │
+  ▼
+[ AOP proxy ]          (for example, retry, caching, or transaction advice)
+  │
+  │  delegates to its target
+  ▼
+[ override instance ]  (for example, a Mockito spy created by @MockitoSpyBean)
+----
+
+For a `WRAP`-based override such as `@MockitoSpyBean`, the "wrapping" performed by the
+AOP proxy is unrelated to the manner in which the resulting Mockito spy itself "wraps"
+the original bean instance it was created from. The proxy shown above determines which
+object a caller actually invokes, whereas the spy's relationship to the original
+instance only determines what happens when an unstubbed method is invoked on the spy: it
+falls through to that instance's real behavior.
+
+This distinction has practical consequences when combining bean overrides with Mockito's
+stubbing and verification APIs. See
+xref:testing/annotations/integration-spring/annotation-mockitobean.adoc#spring-testing-annotation-beanoverriding-mockitospybean-aop-proxies[`@MockitoSpyBean`
+and Spring AOP Proxies] for details.

framework-docs/modules/ROOT/pages/testing/testcontext-framework/bootstrapping.adoc

@@ -19,6 +19,6 @@ meta-annotation. If a bootstrapper is not explicitly configured by using
 `WebTestContextBootstrapper` is used, depending on the presence of `@WebAppConfiguration`.
 
 Since the `TestContextBootstrapper` SPI is likely to change in the future (to accommodate
-new requirements), we strongly encourage implementers not to implement this interface
+new requirements), we strongly encourage implementors not to implement this interface
 directly but rather to extend `AbstractTestContextBootstrapper` or one of its concrete
 subclasses instead.

framework-docs/modules/ROOT/pages/testing/testcontext-framework/ctx-management/env-profiles.adoc

@@ -543,3 +543,85 @@ Kotlin::
 ----
 ======
 
+The following example demonstrates how to implement and register a custom
+`SystemPropertyOverrideActiveProfilesResolver` that allows the `spring.profiles.active`
+property (when configured as a JVM system property) to override profiles configured via
+`@ActiveProfiles`:
+
+[tabs]
+======
+Java::
++
+[source,java,indent=0,subs="verbatim,quotes",role="primary"]
+----
+	// profiles resolved programmatically via a custom resolver that
+	// allows "spring.profiles.active" to override @ActiveProfiles
+	@ActiveProfiles(
+			resolver = SystemPropertyOverrideActiveProfilesResolver.class,
+			inheritProfiles = false)
+	class TransferServiceTest extends AbstractIntegrationTest {
+		// test body
+	}
+----
+
+Kotlin::
++
+[source,kotlin,indent=0,subs="verbatim,quotes",role="secondary"]
+----
+	// profiles resolved programmatically via a custom resolver that
+	// allows "spring.profiles.active" to override @ActiveProfiles
+	@ActiveProfiles(
+			resolver = SystemPropertyOverrideActiveProfilesResolver::class,
+			inheritProfiles = false)
+	class TransferServiceTest : AbstractIntegrationTest() {
+		// test body
+	}
+----
+======
+
+[tabs]
+======
+Java::
++
+[source,java,indent=0,subs="verbatim,quotes",role="primary",fold="-imports"]
+----
+	import org.springframework.core.env.AbstractEnvironment;
+	import org.springframework.test.context.support.DefaultActiveProfilesResolver;
+	import org.springframework.util.StringUtils;
+
+	public class SystemPropertyOverrideActiveProfilesResolver extends DefaultActiveProfilesResolver {
+
+		@Override
+		public String[] resolve(Class<?> testClass) {
+			String profiles = System.getProperty(AbstractEnvironment.ACTIVE_PROFILES_PROPERTY_NAME);
+			if (StringUtils.hasText(profiles)) {
+				return StringUtils.commaDelimitedListToStringArray(
+						StringUtils.trimAllWhitespace(profiles));
+			}
+			return super.resolve(testClass);
+		}
+	}
+----
+
+Kotlin::
++
+[source,kotlin,indent=0,subs="verbatim,quotes",role="secondary",fold="-imports"]
+----
+	import org.springframework.core.env.AbstractEnvironment
+	import org.springframework.test.context.support.DefaultActiveProfilesResolver
+	import org.springframework.util.StringUtils
+
+	class SystemPropertyOverrideActiveProfilesResolver : DefaultActiveProfilesResolver() {
+
+		override fun resolve(testClass: Class<*>): Array<String> {
+			val profiles = System.getProperty(AbstractEnvironment.ACTIVE_PROFILES_PROPERTY_NAME)
+			if (StringUtils.hasText(profiles)) {
+				return StringUtils.commaDelimitedListToStringArray(
+					StringUtils.trimAllWhitespace(profiles)
+				)
+			}
+			return super.resolve(testClass)
+		}
+	}
+----
+======

framework-docs/modules/ROOT/pages/testing/testcontext-framework/support-classes.adoc

@@ -396,11 +396,10 @@ recursively.
 ====
 As of Spring Framework 7.0, the `SpringExtension` uses a test-method scoped
 `ExtensionContext` within `@Nested` test class hierarchies by default. However, the
-`SpringExtension` can be configured to use a test-class scoped `ExtensionContext`.
-
-See the documentation for
-xref:testing/annotations/integration-junit-jupiter.adoc#integration-testing-annotations-springextensionconfig[`@SpringExtensionConfig`]
-for details.
+`SpringExtension` can be configured to use a test-class scoped `ExtensionContext` — for
+example via `@SpringExtensionConfig` or the `spring.test.extension.context.scope` Spring
+property (see
+xref:testing/annotations/integration-junit-jupiter.adoc#integration-testing-annotations-springextensionconfig[`@SpringExtensionConfig`]).
 ====
 
 [TIP]

framework-docs/modules/ROOT/pages/testing/unit.adoc

@@ -99,6 +99,11 @@ mock to configure expectations on it and perform verifications. For Spring's cor
 utilities, see {spring-framework-api}/aop/support/AopUtils.html[`AopUtils`] and
 {spring-framework-api}/aop/framework/AopProxyUtils.html[`AopProxyUtils`].
 
+TIP: For guidance on using `AopTestUtils` together with `@MockitoSpyBean` when the spied
+bean is wrapped in a Spring AOP proxy, see
+xref:testing/annotations/integration-spring/annotation-mockitobean.adoc#spring-testing-annotation-beanoverriding-mockitospybean-aop-proxies[`@MockitoSpyBean`
+and Spring AOP Proxies].
+
 {spring-framework-api}/test/util/ReflectionTestUtils.html[`ReflectionTestUtils`] is a
 collection of reflection-based utility methods. You can use these methods in testing
 scenarios where you need to change the value of a constant, set a non-`public` field,

framework-docs/modules/ROOT/pages/web/webflux/controller/ann-initbinder.adoc

@@ -107,7 +107,4 @@ Kotlin::
 
 
 [[webflux-ann-initbinder-model-design]]
-== Model Design
-[.small]#xref:web/webmvc/mvc-controller/ann-initbinder.adoc#mvc-ann-initbinder-model-design[See equivalent in the Servlet stack]#
-
-include::partial$web/web-data-binding-model-design.adoc[]
+NOTE: For more guidance on model design, please see xref:web/webflux/data-binding.adoc[Data Binding].

framework-docs/modules/ROOT/pages/web/webflux/data-binding.adoc

@@ -0,0 +1,36 @@
+[[webflux-data-binding]]
+= Data Binding
+:page-section-summary-toc: 1
+
+[.small]#xref:web/webmvc/mvc-data-binding.adoc[See equivalent in the Servlet stack]#
+
+Data binding is a mechanism that binds string parameters onto an object graph with type conversion.
+It is a core mechanism of the Spring Framework that helps with application configuration.
+In web applications it makes it easy to access query parameters and form data through richly typed objects rather than through maps of string values.
+
+To learn more about the data binding mechanism, including constructor and setter binding, property name syntax, type conversion,
+and more, see xref:core/validation/data-binding.adoc[Data binding] in the Core Technologies section.
+
+For annotated controllers, data binding applies to a
+xref:web/webflux/controller/ann-methods/modelattrib-method-args.adoc[@ModelAttribute] method argument.
+For functional endpoints, use the `bind` method of xref:web/webflux-functional.adoc#webflux-fn-request[ServerRequest].
+
+TIP: For browser applications with annotated controllers, you can use
+xref:web/webflux/controller/ann-modelattrib-methods.adoc[@ModelAttribute methods]
+to initialize additional model attributes for use in rendered views.
+
+Each request uses a separate `WebDataBinder` instance.
+For annotated controllers, this instance can be customized through
+xref:web/webflux/controller/ann-initbinder.adoc[@InitBinder methods] within a controller, or
+across controllers through xref:web/webmvc/mvc-controller/ann-advice.adoc[Controller Advice].
+For functional endpoints, use overloaded `ServerRequest.bind` methods.
+
+
+
+
+[[webflux-data-binding-design]]
+== Model Design
+[.small]#xref:web/webmvc/mvc-data-binding.adoc#mvc-data-binding-design[See equivalent in the Servlet stack]#
+
+include::partial$web/web-data-binding-model-design.adoc[]
+

framework-docs/modules/ROOT/pages/web/webflux/reactive-spring.adoc

@@ -338,21 +338,26 @@ include::partial$web/forwarded-headers.adoc[]
 [[webflux-forwarded-headers-transformer]]
 === ForwardedHeaderTransformer
 
-`ForwardedHeaderTransformer` is a component that modifies the host, port, and scheme of
-the request, based on forwarded headers, and then removes those headers. If you declare
-it as a bean with the name `forwardedHeaderTransformer`, it will be
+`ForwardedHeaderTransformer` is a component that modifies the request to match information
+from the standard `"Forwarded"` or `"X-Forwarded"` headers, and also removes those headers
+to eliminate further impact. If you declare it as a bean with the name
+`forwardedHeaderTransformer`, it will be
 xref:web/webflux/reactive-spring.adoc#webflux-web-handler-api-special-beans[detected] and used.
 
-
 [[webflux-forwarded-headers-security]]
 === Security Considerations
 
-There are security considerations for forwarded headers since an application cannot know
-if the headers were added by a proxy, as intended, or by a malicious client. This is why
-a proxy at the boundary of trust should be configured to remove untrusted forwarded traffic coming
-from the outside. You can also configure the `ForwardedHeaderTransformer` with
-`removeOnly=true`, in which case it removes but does not use the headers.
+Forwarded headers are intended to be set by trusted proxies and never allowed in from the
+outside. A proxy at the edge of trust must remove forwarded headers including both the
+standard `"Forwarded"` and `"X-Forwarded"` headers, regardless of which one they use,
+to protect applications which may check both.
 
+When creating `ForwardedHeaderTransformer` you can specify whether to use the
+standard `"Forwarded"` or `"X-Forwarded"` headers. A separate property on the transformer
+lets you turn use of `"X-Forwarded-Prefix"` on and off.
+
+`ForwardedHeaderTransformer`  can be configured in `removeOnly` mode, in which case it removes
+forwarded headers from the request without using them.
 
 [[webflux-filters]]
 == Filters

framework-docs/modules/ROOT/pages/web/webmvc-view/mvc-freemarker.adoc

@@ -182,7 +182,7 @@ The parameters to any of the above macros have consistent meanings:
   For strictly sorted maps, you can use a `SortedMap` (such as a `TreeMap`) with a
   suitable `Comparator` and, for arbitrary Maps that should return values in insertion
   order, use a `LinkedHashMap` or a `LinkedMap` from `commons-collections`.
-* `separator`: Where multiple options are available as discreet elements (radio buttons
+* `separator`: Where multiple options are available as discrete elements (radio buttons
   or checkboxes), the sequence of characters used to separate each one in the list
   (such as `<br>`).
 * `attributes`: An additional string of arbitrary tags or text to be included within

framework-docs/modules/ROOT/pages/web/webmvc/filters.adoc

@@ -24,7 +24,7 @@ ignoring further handling via `FORWARD` dispatches. The filter also provides con
 over whether the `Filter` gets involved in `ASYNC` and `ERROR` dispatches.
 
 Servlet filters can be configured in `web.xml` or via Servlet annotations.
-In a Spring Boot application , you can
+In a Spring Boot application, you can
 {spring-boot-docs}/how-to/webserver.html#howto.webserver.add-servlet-filter-listener.spring-bean[declare Filter's as beans]
 and Boot will have them configured.
 
@@ -51,20 +51,29 @@ include::partial$web/forwarded-headers.adoc[]
 [[filters-forwarded-headers-non-forwardedheaderfilter]]
 === ForwardedHeaderFilter
 
-`ForwardedHeaderFilter` is a Servlet filter that modifies the request in order to
-a) change the host, port, and scheme based on `Forwarded` headers, and b) to remove those
-headers to eliminate further impact. The filter relies on wrapping the request, and
-therefore it must be ordered ahead of other filters, such as `RequestContextFilter`, that
-should work with the modified and not the original request.
+`ForwardedHeaderFilter` is a Servlet filter that modifies the request to match information
+from the standard `"Forwarded"` or `"X-Forwarded"` headers, and also removes those headers
+to eliminate further impact. The filter wraps the request and must be ordered ahead
+of other filters such as `RequestContextFilter` in order for all downstream
+handlers to see the modified request.
+
 
 [[filters-forwarded-headers-security]]
 === Security Considerations
 
-There are security considerations for forwarded headers since an application cannot know
-if the headers were added by a proxy, as intended, or by a malicious client. This is why
-a proxy at the boundary of trust should be configured to remove untrusted `Forwarded`
-headers that come from the outside. You can also configure the `ForwardedHeaderFilter`
-with `removeOnly=true`, in which case it removes but does not use the headers.
+Forwarded headers are intended to be set by trusted proxies and never allowed in from the
+outside. A proxy at the edge of trust must remove forwarded headers including both the
+standard `"Forwarded"` and `"X-Forwarded"` headers, regardless of which one they use,
+to protect applications which may check both.
+
+When creating `ForwardedHeaderFilter` you can specify whether to use the
+standard `"Forwarded"` or `"X-Forwarded"` headers. A separate property on the filter
+lets you turn use of `"X-Forwarded-Prefix"` on and off.
+
+`ForwardedHeaderFilter` can be configured in `removeOnly` mode, in which case it removes
+forwarded headers from the request without using them.
+
+
 
 [[filters-forwarded-headers-dispatcher]]
 === Dispatcher Types

framework-docs/modules/ROOT/pages/web/webmvc/mvc-controller/ann-exceptionhandler.adoc

@@ -188,7 +188,7 @@ the content negotiation during the error handling phase will decide which conten
 | `View`
 | A `View` instance to use for rendering together with the implicit model -- determined
   through command objects and `@ModelAttribute` methods. The handler method may also
-  programmatically enrich the model by declaring a `Model` argument (descried earlier).
+  programmatically enrich the model by declaring a `Model` argument (described earlier).
 
 | `java.util.Map`, `org.springframework.ui.Model`
 | Attributes to be added to the implicit model with the view name implicitly determined

framework-docs/modules/ROOT/pages/web/webmvc/mvc-controller/ann-initbinder.adoc

@@ -107,7 +107,4 @@ Kotlin::
 
 
 [[mvc-ann-initbinder-model-design]]
-== Model Design
-[.small]#xref:web/webflux/controller/ann-initbinder.adoc#webflux-ann-initbinder-model-design[See equivalent in the Reactive stack]#
-
-include::partial$web/web-data-binding-model-design.adoc[]
+NOTE: For more guidance on model design, please see xref:web/webmvc/mvc-data-binding.adoc[Data Binding].

framework-docs/modules/ROOT/pages/web/webmvc/mvc-data-binding.adoc

@@ -0,0 +1,34 @@
+[[mvc-data-binding]]
+= Data Binding
+:page-section-summary-toc: 1
+
+[.small]#xref:web/webflux/data-binding.adoc[See equivalent in the Reactive stack]#
+
+Data binding is a mechanism that binds string parameters onto an object graph with type conversion.
+It is a core mechanism of the Spring Framework that helps with application configuration.
+In web applications it makes it easy to access query parameters and form data through richly typed objects rather than through maps of string values.
+
+To learn more about the data binding mechanism, including constructor and setter binding, property name syntax, type conversion,
+and more, see xref:core/validation/data-binding.adoc[Data binding] in the Core Technologies section.
+
+For annotated controllers, data binding applies to a
+xref:web/webmvc/mvc-controller/ann-methods/modelattrib-method-args.adoc[@ModelAttribute] method argument.
+For functional endpoints, use the `bind` method of xref:web/webmvc-functional.adoc#webmvc-fn-request[ServerRequest].
+
+TIP: For browser applications with annotated controllers, you can use
+xref:web/webmvc/mvc-controller/ann-modelattrib-methods.adoc[@ModelAttribute methods]
+to initialize additional model attributes for use in rendered views.
+
+Each request uses a separate `WebDataBinder` instance.
+For annotated controllers, this instance can be customized through
+xref:web/webmvc/mvc-controller/ann-initbinder.adoc[@InitBinder methods] within a controller, or
+across controllers through xref:web/webmvc/mvc-controller/ann-advice.adoc[Controller Advice].
+For functional endpoints, use overloaded `ServerRequest.bind` methods.
+
+
+
+[[mvc-data-binding-design]]
+== Model Design
+[.small]#xref:web/webflux/data-binding.adoc#webflux-data-binding-design[See equivalent in the Reactive stack]#
+
+include::partial$web/web-data-binding-model-design.adoc[]

framework-docs/modules/ROOT/pages/web/webmvc/mvc-uri-building.adoc

@@ -112,8 +112,8 @@ Kotlin::
 
 NOTE: As of 5.1, `ServletUriComponentsBuilder` ignores information from the `Forwarded` and
 `X-Forwarded-*` headers, which specify the client-originated address. Consider using the
-xref:web/webmvc/filters.adoc#filters-forwarded-headers[`ForwardedHeaderFilter`] to extract and use or to discard
-such headers.
+xref:web/webmvc/filters.adoc#filters-forwarded-headers[`ForwardedHeaderFilter`]
+to extract and use or to discard such headers.
 
 
 [[mvc-links-to-controllers]]
@@ -261,8 +261,8 @@ Kotlin::
 
 NOTE: As of 5.1, `MvcUriComponentsBuilder` ignores information from the `Forwarded` and
 `X-Forwarded-*` headers, which specify the client-originated address. Consider using the
-xref:web/webmvc/filters.adoc#filters-forwarded-headers[ForwardedHeaderFilter] to extract and use or to discard
-such headers.
+xref:web/webmvc/filters.adoc#filters-forwarded-headers[ForwardedHeaderFilter] to extract
+and use or to discard such headers.
 
 
 [[mvc-links-to-controllers-from-views]]

framework-docs/modules/ROOT/pages/web/websocket/fallback.adoc

@@ -257,7 +257,7 @@ An `XhrTransport`, by definition, supports both `xhr-streaming` and `xhr-polling
 from a client perspective, there is no difference other than in the URL used to connect
 to the server. At present there are two implementations:
 
-* `RestTemplateXhrTransport` uses Spring's `RestTemplate` for HTTP requests.
+* `RestClientXhrTransport` uses Spring's `RestClient` for HTTP requests.
 * `JettyXhrTransport` uses Jetty's `HttpClient` for HTTP requests.
 
 The following example shows how to create a SockJS client and connect to a SockJS endpoint:
@@ -266,7 +266,7 @@ The following example shows how to create a SockJS client and connect to a SockJ
 ----
   List<Transport> transports = new ArrayList<>(2);
   transports.add(new WebSocketTransport(new StandardWebSocketClient()));
-  transports.add(new RestTemplateXhrTransport());
+  transports.add(new RestClientXhrTransport());
 
   SockJsClient sockJsClient = new SockJsClient(transports);
   sockJsClient.doHandshake(new MyWebSocketHandler(), "ws://example.com:8080/sockjs");

framework-docs/modules/ROOT/partials/web/forwarded-headers.adoc

@@ -1,15 +1,30 @@
-As a request goes through proxies such as load balancers the host, port, and
-scheme may change, and that makes it a challenge to create links that point to the correct
-host, port, and scheme from a client perspective.
+As a request goes through a chain of proxies, request details such as the scheme, host,
+port, remote address, and local address change. Proxies can insert headers that keep track of
+the hops, and that can help to restore the request from the original client's perspective.
+This allows an application to create self-reference links for external clients.
+
+There are two alternatives for headers that proxies can use:
+
+- {rfc-site}/rfc7239[RFC 7239] defines the `"Forwarded"` HTTP header, a single header with
+individual attributes for each component in the chain of proxied requests with the
+following syntax.
+- `"X-Forwarded-"` prefixed headers are the original approach that predates the standard
+and uses a separate header for each request component.
+
+The Spring Framework supports both approaches. Most proxies today support the original
+`"X-Forwarded"` headers only as a de facto standard.
+
+WARNING: For maximum security, a proxy at the edge of trust must be configured to reset both
+the standard `"Forwarded"` and `"X-Forwarded-"` headers regardless of which ones are chosen
+for use. Likewise, when configuring forwarded header handling in Spring, you need to indicate
+which type of headers to use. More on security considerations later in this section.
+
 
-{rfc-site}/rfc7239[RFC 7239] defines the `Forwarded` HTTP header
-that proxies can use to provide information about the original request.
 
 [[forwarded-headers-non-standard]]
-=== Non-standard Headers
+=== X-Forwarded Headers
 
-There are other non-standard headers, too, including `X-Forwarded-Host`, `X-Forwarded-Port`,
-`X-Forwarded-Proto`, `X-Forwarded-Ssl`, `X-Forwarded-Prefix`, and `X-Forwarded-For`.
+This section describes supported `"X-Forwarded"` headers.
 
 [[x-forwarded-host]]
 ==== X-Forwarded-Host

framework-docs/modules/ROOT/partials/web/web-data-binding-model-design.adoc

@@ -1,91 +1,53 @@
-xref:core/validation/data-binding.adoc[Data binding] for web requests involves
-binding request parameters to a model object. By default, request parameters can be bound
-to any public property of the model object, which means malicious clients can provide
-extra values for properties that exist in the model object graph, but are not expected to
-be set. This is why model object design requires careful consideration.
+Data binding involves binding untrusted input onto application objects.
+For security reasons, it's crucial to ensure that input is properly constrained to expected fields only.
+This section provides guidance for safe binding.
 
-TIP: The model object, and its nested object graph is also sometimes referred to as a
-_command object_, _form-backing object_, or _POJO_ (Plain Old Java Object).
+First, prefer **immutable object design** for web binding purposes.
+It is safe because a constructor naturally constrains binding to expected inputs.
+You can use a Java record or a class with a primary constructor, and either can have further nested objects.
+See xref:core/validation/data-binding.adoc#data-binding-constructor-binding[Constructor Binding] for details.
 
-A good practice is to use a _dedicated model object_ rather than exposing your domain
-model such as JPA or Hibernate entities for web data binding. For example, on a form to
-change an email address, create a `ChangeEmailForm` model object that declares only
-the properties required for the input:
+Another option for safe binding is to use **dedicated objects** designed for the expected input.
+Such objects, even if mutable, are safe because they constrain binding to the expected inputs.
 
-[source,java,indent=0,subs="verbatim,quotes"]
-----
-	public class ChangeEmailForm {
-
-		private String oldEmailAddress;
-		private String newEmailAddress;
-
-		public void setOldEmailAddress(String oldEmailAddress) {
-			this.oldEmailAddress = oldEmailAddress;
-		}
-
-		public String getOldEmailAddress() {
-			return this.oldEmailAddress;
-		}
-
-		public void setNewEmailAddress(String newEmailAddress) {
-			this.newEmailAddress = newEmailAddress;
-		}
-
-		public String getNewEmailAddress() {
-			return this.newEmailAddress;
-		}
-
-	}
-----
-
-Another good practice is to apply
-xref:core/validation/data-binding.adoc#data-binding-constructor-binding[constructor binding],
-which uses only the request parameters it needs for constructor arguments, and any other
-input is ignored. This is in contrast to property binding which by default binds every
-request parameter for which there is a matching property.
-
-If neither a dedicated model object nor constructor binding is sufficient, and you must
-use property binding, we strongly recommend registering `allowedFields` patterns (case
-sensitive) on `WebDataBinder` in order to prevent unexpected properties from being set.
+Domain objects such as JPA or Hibernate entities are generally not safe for web binding
+as they likely contain more properties than the expected inputs.
+For such cases, it's crucial to declare the properties to expose for binding.
 For example:
 
 [source,java,indent=0,subs="verbatim,quotes"]
 ----
 	@Controller
-	public class ChangeEmailController {
+	public class PersonController {
 
 		@InitBinder
 		void initBinder(WebDataBinder binder) {
-			binder.setAllowedFields("oldEmailAddress", "newEmailAddress");
+			// See Javadoc for supported pattern syntax
+			binder.setAllowedFields("firstName", "lastName", "*Address");
 		}
-
-		// @RequestMapping methods, etc.
-
 	}
 ----
 
-You can also register `disallowedFields`  patterns (case insensitive). However,
-"allowed" configuration is preferred over "disallowed" as it is more explicit and less
-prone to mistakes.
+NOTE: It is also possible to configure `disallowedFields`, but that's fragile, and
+due to be https://github.com/spring-projects/spring-framework/issues/36802[deprecated] in Spring Framework 7.1.
+It is easy to overlook fields or introduce additional fields over time that should also be excluded.
 
-By default, constructor and property binding are both used. If you want to use
-constructor binding only, you can set the `declarativeBinding` flag on `WebDataBinder`
-through an `@InitBinder` method either locally within a controller or globally through an
-`@ControllerAdvice`. Turning this flag on ensures that only constructor binding is used
-and that property binding is not used unless `allowedFields` patterns are configured.
-For example:
+By default, `DataBinder` applies both constructor and setter binding.
+This is fine with immutable objects and dedicated objects, but for domain objects, you must
+remember to set `allowedFields`. To ensure data binding is only used in declarative style where
+expected inputs are explicitly declared, you can set  `declarativeBinding` on `DataBinder`.
+That applies constructor binding always, and setter binding conditionally if `allowedFields` is set.
+The following shows how to set this flag globally, or
+you can also narrow it through attributes on `ControllerAdvice`:
 
 [source,java,indent=0,subs="verbatim,quotes"]
 ----
-	@Controller
-	public class MyController {
+	@ControllerAdvice
+	public class ControllerConfig {
 
 		@InitBinder
 		void initBinder(WebDataBinder binder) {
 			binder.setDeclarativeBinding(true);
 		}
-
-		// @RequestMapping methods, etc.
-
 	}
 ----

framework-docs/package.json

@@ -1,11 +1,11 @@
 {
   "dependencies": {
-    "antora": "3.2.0-alpha.11",
+    "antora": "3.2.0-alpha.12",
     "@antora/atlas-extension": "1.0.0-alpha.5",
-    "@antora/collector-extension": "1.0.2",
+    "@antora/collector-extension": "1.0.3",
     "@asciidoctor/tabs": "1.0.0-beta.6",
-    "@springio/antora-extensions": "1.14.7",
-    "fast-xml-parser": "5.3.8",
-    "@springio/asciidoctor-extensions": "1.0.0-alpha.17"
+    "@springio/antora-extensions": "1.14.12",
+    "fast-xml-parser": "5.7.0",
+    "@springio/asciidoctor-extensions": "1.0.0-alpha.18"
   }
 }

framework-docs/src/main/java/org/springframework/docs/integration/jms/jmssending/JmsQueueSender.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2024 the original author or authors.
+ * Copyright 2002-present the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

framework-docs/src/main/java/org/springframework/docs/integration/jms/jmssendingconversion/JmsSenderWithConversion.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2024 the original author or authors.
+ * Copyright 2002-present the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

framework-docs/src/main/java/org/springframework/docs/integration/jms/jmssendingpostprocessor/JmsClientWithPostProcessor.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2024 the original author or authors.
+ * Copyright 2002-present the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

framework-docs/src/main/java/org/springframework/docs/web/webmvc/mvccontroller/mvcannexceptionhandlerexc/ExceptionController.java

@@ -29,7 +29,7 @@ public class ExceptionController {
 
 	// tag::narrow[]
 	@ExceptionHandler({FileSystemException.class, RemoteException.class})
-	public ResponseEntity<String> handleIoException(IOException ex) {
+	public ResponseEntity<String> handleIOException(IOException ex) {
 		return ResponseEntity.internalServerError().body(ex.getMessage());
 	}
 	// end::narrow[]

framework-docs/src/main/java/org/springframework/docs/web/webmvc/mvcservlet/AppConfig.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2025 the original author or authors.
+ * Copyright 2002-present the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

framework-docs/src/main/java/org/springframework/docs/web/webmvc/mvcservlet/MyWebApplicationInitializer.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2025 the original author or authors.
+ * Copyright 2002-present the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

framework-docs/src/main/java/org/springframework/docs/web/webmvc/mvcservlet/mvcanncustomerservletcontainererrorpage/ErrorController.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2025 the original author or authors.
+ * Copyright 2002-present the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

framework-docs/src/main/java/org/springframework/docs/web/webmvc/mvcservlet/mvccontainerconfig/MyFilterDispatcherServletInitializer.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2025 the original author or authors.
+ * Copyright 2002-present the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

framework-docs/src/main/java/org/springframework/docs/web/webmvc/mvcservlet/mvccontainerconfig/MyWebAppInitializer.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2025 the original author or authors.
+ * Copyright 2002-present the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

framework-docs/src/main/java/org/springframework/docs/web/webmvc/mvcservlet/mvccontainerconfig/MyWebApplicationInitializer.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2025 the original author or authors.
+ * Copyright 2002-present the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

framework-docs/src/main/java/org/springframework/docs/web/webmvc/mvcservlet/mvccontainerconfig/MyXmlDispatcherServletInitializer.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2025 the original author or authors.
+ * Copyright 2002-present the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

framework-docs/src/main/java/org/springframework/docs/web/webmvc/mvcservlet/mvcloggingsensitivedata/MyInitializer.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2025 the original author or authors.
+ * Copyright 2002-present the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

framework-docs/src/main/java/org/springframework/docs/web/webmvc/mvcservlet/mvcmultipartresolverstandard/AppInitializer.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2025 the original author or authors.
+ * Copyright 2002-present the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

framework-docs/src/main/java/org/springframework/docs/web/webmvc/mvcservlet/mvcservletcontexthierarchy/MyWebAppInitializer.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2025 the original author or authors.
+ * Copyright 2002-present the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

framework-docs/src/main/kotlin/org/springframework/docs/core/aop/ataspectj/aopataspectjexample/ConcurrentOperationExecutor.kt

@@ -54,6 +54,6 @@ class ConcurrentOperationExecutor : Ordered {
 				lockFailureException = ex
 			}
 		} while (numAttempts <= this.maxRetries)
-		throw lockFailureException!!
+		throw lockFailureException
 	}
 } // end::snippet[]

framework-docs/src/main/kotlin/org/springframework/docs/web/webmvc/mvccontroller/mvcannexceptionhandlerexc/ExceptionController.kt

@@ -27,7 +27,7 @@ class ExceptionController {
 
 	// tag::narrow[]
 	@ExceptionHandler(FileSystemException::class, RemoteException::class)
-	fun handleIoException(ex: IOException): ResponseEntity<String> {
+	fun handleIOException(ex: IOException): ResponseEntity<String> {
 		return ResponseEntity.internalServerError().body(ex.message)
 	}
 	// end::narrow[]

framework-docs/src/main/kotlin/org/springframework/docs/web/webmvc/mvcservlet/AppConfig.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2025 the original author or authors.
+ * Copyright 2002-present the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

framework-docs/src/main/kotlin/org/springframework/docs/web/webmvc/mvcservlet/MyWebApplicationInitializer.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2025 the original author or authors.
+ * Copyright 2002-present the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

framework-docs/src/main/kotlin/org/springframework/docs/web/webmvc/mvcservlet/mvcanncustomerservletcontainererrorpage/ErrorController.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2025 the original author or authors.
+ * Copyright 2002-present the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

framework-docs/src/main/kotlin/org/springframework/docs/web/webmvc/mvcservlet/mvccontainerconfig/MyFilterDispatcherServletInitializer.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2025 the original author or authors.
+ * Copyright 2002-present the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

framework-docs/src/main/kotlin/org/springframework/docs/web/webmvc/mvcservlet/mvccontainerconfig/MyWebAppInitializer.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2025 the original author or authors.
+ * Copyright 2002-present the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

framework-docs/src/main/kotlin/org/springframework/docs/web/webmvc/mvcservlet/mvccontainerconfig/MyWebApplicationInitializer.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2025 the original author or authors.
+ * Copyright 2002-present the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

framework-docs/src/main/kotlin/org/springframework/docs/web/webmvc/mvcservlet/mvccontainerconfig/MyXmlDispatcherServletInitializer.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2025 the original author or authors.
+ * Copyright 2002-present the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.