Release Spring Framework 7.0.9

Closes gh-37103

.github/actions/await-http-resource/action.yml

@@ -1,20 +0,0 @@
-name: Await HTTP Resource
-description: 'Waits for an HTTP resource to be available (a HEAD request succeeds)'
-inputs:
-  url:
-    description: 'URL of the resource to await'
-    required: true
-runs:
-  using: composite
-  steps:
-    - name: Await HTTP resource
-      shell: bash
-      run: |
-        url=${{ inputs.url }}
-        echo "Waiting for $url"
-        until curl --fail --head --silent ${{ inputs.url }} > /dev/null
-        do
-          echo "."
-          sleep 60
-        done
-        echo "$url is available"

.github/actions/build/action.yml

@@ -1,6 +1,18 @@
 name: 'Build'
 description: 'Builds the project, optionally publishing it to a local deployment repository'
 inputs:
+  commercial-release-repository-url:
+    description: 'URL of the release repository'
+    required: false
+  commercial-repository-password:
+    description: 'Password for authentication with the commercial repository'
+    required: false
+  commercial-repository-username:
+    description: 'Username for authentication with the commercial repository'
+    required: false
+  commercial-snapshot-repository-url:
+    description: 'URL of the snapshot repository'
+    required: false
   develocity-access-key:
     description: 'Access key for authentication with ge.spring.io'
     required: false
@@ -46,11 +58,21 @@ runs:
       id: build
       if: ${{ inputs.publish == 'false' }}
       shell: bash
+      env:
+        COMMERCIAL_RELEASE_REPO_URL: ${{ inputs.commercial-release-repository-url }}
+        COMMERCIAL_REPO_PASSWORD: ${{ inputs.commercial-repository-password }}
+        COMMERCIAL_REPO_USERNAME: ${{ inputs.commercial-repository-username }}
+        COMMERCIAL_SNAPSHOT_REPO_URL: ${{ inputs.commercial-snapshot-repository-url }}
       run: ./gradlew check antora
     - name: Publish
       id: publish
       if: ${{ inputs.publish == 'true' }}
       shell: bash
+      env:
+        COMMERCIAL_RELEASE_REPO_URL: ${{ inputs.commercial-release-repository-url }}
+        COMMERCIAL_REPO_PASSWORD: ${{ inputs.commercial-repository-password }}
+        COMMERCIAL_REPO_USERNAME: ${{ inputs.commercial-repository-username }}
+        COMMERCIAL_SNAPSHOT_REPO_URL: ${{ inputs.commercial-snapshot-repository-url }}
       run: ./gradlew -PdeploymentRepository=$(pwd)/deployment-repository build publishAllPublicationsToDeploymentRepository
     - name: Read Version From gradle.properties
       id: read-version

.github/actions/create-github-release/action.yml

@@ -1,6 +1,13 @@
 name: Create GitHub Release
 description: 'Create the release on GitHub with a changelog'
 inputs:
+  commercial:
+    description: 'Whether to generate the changelog for the commercial release'
+    required: true
+  latest:
+    description: 'Whether the release is the latest release'
+    required: false
+    default: 'false'
   milestone:
     description: 'Name of the GitHub milestone for which a release will be created'
     required: true
@@ -15,13 +22,13 @@ runs:
   using: composite
   steps:
     - name: Generate Changelog
-      uses: spring-io/github-changelog-generator@86958813a62af8fb223b3fd3b5152035504bcb83 #v0.0.12
+      uses: spring-io/github-changelog-generator@f7d7a87a3e7c627ecb8c26cf086c38ac5a939721 #v0.0.14
       with:
-        config-file: .github/actions/create-github-release/changelog-generator.yml
+        config-file: ${{ inputs.commercial && '.github/actions/create-github-release/changelog-generator-commercial.yml' || '.github/actions/create-github-release/changelog-generator-oss.yml' }}
         milestone: ${{ inputs.milestone }}
         token: ${{ inputs.token }}
     - name: Create GitHub Release
       shell: bash
       env:
         GITHUB_TOKEN: ${{ inputs.token }}
-      run: gh release create ${{ format('v{0}', inputs.milestone) }} --notes-file changelog.md ${{ inputs.pre-release == 'true' && '--prerelease' || '' }}
+      run: gh release create ${{ format('v{0}', inputs.milestone) }} --notes-file changelog.md ${{ inputs.pre-release == 'true' && '--prerelease' || format('--latest={0}', inputs.latest) }}

.github/actions/create-github-release/changelog-generator-commercial.yml

@@ -0,0 +1,33 @@
+changelog:
+  repository: spring-projects/spring-framework-commercial
+  sections:
+    - title: ":warning: Attention Required"
+      labels:
+        - "for: upgrade-attention"
+      summary:
+        mode: "member-comment"
+        config:
+          prefix: "Attention Required:"
+    - title: ":star: New Features"
+      labels:
+        - "type: enhancement"
+    - title: ":lady_beetle: Bug Fixes"
+      labels:
+        - "type: bug"
+        - "type: regression"
+    - title: ":notebook_with_decorative_cover: Documentation"
+      labels:
+        - "type: documentation"
+    - title: ":hammer: Dependency Upgrades"
+      sort: "title"
+      labels:
+        - "type: dependency-upgrade"
+  contributors:
+    exclude:
+      names:
+        - "bclozel"
+        - "jhoeller"
+        - "rstoyanchev"
+        - "sbrannen"
+        - "sdeleuze"
+        - "snicoll"

.github/actions/create-github-release/changelog-generator-oss.yml

@@ -27,9 +27,7 @@ changelog:
       names:
         - "bclozel"
         - "jhoeller"
-        - "poutsma"
         - "rstoyanchev"
         - "sbrannen"
         - "sdeleuze"
-        - "simonbasle"
         - "snicoll"

.github/actions/prepare-gradle-build/action.yml

@@ -29,27 +29,25 @@ runs:
         distribution: ${{ inputs.java-early-access == 'true' && 'temurin' || (inputs.java-distribution || 'liberica') }}
         java-version: |
           ${{ inputs.java-early-access == 'true' && format('{0}-ea', inputs.java-version) || inputs.java-version }}
-          ${{ inputs.java-toolchain == 'true' && '17' || '' }}
-          25
+          ${{ inputs.java-toolchain == 'true' && '25' || '' }}
     - name: Set Up Gradle
-      uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
+      uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # 6.2.0
       with:
+        cache-provider: basic
         cache-read-only: false
         develocity-access-key: ${{ inputs.develocity-access-key }}
         develocity-token-expiry: 4
     - name: Configure Gradle Properties
       shell: bash
       run: |
-        mkdir -p $HOME/.gradle
-        echo 'systemProp.user.name=spring-builds+github' >> $HOME/.gradle/gradle.properties
-        echo 'systemProp.org.gradle.internal.launcher.welcomeMessageEnabled=false' >> $HOME/.gradle/gradle.properties
-        echo 'org.gradle.daemon=false' >> $HOME/.gradle/gradle.properties
-        echo 'org.gradle.daemon=4' >> $HOME/.gradle/gradle.properties
+        echo 'systemProp.user.name=spring-builds+github' >> $GRADLE_USER_HOME/gradle.properties
+        echo 'systemProp.org.gradle.internal.launcher.welcomeMessageEnabled=false' >> $GRADLE_USER_HOME/gradle.properties
+        echo 'org.gradle.daemon=false' >> $GRADLE_USER_HOME/gradle.properties
     - name: Configure Toolchain Properties
       if: ${{ inputs.java-toolchain == 'true' }}
       shell: bash
       run: |
-        echo toolchainVersion=${{ inputs.java-version }} >> $HOME/.gradle/gradle.properties
-        echo systemProp.org.gradle.java.installations.auto-detect=false >> $HOME/.gradle/gradle.properties
-        echo systemProp.org.gradle.java.installations.auto-download=false >> $HOME/.gradle/gradle.properties
-        echo systemProp.org.gradle.java.installations.paths=${{ format('$JAVA_HOME_{0}_X64', inputs.java-version) }} >> $HOME/.gradle/gradle.properties
+        echo toolchainVersion=${{ inputs.java-version }} >> $GRADLE_USER_HOME/gradle.properties
+        echo systemProp.org.gradle.java.installations.auto-detect=false >> $GRADLE_USER_HOME/gradle.properties
+        echo systemProp.org.gradle.java.installations.auto-download=false >> $GRADLE_USER_HOME/gradle.properties
+        echo systemProp.org.gradle.java.installations.paths=${{ format('$JAVA_HOME_{0}_X64', inputs.java-version) }} >> $GRADLE_USER_HOME/gradle.properties

.github/actions/release-train-build/action.yml

@@ -0,0 +1,7 @@
+name: Build Release
+runs:
+  using: composite
+  steps:
+    - name: Build Release
+      shell: bash
+      run:  ./gradlew -PdeploymentRepository=$(pwd)/deployment-repository publishAllPublicationsToDeploymentRepository

.github/actions/release-train-build/deployment-spec.yml

@@ -0,0 +1,16 @@
+artifactory:
+  artifacts:
+    - pattern: "/**/framework-api-*.zip"
+      properties:
+        zip.deployed: "false"
+        zip.name: "spring-framework"
+    - pattern: "/**/framework-api-*-docs.zip"
+      properties:
+        zip.type: "docs"
+    - pattern: "/**/framework-api-*-schema.zip"
+      properties:
+        zip.type: "schema"
+maven-central:
+  excludes:
+    - "org/springframework/framework-api/**"
+    - "org/springframework/framework-docs/**"

.github/actions/release-train-test/action.yml

@@ -0,0 +1,7 @@
+name: Test Release
+runs:
+  using: composite
+  steps:
+    - name: Test Release
+      shell: bash
+      run:  ./gradlew check

.github/actions/sync-to-maven-central/action.yml

@@ -1,34 +0,0 @@
-name: Sync to Maven Central
-description: 'Syncs a release to Maven Central and waits for it to be available for use'
-inputs:
-  central-token-password:
-    description: 'Password for authentication with central.sonatype.com'
-    required: true
-  central-token-username:
-    description: 'Username for authentication with central.sonatype.com'
-    required: true
-  jfrog-cli-config-token:
-    description: 'Config token for the JFrog CLI'
-    required: true
-  spring-framework-version:
-    description: 'Version of Spring Framework that is being synced to Central'
-    required: true
-runs:
-  using: composite
-  steps:
-    - name: Set Up JFrog CLI
-      uses: jfrog/setup-jfrog-cli@5b06f730cc5a6f55d78b30753f8583454b08c0aa # v4.8.1
-      env:
-        JF_ENV_SPRING: ${{ inputs.jfrog-cli-config-token }}
-    - name: Download Release Artifacts
-      shell: bash
-      run: jf rt download --spec ${{ format('{0}/artifacts.spec', github.action_path) }} --spec-vars 'buildName=${{ format('spring-framework-{0}', inputs.spring-framework-version) }};buildNumber=${{ github.run_number }}'
-    - name: Sync
-      uses: spring-io/central-publish-action@0c03960e9b16fdfe70e2443e1d5393cbc3a35622 # v0.3.0
-      with:
-        token: ${{ inputs.central-token-password }}
-        token-name: ${{ inputs.central-token-username }}
-    - name: Await
-      uses: ./.github/actions/await-http-resource
-      with:
-        url: ${{ format('https://repo.maven.apache.org/maven2/org/springframework/spring-context/{0}/spring-context-{0}.jar', inputs.spring-framework-version) }}

.github/actions/sync-to-maven-central/artifacts.spec

@@ -1,20 +0,0 @@
-{
-  "files": [
-    {
-      "aql": {
-        "items.find": {
-          "$and": [
-            {
-              "@build.name": "${buildName}",
-              "@build.number": "${buildNumber}",
-              "path": {
-                "$nmatch": "org/springframework/framework-api/*"
-              }
-            }
-          ]
-        }
-      },
-      "target": "nexus/"
-    }
-  ]
-}

.github/workflow-generator.yml

@@ -0,0 +1,18 @@
+workflow:
+  generator:
+    project:
+      java:
+        versions:
+          primary: 25
+    workflows:
+      release-train:
+        build:
+          env:
+            COMMERCIAL_REPO_USERNAME: secrets.COMMERCIAL_ARTIFACTORY_USERNAME
+            COMMERCIAL_REPO_PASSWORD: secrets.COMMERCIAL_ARTIFACTORY_PASSWORD
+            COMMERCIAL_RELEASE_REPO_URL: vars.COMMERCIAL_RELEASE_REPO_URL
+        test:
+          env:
+            COMMERCIAL_REPO_USERNAME: secrets.COMMERCIAL_ARTIFACTORY_USERNAME
+            COMMERCIAL_REPO_PASSWORD: secrets.COMMERCIAL_ARTIFACTORY_PASSWORD
+            COMMERCIAL_RELEASE_REPO_URL: vars.COMMERCIAL_RELEASE_REPO_URL

.github/workflows/backport-bot.yml

@@ -7,27 +7,15 @@ on:
   push:
     branches:
       - '*.x'
-permissions:
-  contents: read
 jobs:
-  build:
+  backport-issue:
     permissions:
       contents: read
       issues: write
       pull-requests: write
     runs-on: ubuntu-latest
     steps:
-      - name: Check out code
-        uses: actions/checkout@v6
-      - name: Set up Java
-        uses: actions/setup-java@v5
+      - name: Create Backport Issue
+        uses: spring-io/backport-bot@v0.0.2
         with:
-          distribution: 'liberica'
-          java-version: 17
-      - name: Download BackportBot
-        run: wget https://github.com/spring-io/backport-bot/releases/download/latest/backport-bot-0.0.1-SNAPSHOT.jar
-      - name: Backport
-        env:
-          GITHUB_EVENT: ${{ toJSON(github.event) }}
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: java -jar backport-bot-0.0.1-SNAPSHOT.jar --github.accessToken="$GITHUB_TOKEN" --github.event_name "$GITHUB_EVENT_NAME" --github.event "$GITHUB_EVENT"
+          token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/build-and-deploy-snapshot.yml

@@ -2,23 +2,27 @@ name: Build and Deploy Snapshot
 on:
   push:
     branches:
-      - 7.0.x
+      - '7.0.x-internal'
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
 jobs:
   build-and-deploy-snapshot:
     name: Build and Deploy Snapshot
-    if: ${{ github.repository == 'spring-projects/spring-framework' }}
-    runs-on: ubuntu-latest
+    if: ${{ github.repository == 'spring-projects/spring-framework' || github.repository == 'spring-projects/spring-framework-commercial' }}
+    runs-on: ${{ vars.UBUNTU_MEDIUM || 'ubuntu-latest' }}
     timeout-minutes: 60
     steps:
       - name: Check Out Code
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Build and Publish
         id: build-and-publish
         uses: ./.github/actions/build
         with:
-          develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
+          commercial-release-repository-url: ${{ vars.COMMERCIAL_RELEASE_REPO_URL }}
+          commercial-repository-password: ${{ secrets.COMMERCIAL_ARTIFACTORY_PASSWORD }}
+          commercial-repository-username: ${{ secrets.COMMERCIAL_ARTIFACTORY_USERNAME }}
+          commercial-snapshot-repository-url: ${{ vars.COMMERCIAL_SNAPSHOT_REPO_URL }}
+          #develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
           publish: true
       - name: Deploy
         uses: spring-io/artifactory-deploy-action@926d7f7cc810569395346bf3a4d91b380b3e355b # v0.0.4
@@ -27,32 +31,47 @@ jobs:
             /**/framework-api-*.zip::zip.name=spring-framework,zip.deployed=false
             /**/framework-api-*-docs.zip::zip.type=docs
             /**/framework-api-*-schema.zip::zip.type=schema
-          build-name: 'spring-framework-7.0.x'
+          build-name: ${{ vars.COMMERCIAL && format('spring-framework-commercial-{0}', '7.0.x') || format('spring-framework-{0}', '7.0.x') }}
           folder: 'deployment-repository'
-          password: ${{ secrets.ARTIFACTORY_PASSWORD }}
-          repository: 'libs-snapshot-local'
+          project: ${{ vars.COMMERCIAL && 'spring' }}
+          repository: ${{ vars.COMMERCIAL && 'spring-enterprise-maven-dev-local' || 'libs-snapshot-local' }}
+          uri: ${{ vars.COMMERCIAL_DEPLOY_REPO_URL || 'https://repo.spring.io' }}
+          username: ${{ vars.COMMERCIAL && secrets.COMMERCIAL_ARTIFACTORY_USERNAME || secrets.ARTIFACTORY_USERNAME }}
+          password: ${{ vars.COMMERCIAL && secrets.COMMERCIAL_ARTIFACTORY_PASSWORD || secrets.ARTIFACTORY_PASSWORD }}
           signing-key: ${{ secrets.GPG_PRIVATE_KEY }}
           signing-passphrase: ${{ secrets.GPG_PASSPHRASE }}
-          uri: 'https://repo.spring.io'
-          username: ${{ secrets.ARTIFACTORY_USERNAME }}
       - name: Send Notification
         if: always()
         uses: ./.github/actions/send-notification
         with:
           build-scan-url: ${{ steps.build-and-publish.outputs.build-scan-url }}
-          run-name: ${{ format('{0} | Linux | Java 17', github.ref_name) }}
+          run-name: ${{ format('{0} | Linux | Java 25', github.ref_name) }}
           status: ${{ job.status }}
           webhook-url: ${{ secrets.GOOGLE_CHAT_WEBHOOK_URL }}
     outputs:
       version: ${{ steps.build-and-publish.outputs.version }}
+  trigger-docs-build:
+    name: Trigger Docs Build
+    needs: build-and-deploy-snapshot
+    if: ${{ !vars.COMMERCIAL }} # remove when commercial support
+    permissions:
+      actions: write
+    runs-on: ${{ vars.UBUNTU_SMALL || 'ubuntu-latest' }}
+    steps:
+      - name: Run Deploy Docs Workflow
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: gh workflow run deploy-docs.yml --repo ${{ github.repository }} -r docs-build -f build-refname=${{ github.ref_name }}
   verify:
     name: Verify
     needs: build-and-deploy-snapshot
     uses: ./.github/workflows/verify.yml
     secrets:
+      commercial-repository-password: ${{ secrets.COMMERCIAL_ARTIFACTORY_PASSWORD }}
+      commercial-repository-username: ${{ secrets.COMMERCIAL_ARTIFACTORY_USERNAME }}
       google-chat-webhook-url: ${{ secrets.GOOGLE_CHAT_WEBHOOK_URL }}
-      repository-password: ${{ secrets.ARTIFACTORY_PASSWORD }}
-      repository-username: ${{ secrets.ARTIFACTORY_USERNAME }}
+      opensource-repository-password: ${{ secrets.ARTIFACTORY_PASSWORD }}
+      opensource-repository-username: ${{ secrets.ARTIFACTORY_USERNAME }}
       token: ${{ secrets.GH_ACTIONS_REPO_TOKEN }}
     with:
       version: ${{ needs.build-and-deploy-snapshot.outputs.version }}

.github/workflows/build-pull-request.yml

@@ -7,10 +7,9 @@ jobs:
     name: Build Pull Request
     if: ${{ github.repository == 'spring-projects/spring-framework' }}
     runs-on: ubuntu-latest
-    timeout-minutes: 60
     steps:
       - name: Check Out Code
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Build
         id: build
         uses: ./.github/actions/build
@@ -19,7 +18,7 @@ jobs:
         uses: ./.github/actions/print-jvm-thread-dumps
       - name: Upload Build Reports
         if: failure()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: build-reports
-          path: '**/build/reports/'
+          path: '**/build/reports/'

.github/workflows/ci.yml

@@ -2,31 +2,33 @@ name: CI
 on:
   schedule:
     - cron: '30 9 * * *'
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
+permissions:
+  contents: read
 jobs:
   ci:
     name: '${{ matrix.os.name}} | Java ${{ matrix.java.version}}'
-    if: ${{ github.repository == 'spring-projects/spring-framework' }}
+    if: ${{ github.repository == 'spring-projects/spring-framework' || github.repository == 'spring-projects/spring-framework-commercial' }}
     runs-on: ${{ matrix.os.id }}
     timeout-minutes: 60
     strategy:
       matrix:
         os:
-          - id: ubuntu-latest
+          - id: ${{ vars.UBUNTU_MEDIUM || 'ubuntu-latest' }}
             name: Linux
         java:
           - version: 17
-            toolchain: false
+            toolchain: true
           - version: 21
             toolchain: true
           - version: 25
+            toolchain: false
+          - version: 26
             toolchain: true
         exclude:
           - os:
               name: Linux
             java:
-              version: 17
+              version: 25
     steps:
       - name: Prepare Windows runner
         if: ${{ runner.os == 'Windows' }}
@@ -35,11 +37,15 @@ jobs:
           git config --global core.longPaths true
           Stop-Service -name Docker
       - name: Check Out Code
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Build
         id: build
         uses: ./.github/actions/build
         with:
+          commercial-release-repository-url: ${{ vars.COMMERCIAL_RELEASE_REPO_URL }}
+          commercial-repository-password: ${{ secrets.COMMERCIAL_ARTIFACTORY_PASSWORD }}
+          commercial-repository-username: ${{ secrets.COMMERCIAL_ARTIFACTORY_USERNAME }}
+          commercial-snapshot-repository-url: ${{ vars.COMMERCIAL_SNAPSHOT_REPO_URL }}
           develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
           java-early-access: ${{ matrix.java.early-access || 'false' }}
           java-distribution: ${{ matrix.java.distribution }}

.github/workflows/deploy-docs.yml

@@ -1,35 +0,0 @@
-name: Deploy Docs
-on:
-  push:
-    branches:
-      - 'main'
-      - '*.x'
-      - '!gh-pages'
-    tags:
-      - 'v*'
-  repository_dispatch:
-    types: request-build-reference # legacy
-  workflow_dispatch:
-permissions:
-  actions: write
-jobs:
-  build:
-    name: Dispatch docs deployment
-    if: github.repository_owner == 'spring-projects'
-    runs-on: ubuntu-latest
-    steps:
-    - name: Check out code
-      uses: actions/checkout@v6
-      with:
-        fetch-depth: 1
-        ref: docs-build
-    - name: Dispatch (partial build)
-      if: github.ref_type == 'branch'
-      env:
-        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      run: gh workflow run deploy-docs.yml -r $(git rev-parse --abbrev-ref HEAD) -f build-refname=${{ github.ref_name }}
-    - name: Dispatch (full build)
-      if: github.ref_type == 'tag'
-      env:
-        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      run: gh workflow run deploy-docs.yml -r $(git rev-parse --abbrev-ref HEAD)

.github/workflows/publish-milestone.yml

@@ -0,0 +1,39 @@
+name: Release Milestone
+on:
+  push:
+    tags:
+      - v7.0.0-M[1-9]
+      - v7.0.0-RC[1-9]
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+jobs:
+  trigger-docs-build:
+    name: Trigger Docs Build
+    permissions:
+      actions: write
+    runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.version.outputs.version }}
+    steps:
+      - name: Determine Version
+        id: version
+        run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"
+      - name: Run Deploy Docs Workflow
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: gh workflow run deploy-docs.yml --repo ${{ github.repository }} -r docs-build -f build-refname=${{ github.ref_name }}
+  create-github-release:
+    name: Create GitHub Release
+    needs:
+      - trigger-docs-build
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check Out Code
+        uses: actions/checkout@v6
+      - name: Create GitHub Release
+        uses: ./.github/actions/create-github-release
+        with:
+          commercial: ${{ vars.COMMERCIAL }}
+          milestone: ${{ needs.trigger-docs-build.outputs.version }}
+          pre-release: true
+          token: ${{ secrets.GH_ACTIONS_REPO_TOKEN }}

.github/workflows/publish-release.yml

@@ -0,0 +1,38 @@
+name: Release
+on:
+  push:
+    tags:
+      - v7.0.[0-9]+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+jobs:
+  trigger-docs-build:
+    name: Trigger Docs Build
+    permissions:
+      actions: write
+    runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.version.outputs.version }}
+    steps:
+      - name: Determine Version
+        id: version
+        run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"
+      - name: Run Deploy Docs Workflow
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: gh workflow run deploy-docs.yml --repo ${{ github.repository }} -r docs-build -f build-refname=${{ github.ref_name }}
+  create-github-release:
+    name: Create GitHub Release
+    needs:
+      - trigger-docs-build
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check Out Code
+        uses: actions/checkout@v6
+      - name: Create GitHub Release
+        uses: ./.github/actions/create-github-release
+        with:
+          commercial: ${{ vars.COMMERCIAL }}
+          latest: true
+          milestone: ${{ needs.trigger-docs-build.outputs.version }}
+          token: ${{ secrets.GH_ACTIONS_REPO_TOKEN }}

.github/workflows/release-milestone.yml

@@ -1,95 +0,0 @@
-name: Release Milestone
-on:
-  push:
-    tags:
-      - v7.0.0-M[1-9]
-      - v7.0.0-RC[1-9]
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-jobs:
-  build-and-stage-release:
-    name: Build and Stage Release
-    if: ${{ github.repository == 'spring-projects/spring-framework' }}
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check Out Code
-        uses: actions/checkout@v6
-      - name: Build and Publish
-        id: build-and-publish
-        uses: ./.github/actions/build
-        with:
-          develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
-          publish: true
-      - name: Stage Release
-        uses: spring-io/artifactory-deploy-action@926d7f7cc810569395346bf3a4d91b380b3e355b # v0.0.4
-        with:
-          artifact-properties: |
-            /**/framework-api-*.zip::zip.name=spring-framework,zip.deployed=false
-            /**/framework-api-*-docs.zip::zip.type=docs
-            /**/framework-api-*-schema.zip::zip.type=schema
-          build-name: ${{ format('spring-framework-{0}', steps.build-and-publish.outputs.version)}}
-          folder: 'deployment-repository'
-          password: ${{ secrets.ARTIFACTORY_PASSWORD }}
-          repository: 'libs-staging-local'
-          signing-key: ${{ secrets.GPG_PRIVATE_KEY }}
-          signing-passphrase: ${{ secrets.GPG_PASSPHRASE }}
-          uri: 'https://repo.spring.io'
-          username: ${{ secrets.ARTIFACTORY_USERNAME }}
-    outputs:
-      version: ${{ steps.build-and-publish.outputs.version }}
-  verify:
-    name: Verify
-    needs: build-and-stage-release
-    uses: ./.github/workflows/verify.yml
-    secrets:
-      google-chat-webhook-url: ${{ secrets.GOOGLE_CHAT_WEBHOOK_URL }}
-      repository-password: ${{ secrets.ARTIFACTORY_PASSWORD }}
-      repository-username: ${{ secrets.ARTIFACTORY_USERNAME }}
-      token: ${{ secrets.GH_ACTIONS_REPO_TOKEN }}
-    with:
-      staging: true
-      version: ${{ needs.build-and-stage-release.outputs.version }}
-  sync-to-maven-central:
-    name: Sync to Maven Central
-    needs:
-      - build-and-stage-release
-      - verify
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check Out Code
-        uses: actions/checkout@v6
-      - name: Sync to Maven Central
-        uses: ./.github/actions/sync-to-maven-central
-        with:
-          central-token-password: ${{ secrets.CENTRAL_TOKEN_PASSWORD }}
-          central-token-username: ${{ secrets.CENTRAL_TOKEN_USERNAME }}
-          jfrog-cli-config-token: ${{ secrets.JF_ARTIFACTORY_SPRING }}
-          spring-framework-version: ${{ needs.build-and-stage-release.outputs.version }}
-  promote-release:
-    name: Promote Release
-    needs:
-      - build-and-stage-release
-      - sync-to-maven-central
-    runs-on: ubuntu-latest
-    steps:
-      - name: Set up JFrog CLI
-        uses: jfrog/setup-jfrog-cli@5b06f730cc5a6f55d78b30753f8583454b08c0aa # v4.8.1
-        env:
-          JF_ENV_SPRING: ${{ secrets.JF_ARTIFACTORY_SPRING }}
-      - name: Promote build
-        run: jfrog rt build-promote ${{ format('spring-framework-{0}', needs.build-and-stage-release.outputs.version)}} ${{ github.run_number }} libs-milestone-local
-  create-github-release:
-    name: Create GitHub Release
-    needs:
-      - build-and-stage-release
-      - promote-release
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check Out Code
-        uses: actions/checkout@v6
-      - name: Create GitHub Release
-        uses: ./.github/actions/create-github-release
-        with:
-          milestone: ${{ needs.build-and-stage-release.outputs.version }}
-          pre-release: true
-          token: ${{ secrets.GH_ACTIONS_REPO_TOKEN }}

.github/workflows/release-train-build.yml

@@ -0,0 +1,93 @@
+# This file was auto-generated by github-actions-workflow-generator 0.0.6. Do not edit.
+# To update it, modify .github/workflow-generator.yml as needed and re-run the generator.
+
+name: "Release Train – Build"
+run-name: "${{ inputs.callback-ref }} – Build"
+"on":
+  workflow_dispatch:
+    inputs:
+      callback:
+        description: "Repository to which a callback should be made upon completion"
+        required: true
+        type: "string"
+      callback-ref:
+        description: "Ref in the callback repository to which a callback should be made upon completion"
+        required: true
+        type: "string"
+      release-train-maven-repository-url:
+        description: "URL of a Maven repository to be used to resolve artifacts of projects earlier in the train"
+        required: true
+        type: "string"
+permissions:
+  contents: "read"
+concurrency:
+  group: "${{ github.workflow }}-${{ github.ref }}"
+jobs:
+  build-release:
+    name: "Build Release"
+    runs-on: "ubuntu22-2-8"
+    steps:
+    - name: "Prevent Re-runs"
+      id: "prevent-re-runs"
+      run: |-
+        if [ "$GITHUB_RUN_ATTEMPT" -gt 1 ]; then
+          echo "Re-runs are prohibited. Use the 'Release Train – Retry' workflow to retry build failures"
+          exit 1
+        fi
+    - name: "Set up Java"
+      id: "set-up-java"
+      uses: "actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95" # v5.6.0
+      with:
+        distribution: "liberica"
+        java-version: "25"
+    - name: "Check Out Code"
+      id: "check-out-code"
+      uses: "actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0" # v7.0.0
+    - name: "Build Release"
+      id: "build-release"
+      uses: "./.github/actions/release-train-build"
+      env:
+        COMMERCIAL_RELEASE_REPO_URL: "${{ vars.COMMERCIAL_RELEASE_REPO_URL }}"
+        COMMERCIAL_REPO_PASSWORD: "${{ secrets.COMMERCIAL_ARTIFACTORY_PASSWORD }}"
+        COMMERCIAL_REPO_USERNAME: "${{ secrets.COMMERCIAL_ARTIFACTORY_USERNAME }}"
+        RELEASE_TRAIN_MAVEN_REPOSITORY_PASSWORD: "${{ secrets.RELEASE_TRAIN_PARTICIPANT_MAVEN_REPOSITORY_PASSWORD }}"
+        RELEASE_TRAIN_MAVEN_REPOSITORY_URL: "${{ inputs.release-train-maven-repository-url }}"
+        RELEASE_TRAIN_MAVEN_REPOSITORY_USERNAME: "${{ secrets.RELEASE_TRAIN_PARTICIPANT_MAVEN_REPOSITORY_USERNAME }}"
+    - name: "Upload Deployment Repository"
+      id: "upload-deployment-repository"
+      uses: "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a" # v7.0.1
+      with:
+        name: "deployment-repository"
+        path: "deployment-repository/**"
+    - name: "Upload Deployment Spec"
+      id: "upload-deployment-spec"
+      uses: "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a" # v7.0.1
+      with:
+        archive: "false"
+        if-no-files-found: "ignore"
+        name: "deployment-spec"
+        path: ".github/actions/release-train-build/deployment-spec.yml"
+    - name: "Save Build System Caches"
+      id: "save-build-system-caches"
+      uses: "actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9" # v6.1.0
+      with:
+        key: "release-train-${{ inputs.callback-ref }}-${{ github.ref_name }}"
+        path: |-
+          ~/.gradle/caches
+          ~/.gradle/wrapper
+    - name: "Send Callback"
+      id: "send-callback"
+      if: "${{ !cancelled() }}"
+      env:
+        GH_TOKEN: "${{ secrets.RELEASE_TRAIN_PARTICIPANT_GITHUB_TOKEN }}"
+      run: |-
+        gh workflow run callback \
+        --repo ${{ inputs.callback }} \
+        --ref ${{ inputs.callback-ref }} \
+        --field commit-hash=${{ steps.check-out-code.outputs.commit }} \
+        --field deployment-repository-artifact-identifier=${{ steps.upload-deployment-repository.outputs.artifact-id }} \
+        --field deployment-spec-artifact-identifier=${{ steps.upload-deployment-spec.outputs.artifact-id }} \
+        --field release-branch=${{ github.ref_name }} \
+        --field release-repository=${{ github.repository }} \
+        --field result=${{ job.status == 'success' && 'built' || 'build-failed' }} \
+        --field workflow-run-url=${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}

.github/workflows/release-train-join.yml

@@ -0,0 +1,55 @@
+# This file was auto-generated by github-actions-workflow-generator 0.0.6. Do not edit.
+# To update it, modify .github/workflow-generator.yml as needed and re-run the generator.
+
+name: "Release Train – Join"
+run-name: "${{ inputs.release-train }} – Join"
+"on":
+  workflow_dispatch:
+    inputs:
+      deployment-destination:
+        description: "Destination to which the release should be deployed"
+        options:
+        - "Maven Central"
+        - "Spring Enterprise"
+        required: true
+        type: "choice"
+      release-train:
+        description: "Release train"
+        required: true
+        type: "string"
+      release-train-repository:
+        default: "spring-io/release-train"
+        description: "Release train repository"
+        required: true
+        type: "string"
+permissions:
+  contents: "none"
+jobs:
+  join-release-train:
+    name: "Join Release Train"
+    runs-on: "ubuntu-latest"
+    steps:
+    - name: "Join Release Train"
+      id: "join-release-train"
+      env:
+        GH_TOKEN: "${{ secrets.RELEASE_TRAIN_PARTICIPANT_GITHUB_TOKEN }}"
+      run: |-
+        run_url=$(
+          gh workflow run join \
+          --repo ${{ inputs.release-train-repository }} \
+          --ref ${{ inputs.release-train }} \
+          --field commit-hash=${{ github.sha }} \
+          --field deployment-destination=${{ inputs.deployment-destination == 'Maven Central' && 'maven-central' || 'spring-enterprise' }} \
+          --field release-branch=${{ github.ref_name }} \
+          --field release-repository=${{ github.repository }}
+        )
+        echo "Dispatched workflow run. Waiting for $run_url to complete."
+        run_id=${run_url##*/}
+        watch_exit_code=0
+        gh run watch $run_id --repo ${{ inputs.release-train-repository }} --exit-status --interval=3 > /dev/null 2>&1 || watch_exit_code=$?
+        if [[ $watch_exit_code -eq 0 ]]; then
+          echo "Workflow run succeeded."
+        else
+          echo "Workflow run failed."
+        fi
+        exit $watch_exit_code

.github/workflows/release-train-leave.yml

@@ -0,0 +1,46 @@
+# This file was auto-generated by github-actions-workflow-generator 0.0.6. Do not edit.
+# To update it, modify .github/workflow-generator.yml as needed and re-run the generator.
+
+name: "Release Train – Leave"
+run-name: "${{ inputs.release-train }} – Leave"
+"on":
+  workflow_dispatch:
+    inputs:
+      release-train:
+        description: "Release train"
+        required: true
+        type: "string"
+      release-train-repository:
+        default: "spring-io/release-train"
+        description: "Release train repository"
+        required: true
+        type: "string"
+permissions:
+  contents: "none"
+jobs:
+  leave:
+    name: "Leave"
+    runs-on: "ubuntu-latest"
+    steps:
+    - name: "Leave"
+      id: "leave"
+      env:
+        GH_TOKEN: "${{ secrets.RELEASE_TRAIN_PARTICIPANT_GITHUB_TOKEN }}"
+      run: |-
+        run_url=$(
+          gh workflow run leave \
+          --repo ${{ inputs.release-train-repository }} \
+          --ref ${{ inputs.release-train }} \
+          --field release-branch=${{ github.ref_name }} \
+          --field release-repository=${{ github.repository }}
+        )
+        echo "Dispatched workflow run. Waiting for $run_url to complete."
+        run_id=${run_url##*/}
+        watch_exit_code=0
+        gh run watch $run_id --repo ${{ inputs.release-train-repository }} --exit-status --interval=3 > /dev/null 2>&1 || watch_exit_code=$?
+        if [[ $watch_exit_code -eq 0 ]]; then
+          echo "Workflow run succeeded."
+        else
+          echo "Workflow run failed."
+        fi
+        exit $watch_exit_code

.github/workflows/release-train-ready.yml

@@ -0,0 +1,47 @@
+# This file was auto-generated by github-actions-workflow-generator 0.0.6. Do not edit.
+# To update it, modify .github/workflow-generator.yml as needed and re-run the generator.
+
+name: "Release Train – Ready"
+run-name: "${{ inputs.release-train }} – Ready"
+"on":
+  workflow_dispatch:
+    inputs:
+      release-train:
+        description: "Release train"
+        required: true
+        type: "string"
+      release-train-repository:
+        default: "spring-io/release-train"
+        description: "Release train repository"
+        required: true
+        type: "string"
+permissions:
+  contents: "none"
+jobs:
+  ready:
+    name: "Ready"
+    runs-on: "ubuntu-latest"
+    steps:
+    - name: "Ready"
+      id: "ready"
+      env:
+        GH_TOKEN: "${{ secrets.RELEASE_TRAIN_PARTICIPANT_GITHUB_TOKEN }}"
+      run: |-
+        run_url=$(
+          gh workflow run ready \
+          --repo ${{ inputs.release-train-repository }} \
+          --ref ${{ inputs.release-train }} \
+          --field commit-hash=${{ github.sha }} \
+          --field release-branch=${{ github.ref_name }} \
+          --field release-repository=${{ github.repository }}
+        )
+        echo "Dispatched workflow run. Waiting for $run_url to complete."
+        run_id=${run_url##*/}
+        watch_exit_code=0
+        gh run watch $run_id --repo ${{ inputs.release-train-repository }} --exit-status --interval=3 > /dev/null 2>&1 || watch_exit_code=$?
+        if [[ $watch_exit_code -eq 0 ]]; then
+          echo "Workflow run succeeded."
+        else
+          echo "Workflow run failed."
+        fi
+        exit $watch_exit_code

.github/workflows/release-train-retry.yml

@@ -0,0 +1,34 @@
+# This file was auto-generated by github-actions-workflow-generator 0.0.6. Do not edit.
+# To update it, modify .github/workflow-generator.yml as needed and re-run the generator.
+
+name: "Release Train – Retry"
+run-name: "${{ inputs.release-train }} – Retry"
+"on":
+  workflow_dispatch:
+    inputs:
+      release-train:
+        description: "Release train"
+        required: true
+        type: "string"
+      release-train-repository:
+        default: "spring-io/release-train"
+        description: "Release train repository"
+        required: true
+        type: "string"
+permissions:
+  contents: "none"
+jobs:
+  trigger-retry:
+    name: "Trigger Retry"
+    runs-on: "ubuntu-latest"
+    steps:
+    - name: "Trigger Retry"
+      id: "trigger-retry"
+      env:
+        GH_TOKEN: "${{ secrets.RELEASE_TRAIN_PARTICIPANT_GITHUB_TOKEN }}"
+      run: |-
+        gh workflow run retry \
+        --repo ${{ inputs.release-train-repository }} \
+        --ref ${{ inputs.release-train }} \
+        --field release-branch=${{ github.ref_name }} \
+        --field release-repository=${{ github.repository }}

.github/workflows/release-train-test.yml

@@ -0,0 +1,84 @@
+# This file was auto-generated by github-actions-workflow-generator 0.0.6. Do not edit.
+# To update it, modify .github/workflow-generator.yml as needed and re-run the generator.
+
+name: "Release Train – Test"
+run-name: "${{ inputs.callback-ref }} – Test"
+"on":
+  workflow_dispatch:
+    inputs:
+      callback:
+        description: "Repository to which a callback should be made upon completion"
+        required: true
+        type: "string"
+      callback-ref:
+        description: "Ref in the callback repository to which a callback should be made upon completion"
+        required: true
+        type: "string"
+      release-train-maven-repository-url:
+        description: "URL of a Maven repository to be used to resolve artifacts of projects earlier in the train"
+        required: true
+        type: "string"
+permissions:
+  contents: "read"
+concurrency:
+  group: "${{ github.workflow }}-${{ github.ref }}"
+jobs:
+  test-release:
+    name: "Test Release"
+    runs-on: "ubuntu22-2-8"
+    steps:
+    - name: "Prevent Re-runs"
+      id: "prevent-re-runs"
+      run: |-
+        if [ "$GITHUB_RUN_ATTEMPT" -gt 1 ]; then
+          echo "Re-runs are prohibited. Use the 'Release Train – Retry' workflow to retry test failures"
+          exit 1
+        fi
+    - name: "Set up Java"
+      id: "set-up-java"
+      uses: "actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95" # v5.6.0
+      with:
+        distribution: "liberica"
+        java-version: "25"
+    - name: "Check Out Code"
+      id: "check-out-code"
+      uses: "actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0" # v7.0.0
+    - name: "Restore Build System Caches"
+      id: "restore-build-system-caches"
+      uses: "actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9" # v6.1.0
+      with:
+        key: "release-train-${{ inputs.callback-ref }}-${{ github.ref_name }}"
+        path: |-
+          ~/.gradle/caches
+          ~/.gradle/wrapper
+    - name: "Test Release"
+      id: "test-release"
+      uses: "./.github/actions/release-train-test"
+      env:
+        COMMERCIAL_RELEASE_REPO_URL: "${{ vars.COMMERCIAL_RELEASE_REPO_URL }}"
+        COMMERCIAL_REPO_PASSWORD: "${{ secrets.COMMERCIAL_ARTIFACTORY_PASSWORD }}"
+        COMMERCIAL_REPO_USERNAME: "${{ secrets.COMMERCIAL_ARTIFACTORY_USERNAME }}"
+        RELEASE_TRAIN_MAVEN_REPOSITORY_PASSWORD: "${{ secrets.RELEASE_TRAIN_PARTICIPANT_MAVEN_REPOSITORY_PASSWORD }}"
+        RELEASE_TRAIN_MAVEN_REPOSITORY_URL: "${{ inputs.release-train-maven-repository-url }}"
+        RELEASE_TRAIN_MAVEN_REPOSITORY_USERNAME: "${{ secrets.RELEASE_TRAIN_PARTICIPANT_MAVEN_REPOSITORY_USERNAME }}"
+    - name: "Send Callback"
+      id: "send-callback"
+      if: "${{ !cancelled() }}"
+      env:
+        GH_TOKEN: "${{ secrets.RELEASE_TRAIN_PARTICIPANT_GITHUB_TOKEN }}"
+      run: |-
+        gh workflow run callback \
+        --repo ${{ inputs.callback }} \
+        --ref ${{ inputs.callback-ref }} \
+        --field commit-hash=${{ steps.check-out-code.outputs.commit }} \
+        --field release-branch=${{ github.ref_name }} \
+        --field release-repository=${{ github.repository }} \
+        --field result=${{ job.status == 'success' && 'tested' || 'test-failed' }} \
+        --field workflow-run-url=${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+    - name: "Upload Build System Reports"
+      id: "upload-build-system-reports"
+      if: "${{ failure() }}"
+      uses: "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a" # v7.0.1
+      with:
+        name: "build-system-reports"
+        path: "**/build/reports"

.github/workflows/release.yml

@@ -1,93 +0,0 @@
-name: Release
-on:
-  push:
-    tags:
-      - v7.0.[0-9]+
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-jobs:
-  build-and-stage-release:
-    name: Build and Stage Release
-    if: ${{ github.repository == 'spring-projects/spring-framework' }}
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check Out Code
-        uses: actions/checkout@v6
-      - name: Build and Publish
-        id: build-and-publish
-        uses: ./.github/actions/build
-        with:
-          develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
-          publish: true
-      - name: Stage Release
-        uses: spring-io/artifactory-deploy-action@926d7f7cc810569395346bf3a4d91b380b3e355b # v0.0.4
-        with:
-          artifact-properties: |
-            /**/framework-api-*.zip::zip.name=spring-framework,zip.deployed=false
-            /**/framework-api-*-docs.zip::zip.type=docs
-            /**/framework-api-*-schema.zip::zip.type=schema
-          build-name: ${{ format('spring-framework-{0}', steps.build-and-publish.outputs.version)}}
-          folder: 'deployment-repository'
-          password: ${{ secrets.ARTIFACTORY_PASSWORD }}
-          repository: 'libs-staging-local'
-          signing-key: ${{ secrets.GPG_PRIVATE_KEY }}
-          signing-passphrase: ${{ secrets.GPG_PASSPHRASE }}
-          uri: 'https://repo.spring.io'
-          username: ${{ secrets.ARTIFACTORY_USERNAME }}
-    outputs:
-      version: ${{ steps.build-and-publish.outputs.version }}
-  verify:
-    name: Verify
-    needs: build-and-stage-release
-    uses: ./.github/workflows/verify.yml
-    secrets:
-      google-chat-webhook-url: ${{ secrets.GOOGLE_CHAT_WEBHOOK_URL }}
-      repository-password: ${{ secrets.ARTIFACTORY_PASSWORD }}
-      repository-username: ${{ secrets.ARTIFACTORY_USERNAME }}
-      token: ${{ secrets.GH_ACTIONS_REPO_TOKEN }}
-    with:
-      staging: true
-      version: ${{ needs.build-and-stage-release.outputs.version }}
-  sync-to-maven-central:
-    name: Sync to Maven Central
-    needs:
-      - build-and-stage-release
-      - verify
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check Out Code
-        uses: actions/checkout@v6
-      - name: Sync to Maven Central
-        uses: ./.github/actions/sync-to-maven-central
-        with:
-          central-token-password: ${{ secrets.CENTRAL_TOKEN_PASSWORD }}
-          central-token-username: ${{ secrets.CENTRAL_TOKEN_USERNAME }}
-          jfrog-cli-config-token: ${{ secrets.JF_ARTIFACTORY_SPRING }}
-          spring-framework-version: ${{ needs.build-and-stage-release.outputs.version }}
-  promote-release:
-    name: Promote Release
-    needs:
-      - build-and-stage-release
-      - sync-to-maven-central
-    runs-on: ubuntu-latest
-    steps:
-      - name: Set up JFrog CLI
-        uses: jfrog/setup-jfrog-cli@5b06f730cc5a6f55d78b30753f8583454b08c0aa # v4.8.1
-        env:
-          JF_ENV_SPRING: ${{ secrets.JF_ARTIFACTORY_SPRING }}
-      - name: Promote build
-        run: jfrog rt build-promote ${{ format('spring-framework-{0}', needs.build-and-stage-release.outputs.version)}} ${{ github.run_number }} libs-release-local
-  create-github-release:
-    name: Create GitHub Release
-    needs:
-      - build-and-stage-release
-      - promote-release
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check Out Code
-        uses: actions/checkout@v6
-      - name: Create GitHub Release
-        uses: ./.github/actions/create-github-release
-        with:
-          milestone: ${{ needs.build-and-stage-release.outputs.version }}
-          token: ${{ secrets.GH_ACTIONS_REPO_TOKEN }}

.github/workflows/verify.yml

@@ -12,31 +12,39 @@ on:
         required: true
         type: string
     secrets:
+      commercial-repository-password:
+        description: 'Password for authentication with the commercial repository'
+        required: false
+      commercial-repository-username:
+        description: 'Username for authentication with the commercial repository'
+        required: false
       google-chat-webhook-url:
         description: 'Google Chat Webhook URL'
         required: true
-      repository-password:
-        description: 'Password for authentication with the repository'
+      opensource-repository-password:
+        description: 'Password for authentication with the open-source repository'
         required: false
-      repository-username:
-        description: 'Username for authentication with the repository'
+      opensource-repository-username:
+        description: 'Username for authentication with the open-source repository'
         required: false
       token:
         description: 'Token to use for authentication with GitHub'
         required: true
+permissions:
+  contents: read
 jobs:
   verify:
     name: Verify
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.UBUNTU_SMALL || 'ubuntu-latest' }}
     steps:
       - name: Check Out Release Verification Tests
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          ref: 'v0.0.2'
+          ref: 'v0.0.3'
           repository: spring-projects/spring-framework-release-verification
           token: ${{ secrets.token }}
       - name: Check Out Send Notification Action
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           path: send-notification
           sparse-checkout: .github/actions/send-notification
@@ -46,8 +54,9 @@ jobs:
           distribution: 'liberica'
           java-version: 17
       - name: Set Up Gradle
-        uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
+        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
         with:
+          cache-provider: basic
           cache-read-only: false
       - name: Configure Gradle Properties
         shell: bash
@@ -56,15 +65,17 @@ jobs:
           echo 'org.gradle.daemon=false' >> $HOME/.gradle/gradle.properties
       - name: Run Release Verification Tests
         env:
-          RVT_OSS_REPOSITORY_PASSWORD: ${{ secrets.repository-password }}
-          RVT_OSS_REPOSITORY_USERNAME: ${{ secrets.repository-username }}
-          RVT_RELEASE_TYPE: oss
+          RVT_COMMERCIAL_REPOSITORY_PASSWORD: ${{ secrets.commercial-repository-password }}
+          RVT_COMMERCIAL_REPOSITORY_USERNAME: ${{ secrets.commercial-repository-username }}
+          RVT_OSS_REPOSITORY_PASSWORD: ${{ secrets.opensource-repository-password }}
+          RVT_OSS_REPOSITORY_USERNAME: ${{ secrets.opensource-repository-username }}
+          RVT_RELEASE_TYPE: ${{ vars.COMMERCIAL && 'commercial' || 'oss' }}
           RVT_STAGING: ${{ inputs.staging }}
           RVT_VERSION: ${{ inputs.version }}
         run: ./gradlew spring-framework-release-verification-tests:test
       - name: Upload Build Reports on Failure
         if: failure()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: build-reports
           path: '**/build/reports/'

build.gradle

@@ -6,7 +6,7 @@ plugins {
 	id 'com.github.bjornvester.xjc' version '1.8.2' apply false
 	id 'com.gradleup.shadow' version "9.2.2" apply false
 	id 'me.champeau.jmh' version '0.7.2' apply false
-	id 'io.spring.nullability' version '0.0.11' apply false
+	id 'io.spring.nullability' version '0.0.14' apply false
 }
 
 ext {
@@ -18,16 +18,8 @@ description = "Spring Framework"
 
 configure(allprojects) { project ->
 	apply plugin: "org.springframework.build.localdev"
+    apply plugin: "org.springframework.build.repositories"
 	group = "org.springframework"
-	repositories {
-		mavenCentral()
-		if (version.contains('-')) {
-			maven { url = "https://repo.spring.io/milestone" }
-		}
-		if (version.endsWith('-SNAPSHOT')) {
-			maven { url = "https://repo.spring.io/snapshot" }
-		}
-	}
 	configurations.all {
 		resolutionStrategy {
 			cacheChangingModulesFor 0, "seconds"
@@ -74,7 +66,7 @@ configure([rootProject] + javaProjects) { project ->
 		//"https://jakarta.ee/specifications/platform/11/apidocs/",
 		"https://docs.hibernate.org/orm/7.2/javadocs/",
 		"https://www.quartz-scheduler.org/api/2.3.0/",
-		"https://hc.apache.org/httpcomponents-client-5.6.x/current/httpclient5/apidocs/",
+		"https://hc.apache.org/httpcomponents-client-5.6.x/5.6/httpclient5/apidocs/",
 		"https://projectreactor.io/docs/core/release/api/",
 		"https://projectreactor.io/docs/test/release/api/",
 		"https://junit.org/junit4/javadoc/4.13.2/",

buildSrc/build.gradle

@@ -50,6 +50,10 @@ gradlePlugin {
 			id = "org.springframework.build.multiReleaseJar"
 			implementationClass = "org.springframework.build.multirelease.MultiReleaseJarPlugin"
 		}
+        repositoriesPlugin {
+            id = "org.springframework.build.repositories"
+            implementationClass = "org.springframework.build.RepositoriesPlugin"
+        }
 		optionalDependenciesPlugin {
 			id = "org.springframework.build.optional-dependencies"
 			implementationClass = "org.springframework.build.optional.OptionalDependenciesPlugin"

buildSrc/src/main/java/org/springframework/build/CheckstyleConventions.java

@@ -50,7 +50,7 @@ public class CheckstyleConventions {
 			project.getPlugins().apply(CheckstylePlugin.class);
 			project.getTasks().withType(Checkstyle.class).forEach(checkstyle -> checkstyle.getMaxHeapSize().set("1g"));
 			CheckstyleExtension checkstyle = project.getExtensions().getByType(CheckstyleExtension.class);
-			checkstyle.setToolVersion("13.4.0");
+			checkstyle.setToolVersion("13.10.0");
 			checkstyle.getConfigDirectory().set(project.getRootProject().file("src/checkstyle"));
 			String version = SpringJavaFormatPlugin.class.getPackage().getImplementationVersion();
 			DependencySet checkstyleDependencies = project.getConfigurations().getByName("checkstyle").getDependencies();

buildSrc/src/main/java/org/springframework/build/RepositoriesPlugin.java

@@ -0,0 +1,98 @@
+/*
+ * Copyright 2002-present the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.build;
+
+import org.gradle.api.Plugin;
+import org.gradle.api.Project;
+
+/**
+ * Plugin that configures the OSS, commercial and release train repositories in the build.
+ *
+ * @author Brian Clozel
+ */
+public class RepositoriesPlugin implements Plugin <Project> {
+
+	@Override
+	public void apply(Project project) {
+		configureOssRepositories(project);
+		configureCommercialRepositories(project);
+		configureReleaseTrainRepository(project);
+	}
+
+	private void configureOssRepositories(Project project) {
+		project.getRepositories().mavenCentral();
+		if (project.getVersion().toString().contains("-")) {
+			project.getRepositories().maven(repository -> {
+				repository.setName("spring-oss-milestone");
+				repository.setUrl("https://repo.spring.io/milestone/");
+			});
+		}
+		if (project.getVersion().toString().endsWith("-SNAPSHOT")) {
+			project.getRepositories().maven(repository -> {
+				repository.setName("spring-oss-snapshot");
+				repository.setUrl("https://repo.spring.io/snapshot/");
+			});
+		}
+	}
+
+	private void configureCommercialRepositories(Project project) {
+		String releaseRepositoryUrl = getEnv("COMMERCIAL_RELEASE_REPO_URL");
+		if (releaseRepositoryUrl != null) {
+			project.getRepositories().maven((repository) -> {
+				repository.setName("spring-commercial-release");
+				repository.setUrl(releaseRepositoryUrl);
+				repository.credentials((creds) -> {
+					creds.setUsername(System.getenv("COMMERCIAL_REPO_USERNAME"));
+					creds.setPassword(System.getenv("COMMERCIAL_REPO_PASSWORD"));
+				});
+			});
+		}
+		String snapshotRepositoryUrl = getEnv("COMMERCIAL_SNAPSHOT_REPO_URL");
+		if (snapshotRepositoryUrl != null && project.getVersion().toString().endsWith("-SNAPSHOT")) {
+			project.getRepositories().maven((repository) -> {
+				repository.setName("spring-commercial-snapshot");
+				repository.setUrl(snapshotRepositoryUrl);
+				repository.credentials((creds) -> {
+					creds.setUsername(System.getenv("COMMERCIAL_REPO_USERNAME"));
+					creds.setPassword(System.getenv("COMMERCIAL_REPO_PASSWORD"));
+				});
+			});
+		}
+	}
+
+	private void configureReleaseTrainRepository(Project project) {
+		String releaseTrainRepositoryUrl = getEnv("RELEASE_TRAIN_MAVEN_REPOSITORY_URL");
+		if (releaseTrainRepositoryUrl != null) {
+			project.getRepositories().maven(repository -> {
+				repository.setName("spring-release-train");
+				repository.setUrl(releaseTrainRepositoryUrl);
+				repository.credentials((creds) -> {
+					creds.setUsername(System.getenv("RELEASE_TRAIN_MAVEN_REPOSITORY_USERNAME"));
+					creds.setPassword(System.getenv("RELEASE_TRAIN_MAVEN_REPOSITORY_PASSWORD"));
+				});
+			});
+		}
+	}
+
+	/**
+	 * Returns the environment variable's value, or {@code null} if it is unset or blank.
+	 */
+	private static String getEnv(String name) {
+		String value = System.getenv(name);
+		return (value != null && !value.isBlank()) ? value : null;
+	}
+}

buildSrc/src/main/java/org/springframework/build/TestConventions.java

@@ -71,7 +71,7 @@ class TestConventions {
 				"junit.platform.discovery.issue.severity.critical", "INFO"
 		));
 		if (project.hasProperty("testGroups")) {
-			test.systemProperty("testGroups", project.getProperties().get("testGroups"));
+			test.systemProperty("testGroups", project.findProperty("testGroups"));
 		}
 		test.jvmArgs(
 				"--add-opens=java.base/java.lang=ALL-UNNAMED",
@@ -82,7 +82,7 @@ class TestConventions {
 
 	private void configureByteBuddyAgent(Project project) {
 		if (project.hasProperty("byteBuddyVersion")) {
-			String byteBuddyVersion = (String) project.getProperties().get("byteBuddyVersion");
+			String byteBuddyVersion = (String) project.findProperty("byteBuddyVersion");
 			Configuration byteBuddyAgentConfig = project.getConfigurations().create("byteBuddyAgentConfig");
 			byteBuddyAgentConfig.setTransitive(false);
 			Dependency byteBuddyAgent = project.getDependencies().create("net.bytebuddy:byte-buddy-agent:" + byteBuddyVersion);

framework-api/framework-api.gradle

@@ -15,8 +15,8 @@ repositories {
 }
 
 dependencies {
-	moduleProjects.each { moduleProject ->
-		javadoc moduleProject
+	rootProject.ext.moduleProjects.each { moduleProject ->
+		javadoc project(moduleProject.path)
 	}
 }
 
@@ -52,7 +52,7 @@ javadoc {
 			// ensure the javadoc process can resolve types compiled from .aj sources
 			springAspectsOutput
 		)
-		classpath += files(moduleProjects.collect { it.sourceSets.main.compileClasspath })
+		classpath += files(rootProject.ext.moduleProjects.collect { it.sourceSets.main.compileClasspath })
 	}
 }
 
@@ -96,7 +96,7 @@ tasks.register('schemaZip', Zip) {
 	description = "Builds -${archiveClassifier} archive containing all " +
 			"XSDs for deployment at https://springframework.org/schema."
 	duplicatesStrategy = DuplicatesStrategy.EXCLUDE
-	moduleProjects.each { module ->
+	rootProject.ext.moduleProjects.each { module ->
 		def Properties schemas = new Properties();
 
 		module.sourceSets.main.resources.find {

framework-bom/framework-bom.gradle

@@ -8,7 +8,7 @@ group = "org.springframework"
 dependencies {
 	constraints {
 		parent.moduleProjects.sort { "$it.name" }.each {
-			api it
+			api project(it.path)
 		}
 	}
 }

framework-docs/framework-docs.gradle

@@ -20,6 +20,10 @@ antora {
 	]
 }
 
+node {
+	version = '24.15.0'
+}
+
 tasks.named("generateAntoraYml") {
 	asciidocAttributes = project.provider( {
 		return  ["spring-version": project.version ]

framework-docs/modules/ROOT/nav.adoc

@@ -198,6 +198,7 @@
 *** xref:web/webmvc/mvc-uri-building.adoc[]
 *** xref:web/webmvc/mvc-ann-async.adoc[]
 *** xref:web/webmvc/mvc-range.adoc[]
+*** xref:web/webmvc/mvc-data-binding.adoc[]
 *** xref:web/webmvc-cors.adoc[]
 *** xref:web/webmvc-versioning.adoc[]
 *** xref:web/webmvc/mvc-ann-rest-exceptions.adoc[]
@@ -295,6 +296,7 @@
 *** xref:web/webflux-functional.adoc[]
 *** xref:web/webflux/uri-building.adoc[]
 *** xref:web/webflux/range.adoc[]
+*** xref:web/webflux/data-binding.adoc[]
 *** xref:web/webflux-cors.adoc[]
 *** xref:web/webflux-versioning.adoc[]
 *** xref:web/webflux/ann-rest-exceptions.adoc[]

framework-docs/modules/ROOT/pages/appendix.adoc

@@ -74,6 +74,17 @@ expressions used in XML bean definitions, `@Value`, etc.
 | The mode to use when compiling expressions for the
 xref:core/expressions/evaluation.adoc#expressions-compiler-configuration[Spring Expression Language].
 
+| `spring.expression.maxBigPowerBits`
+| The default maximum number of bits permitted in the result of a `BigDecimal` or
+`BigInteger` power operation within a
+xref:core/expressions/evaluation.adoc#expressions-parser-configuration[Spring Expression Language]
+expression.
+
+| `spring.expression.maxOperations`
+| The default maximum number of operations permitted during
+xref:core/expressions/evaluation.adoc#expressions-parser-configuration[Spring Expression Language]
+expression evaluation.
+
 | `spring.getenv.ignore`
 | Instructs Spring to ignore operating system environment variables if a Spring
 `Environment` property -- for example, a placeholder in a configuration String -- isn't

framework-docs/modules/ROOT/pages/core/beans/java/composing-configuration-classes.adoc

@@ -610,6 +610,19 @@ Kotlin::
 See the {spring-framework-api}/context/annotation/Conditional.html[`@Conditional`]
 javadoc for more detail.
 
+[NOTE]
+====
+A `@Conditional` annotation declared on an enclosing `@Configuration` class is only
+applied to the registration of a nested `@Configuration` class if the nested class is
+reached through the parser's recursion from its enclosing class, or via `@Import`. If a
+nested class is discovered independently of its enclosing class — for example, via
+`@ComponentScan` or by directly registering it against the application context — it is
+processed using only its own `@Conditional` annotations. Thus, if you wish to ensure that
+the same `@Conditional` annotations apply in such scenarios, you must redeclare the
+relevant annotations on the nested class, or extract them into a composed annotation
+which you apply to both the enclosing class and the nested class.
+====
+
 
 [[beans-java-combining]]
 == Combining Java and XML Configuration

framework-docs/modules/ROOT/pages/core/expressions/evaluation.adoc

@@ -253,6 +253,175 @@ properties. Alternatively, configure custom accessors via
 `SimpleEvaluationContext.forPropertyAccessors(...)`, potentially disable assignment, and
 optionally activate method resolution and/or a type converter through the builder.
 
+[[expressions-evaluation-context-security]]
+=== Security Considerations
+
+SpEL is a powerful expression language that can invoke constructors and methods, read and
+write properties and fields, and reference beans – all backed by reflection. Because of
+this power, evaluating a SpEL expression obtained from an untrusted source is inherently
+dangerous and should generally be avoided, since doing so can effectively grant that
+source the ability to execute arbitrary code within the application, regardless of which
+`EvaluationContext` implementation is used.
+
+Throughout this section, a source of a SpEL expression is considered "trusted" only if it
+is a developer of the application or an administrator responsible for configuring or
+operating the application. Any other source of a SpEL expression must be treated as
+untrusted – for example, an expression supplied by an end user of the application or
+received from an external system.
+
+[WARNING]
+====
+`StandardEvaluationContext` exposes the complete SpEL language and must *never* be used
+to evaluate an expression obtained from an untrusted source.
+====
+
+Although `SimpleEvaluationContext` restricts the SpEL language to a subset of its
+features, that restriction is provided on a best-effort basis and does not guarantee that
+expression evaluation is safe. Since an expression can potentially invoke any property,
+method, or function reachable via the configured root object, property accessors, method
+resolvers, variables, and functions, care must be taken if you choose to evaluate
+expressions from an untrusted source. It is therefore the responsibility of the code that
+configures an `EvaluationContext` – for example, by supplying a root object or by
+registering property accessors, resolvers, variables, or functions – to ensure that none
+of the objects reachable via the context expose operations that would be dangerous if
+invoked by an expression from an untrusted source.
+
+Furthermore, a property "getter" reachable from an expression is not necessarily a pure,
+side-effect-free read operation. A JavaBean-style accessor (such as `getName()` or
+`isActive()`) and a plain accessor method used to support data classes such as Java
+records and Kotlin data classes (such as `name()`) are indistinguishable from a method
+that performs an action and happens to return a value (that is, a method which is
+*accessor-shaped*). For example, the `public boolean delete()` method in `java.io.File`
+looks like a plain accessor method to SpEL. Specifically, neither
+`ReflectivePropertyAccessor` nor `DataBindingPropertyAccessor` can determine whether such
+a method is free of side effects. Moreover, restricting a `SimpleEvaluationContext` to
+read-only data binding governs only whether *assignment* to a property is permitted: it
+does not verify that reading a property is side-effect-free. When exposing a root object
+or other reachable object to an untrusted expression, you must ensure that none of its
+accessor-shaped methods perform an action that would be unsafe if triggered by that
+expression.
+
+[NOTE]
+.What makes a method "accessor-shaped"?
+====
+A method is accessor-shaped if it is `public`, takes no arguments, and returns a value –
+the same shape that `ReflectivePropertyAccessor` and `DataBindingPropertyAccessor` look
+for when resolving a property "getter" by name. That shape says nothing about whether
+invoking the method is actually free of side effects. For example, the following methods
+are all accessor-shaped, but only some of them are safe to invoke as a property read.
+
+Side-effect-free (safe to expose as properties):
+
+* `getName()` and `isActive()`: conventional JavaBean-style accessors.
+* `name()` and `active()`: plain accessor methods used by data classes such as Java
+  records and Kotlin data classes.
+
+Side-effecting (unsafe to expose as properties, despite the identical shape):
+
+* `java.io.File#delete()`: deletes the underlying file and returns whether the deletion
+  succeeded.
+* `java.util.Queue#poll()`: removes and returns the head element, mutating the queue.
+* `java.util.concurrent.atomic.AtomicInteger#incrementAndGet()`: increments and returns
+  a counter, mutating it.
+
+If an untrusted expression can reference `someFile.delete`, `someQueue.poll`, or
+`someCounter.incrementAndGet` as a property, SpEL invokes the corresponding method just
+as readily as it would invoke a genuine getter.
+====
+
+[[expressions-evaluation-context-object-design]]
+=== Object Design
+
+Similar to the design guidance for
+xref:web/webmvc/mvc-data-binding.adoc#mvc-data-binding-design[web data binding], you
+should carefully design any object that may be reached from a SpEL expression evaluated
+against untrusted input. This applies not only to the root object supplied to an
+`EvaluationContext` but also to every object that such an expression can navigate to from
+that root object – for example, an object returned by a property, a method, an index
+operation, a variable, or a function.
+
+When exposing an object to expressions from an untrusted source, consider the following
+recommendations.
+
+Use a dedicated type::
+  Prefer a dedicated type, designed specifically to be evaluated against untrusted
+  expressions, over passing an existing domain or infrastructure type "as is". A
+  dedicated type lets you control exactly which properties and methods are reachable from
+  an expression, rather than exposing the full surface area of a class such as a JPA
+  entity, `java.io.File`, or a JDBC `Connection` – most of which were never designed with
+  SpEL evaluation in mind.
+
+Prefer immutability::
+  An immutable type – for example, a Java record or a Kotlin data class exposing only
+  `val` properties – rules out property writes and eliminates any concern that a "getter"
+  might mutate state as a side effect, since there is no mutable state to affect.
+  Immutability does not, on its own, rule out an accessor-shaped method with an external
+  side effect (such as a network call or a file system operation), but it removes an
+  entire class of risk.
+
+Limit scope::
+  Expose only the properties and methods that the expression is expected to use, and
+  nothing more. Because a `PropertyAccessor` cannot restrict access to specific
+  properties or methods on a per-expression basis, every accessor-shaped method reachable
+  on an exposed object is reachable by any expression that can reach that object –
+  regardless of which property or method the application intended the expression to use.
+
+Audit accessor-shaped methods::
+  Review every accessor-shaped method exposed by a type before making it reachable from
+  an untrusted expression, keeping the <<expressions-evaluation-context-security,
+  security considerations>> discussed above in mind. None of the reachable methods should
+  perform an action that would be unsafe if triggered by that expression.
+
+[WARNING]
+====
+These recommendations apply transitively. If the root object exposes a property or method
+that returns another object, and an untrusted expression can navigate to it (for example,
+`rootObject.child.grandchild`), the nested object is just as reachable as the root object
+itself and must meet the same design requirements. The same is true for an object reached
+via indexing (for example, `rootObject.items[0]` or `rootObject.items['key']`): whatever
+is returned by the index operation is just as reachable as any other nested object.
+====
+
+[[expressions-evaluation-context-lifecycle]]
+=== Lifecycle and Reuse
+
+For performance, the AST nodes that make up a parsed `Expression` may cache the specific
+`PropertyAccessor`, `IndexAccessor`, `MethodExecutor`, or `ConstructorExecutor` that
+satisfied a previous evaluation, so that later evaluations of the same node can avoid
+asking every registered accessor or resolver in turn. Understanding this caching behavior
+is essential to using `Expression` and `EvaluationContext` correctly, in addition to the
+<<expressions-evaluation-context-security,security considerations>> discussed previously.
+
+A parsed `Expression` is designed to be created once and evaluated repeatedly, and doing
+so is both supported and encouraged. In particular:
+
+* A parsed `Expression` may be evaluated against different root objects, and against
+  different `EvaluationContext` instances of the *same type and with equivalent
+  configuration* – for example, several `StandardEvaluationContext` instances each
+  registering the same kind of custom `PropertyAccessor`. Changing the accessors or
+  resolvers registered with a context between evaluations of the same expression is
+  atypical and generally not advised, but is expected to work correctly: the registered
+  state of the *current* context is what is consulted, not a snapshot taken during an
+  earlier evaluation.
+* A parsed `Expression` must *not* be evaluated first against a context with one set of
+  security implications and later against a context with different, typically more
+  restrictive, security implications – for example, first against a
+  `StandardEvaluationContext` and later against a `SimpleEvaluationContext`. Doing so is
+  analogous to executing a database query on behalf of an administrator, caching the
+  resulting administrator-privileged execution plan, and then reusing that cached plan for
+  a lower-privileged user while expecting the lower-privileged user's restrictions to
+  apply: cached state from the first, more permissive evaluation may be reused during the
+  second, and the second context's restrictions cannot be reliably enforced as a result.
+  If the same expression string must be evaluated under contexts with different security
+  implications, parse it into *distinct* `Expression` instances, one per context.
+
+[WARNING]
+====
+Reusing a single parsed `Expression` across `EvaluationContext` instances with different
+security implications is not a supported usage pattern and must be avoided, regardless of
+which `EvaluationContext` implementations are involved.
+====
+
 [[expressions-type-conversion]]
 === Type Conversion
 
@@ -395,6 +564,29 @@ set a JVM system property or Spring property named `spring.context.expression.ma
 to the maximum expression length needed by your application (see
 xref:appendix.adoc#appendix-spring-properties[Supported Spring Properties]).
 
+Similarly, the number of operations performed during the evaluation of a SpEL expression
+cannot exceed 10,000 by default; however, the `maxOperations` value is configurable. If
+you create a `SpelExpressionParser` programmatically (the recommend approach), you can
+specify a custom `maxOperations` value when creating the `SpelParserConfiguration` that
+you provide to the `SpelExpressionParser`. If you are not able to configure an explicit
+value for `maxOperations` via `SpelParserConfiguration`, you can set a JVM system
+property or Spring property named `spring.expression.maxOperations` to the maximum number
+of operations required by your application (see
+xref:appendix.adoc#appendix-spring-properties[Supported Spring Properties]).
+
+In addition, the result of a `BigDecimal` or `BigInteger` power operation within a SpEL
+expression cannot exceed 1,000,000 bits by default – approximately equivalent to a
+decimal number with 300,000 digits. Power operations involving large base values or large
+exponents can be computationally expensive, and this limit ensures that evaluations
+remain bounded; however, the `maximumBigPowerBits` value is configurable. If you create a
+`SpelExpressionParser` programmatically (the recommended approach), you can specify a
+custom `maximumBigPowerBits` value when creating the `SpelParserConfiguration` that you
+provide to the `SpelExpressionParser`. To remove this limit entirely, pass
+`Integer.MAX_VALUE` as the `maximumBigPowerBits` value. If you are not able to configure
+an explicit value for `maximumBigPowerBits` via `SpelParserConfiguration`, you can set a
+JVM system property or Spring property named `spring.expression.maxBigPowerBits` to the
+maximum result size in bits (see xref:appendix.adoc#appendix-spring-properties[Supported
+Spring Properties]).
 
 [[expressions-spel-compilation]]
 == SpEL Compilation

framework-docs/modules/ROOT/pages/core/resilience.adoc

@@ -81,6 +81,13 @@ public void sendNotification() {
 }
 ----
 
+[NOTE]
+====
+When `delay` is `0` combined with a positive `jitter`, the delay never grows
+regardless of any configured `multiplier`, so the full configured `jitter` is
+applied directly as a random delay in the range from `0` to `min(jitter, maxDelay)`.
+====
+
 Last but not least, `@Retryable` also works for reactive methods with a reactive return
 type, decorating the pipeline with Reactor's retry capabilities:
 
@@ -263,6 +270,13 @@ and an exponential back-off strategy with a bit of jitter.
             () -> jmsClient.destination("notifications").send(...));
 ----
 
+[NOTE]
+====
+When `delay` is zero combined with a positive `jitter`, the delay never grows
+regardless of any configured `multiplier`, so the full configured `jitter` is
+applied directly as a random delay in the range from zero to `min(jitter, maxDelay)`.
+====
+
 [TIP]
 ====
 Although the factory methods and builder API for `RetryPolicy` cover most common

framework-docs/modules/ROOT/pages/data-access/transaction/declarative/tx-propagation.adoc

@@ -22,7 +22,7 @@ where all the underlying resources have to participate in the service-level tran
 
 NOTE: By default, a participating transaction joins the characteristics of the outer scope,
 silently ignoring the local isolation level, timeout value, or read-only flag (if any).
-Consider switching the `validateExistingTransactions` flag to `true` on your transaction
+Consider switching the `validateExistingTransaction` flag to `true` on your transaction
 manager if you want isolation level declarations to be rejected when participating in
 an existing transaction with a different isolation level. This non-lenient mode also
 rejects read-only mismatches (that is, an inner read-write transaction that tries to participate

framework-docs/modules/ROOT/pages/integration/rest-clients.adoc

@@ -1179,7 +1179,7 @@ built-in decorators to suppress 404 exceptions and return a `ResponseEntity` wit
 [source,java,indent=0,subs="verbatim,quotes"]
 ----
 	// For RestClient
-	HttpServiceProxyFactory factory = HttpServiceProxyFactory.builderFor(restCqlientAdapter)
+	HttpServiceProxyFactory factory = HttpServiceProxyFactory.builderFor(restClientAdapter)
 			.exchangeAdapterDecorator(NotFoundRestClientAdapterDecorator::new)
 			.build();
 

framework-docs/modules/ROOT/pages/testing/annotations/integration-spring/annotation-mockitobean.adoc

@@ -68,12 +68,22 @@ The `@MockitoBean` annotation uses the `REPLACE_OR_CREATE`
 xref:testing/testcontext-framework/bean-overriding.adoc#testcontext-bean-overriding-strategy[strategy for bean overrides].
 If a corresponding bean does not exist, a new bean will be created. However, you can
 switch to the `REPLACE` strategy by setting the `enforceOverride` attribute to `true` –
-for example, `@MockitoBean(enforceOverride = true)`.
+for example, `@MockitoBean(enforceOverride = true)`. Because this strategy replaces the
+bean directly, bypassing the container's normal bean post-processing, the resulting mock
+is a bare object: it is never wrapped in a Spring AOP proxy, even if the original bean
+would have been — for example, due to `@Transactional`, `@Cacheable`, or `@Retryable`. See
+xref:testing/testcontext-framework/bean-overriding.adoc#testcontext-bean-overriding-aop-proxies[Bean
+Overrides and Spring AOP Proxies] for details.
 
 The `@MockitoSpyBean` annotation uses the `WRAP`
-xref:testing/testcontext-framework/bean-overriding.adoc#testcontext-bean-overriding-strategy[strategy],
-and the original instance is wrapped in a Mockito spy. This strategy requires that
-exactly one candidate bean exists.
+xref:testing/testcontext-framework/bean-overriding.adoc#testcontext-bean-overriding-strategy[strategy]:
+an early instance of the original bean is captured and used to create a Mockito spy.
+This strategy requires that exactly one candidate bean exists. In contrast to
+`@MockitoBean`, if the original bean would have been wrapped in a Spring AOP proxy, that
+proxy is still created — but it now wraps the spy instead of the original bean. See
+<<spring-testing-annotation-beanoverriding-mockitospybean-aop-proxies,`@MockitoSpyBean` and Spring AOP Proxies>>
+for a diagram and further details on the consequences this has for stubbing and
+verification.
 
 [TIP]
 ====
@@ -468,3 +478,284 @@ Kotlin::
 TIP: The spies can also be injected into `@Configuration` classes or other test-related
 components in the `ApplicationContext` in order to configure them with Mockito's stubbing
 APIs.
+
+
+[[spring-testing-annotation-beanoverriding-mockitospybean-aop-proxies]]
+== `@MockitoSpyBean` and Spring AOP Proxies
+
+As explained in
+xref:testing/testcontext-framework/bean-overriding.adoc#testcontext-bean-overriding-aop-proxies[Bean
+Overrides and Spring AOP Proxies], if the bean being spied on would normally be wrapped in
+a Spring AOP proxy — for example, due to `@Transactional`, `@Cacheable`, or `@Retryable`
+— that proxy is still created, with the spy as its target. The bean injected into the
+test class and into other beans in the `ApplicationContext` is therefore the proxy, not
+the spy itself.
+
+Verification via Mockito's `verify()` API is unaffected by this and works transparently,
+regardless of whether it is invoked on the proxy or on the underlying spy.
+
+[[spring-testing-annotation-beanoverriding-mockitospybean-aop-proxies-stubbing]]
+=== Stubbing Through the Proxy
+
+Stubbing requires more care than verification, since `Mockito.doReturn(...).when(...)`,
+`Mockito.doThrow(...).when(...)`, and similar methods behave differently depending on the
+nature of the AOP advice involved when invoked on the proxy.
+
+NOTE: Since `when` is a reserved keyword in Kotlin, the Kotlin examples below use the
+`given(...)`, `willReturn(...)`, and `willThrow(...)` methods from `BDDMockito` instead
+of `Mockito.doReturn(...).when(...)` and `Mockito.doThrow(...).when(...)`.
+
+Advice that does not retain state between invocations — such as
+xref:core/resilience.adoc#resilience-annotations-retryable[`@Retryable`] — has no adverse
+effect on stubbing. The following stubbing sequence, invoked on the proxy, behaves exactly
+as it would on the underlying spy directly, including triggering a retry when the thrown
+exception is encountered.
+
+[tabs]
+======
+Java::
++
+[source,java,indent=0,subs="verbatim,quotes"]
+----
+	doReturn("ok")
+		.doThrow(new RuntimeException("Message delivery failed"))
+		.doReturn("ok again")
+		.when(clientService).sendMessage(any()); // <1>
+----
+<1> `clientService` is the injected proxy. Since `@Retryable` advice is a stateless
+    pass-through, each call — including the one that throws — reaches the spy directly.
+
+Kotlin::
++
+[source,kotlin,indent=0,subs="verbatim,quotes"]
+----
+	willReturn("ok")
+		.willThrow(RuntimeException("Message delivery failed"))
+		.willReturn("ok again")
+		.given(clientService).sendMessage(any()) // <1>
+----
+<1> `clientService` is the injected proxy. Since `@Retryable` advice is a stateless
+    pass-through, each call — including the one that throws — reaches the spy directly.
+======
+
+Advice that caches or otherwise memoizes the outcome of an invocation — such as
+`@Cacheable` — does not behave the same way. While a `doReturn(...)`, `doThrow(...)`, or
+similar declaration is being recorded, Mockito does not invoke the spy's real or
+previously stubbed behavior; instead, the invocation used to declare the stubbing returns
+an empty value (for example, `null`). If that invocation is made on the proxy, the caching
+advice caches this empty value, which then permanently shadows the spy for that
+combination of arguments — including for the very invocation that was supposed to
+configure the stubbing.
+
+[tabs]
+======
+Java::
++
+[source,java,indent=0,subs="verbatim,quotes"]
+----
+	doReturn(1L).when(dateService).getDate(false); // <1>
+	dateService.getDate(false); // <2>
+----
+<1> `dateService` is the injected proxy. This invocation is intercepted by Mockito's
+    stubbing infrastructure before it reaches the spy, so the caching advice ends up
+    caching an empty value for argument `false`.
+<2> Returns the empty value cached by the previous invocation — not `1L` — because the
+    cache was already populated.
+
+Kotlin::
++
+[source,kotlin,indent=0,subs="verbatim,quotes"]
+----
+	willReturn(1L).given(dateService).getDate(false) // <1>
+	dateService.getDate(false) // <2>
+----
+<1> `dateService` is the injected proxy. This invocation is intercepted by Mockito's
+    stubbing infrastructure before it reaches the spy, so the caching advice ends up
+    caching an empty value for argument `false`.
+<2> Returns the empty value cached by the previous invocation — not `1L` — because the
+    cache was already populated.
+======
+
+To avoid this, stub directly on the spy instead of on the proxy, by unwrapping the proxy
+with
+{spring-framework-api}/test/util/AopTestUtils.html#getUltimateTargetObject(java.lang.Object)[`AopTestUtils.getUltimateTargetObject(...)`].
+
+[tabs]
+======
+Java::
++
+[source,java,indent=0,subs="verbatim,quotes"]
+----
+	DateService spy = AopTestUtils.getUltimateTargetObject(dateService);
+	doReturn(1L).when(spy).getDate(false);
+----
+
+Kotlin::
++
+[source,kotlin,indent=0,subs="verbatim,quotes"]
+----
+	val spy = AopTestUtils.getUltimateTargetObject<DateService>(dateService)
+	willReturn(1L).given(spy).getDate(false)
+----
+======
+
+[[spring-testing-annotation-beanoverriding-mockitospybean-aop-proxies-disabling]]
+=== Disabling AOP Advice for Tests
+
+Rather than working around the proxy as shown above, you may instead prefer to disable
+the underlying AOP advice for the duration of the test, while keeping `@Retryable`,
+`@Cacheable`, or similar annotations in place in production code. Common reasons include
+avoiding retry delays that slow down the test suite, or avoiding caching altogether so
+that every invocation reaches the spy directly — which also sidesteps the stubbing
+pitfall described above, without having to unwrap the proxy at all.
+
+The general technique is to externalize whatever controls the advice's effective behavior
+— for example, the number of retry attempts or the `CacheManager` backing `@Cacheable`
+— and override that configuration for tests only, typically by using a bean override or a
+test-specific property. The proxy and its advice are still created, but their behavior is
+simply made a no-op or pure pass-through for the test.
+
+For `@Retryable`, bind the `maxRetriesString` attribute to a property placeholder with a
+sensible default (so that production configuration is unaffected if the property is not
+set), and override that property in the test with
+xref:testing/annotations/integration-spring/annotation-testpropertysource.adoc[`@TestPropertySource`]
+so that no retries are attempted.
+
+[tabs]
+======
+Java::
++
+[source,java,indent=0,subs="verbatim,quotes"]
+----
+	@Retryable(maxRetriesString = "${sendMessage.maxRetries:3}", delay = 10)
+	public String sendMessage(String request) {
+		// ...
+	}
+----
+
+Kotlin::
++
+[source,kotlin,indent=0,subs="verbatim,quotes"]
+----
+	@Retryable(maxRetriesString = "\${sendMessage.maxRetries:3}", delay = 10)
+	fun sendMessage(request: String): String {
+		// ...
+	}
+----
+======
+
+[tabs]
+======
+Java::
++
+[source,java,indent=0,subs="verbatim,quotes"]
+----
+	@SpringJUnitConfig
+	@TestPropertySource(properties = "sendMessage.maxRetries = 0") // <1>
+	class ClientServiceTests {
+
+		@MockitoSpyBean
+		ClientService clientService;
+
+		// test case body...
+	}
+----
+<1> With no retries permitted, the first (and only) attempt is made, and a thrown
+    exception propagates immediately, so the spy's stubbing chain behaves exactly as
+    declared, including for `doThrow(...)` answers.
+
+Kotlin::
++
+[source,kotlin,indent=0,subs="verbatim,quotes"]
+----
+	@SpringJUnitConfig
+	@TestPropertySource(properties = ["sendMessage.maxRetries = 0"]) // <1>
+	class ClientServiceTests {
+
+		@MockitoSpyBean
+		lateinit var clientService: ClientService
+
+		// test case body...
+	}
+----
+<1> With no retries permitted, the first (and only) attempt is made, and a thrown
+    exception propagates immediately, so the spy's stubbing chain behaves exactly as
+    declared, including for `doThrow(...)` answers.
+======
+
+For `@Cacheable`, Spring provides
+{spring-framework-api}/cache/support/NoOpCacheManager.html[`NoOpCacheManager`] — a
+`CacheManager` that accepts cache entries but never actually stores them, so every
+invocation results in a cache miss and therefore an invocation of the target method.
+Overriding the `CacheManager` bean with a `NoOpCacheManager` — for example, with
+xref:testing/annotations/integration-spring/annotation-testbean.adoc[`@TestBean`] —
+effectively disables caching for the test without touching the `@Cacheable` annotation in
+production code.
+
+[tabs]
+======
+Java::
++
+[source,java,indent=0,subs="verbatim,quotes"]
+----
+	@SpringJUnitConfig
+	class DateServiceTests {
+
+		@MockitoSpyBean
+		DateService dateService;
+
+		@TestBean // <1>
+		CacheManager cacheManager;
+
+		static CacheManager cacheManager() { // <2>
+			return new NoOpCacheManager();
+		}
+
+		@Test
+		void test() {
+			doReturn(1L).when(dateService).getDate(false);
+			assertThat(dateService.getDate(false)).isEqualTo(1L);
+
+			doReturn(2L).when(dateService).getDate(false);
+			assertThat(dateService.getDate(false)).isEqualTo(2L); // <3>
+		}
+	}
+----
+<1> Override the `CacheManager` bean for this test.
+<2> Replace it with a `NoOpCacheManager`, so `@Cacheable` never actually caches anything.
+<3> No longer masked by a stale cache entry, since every call reaches the spy.
+
+Kotlin::
++
+[source,kotlin,indent=0,subs="verbatim,quotes"]
+----
+	@SpringJUnitConfig
+	class DateServiceTests {
+
+		@MockitoSpyBean
+		lateinit var dateService: DateService
+
+		@TestBean // <1>
+		lateinit var cacheManager: CacheManager
+
+		companion object {
+			@JvmStatic
+			fun cacheManager(): CacheManager { // <2>
+				return NoOpCacheManager()
+			}
+		}
+
+		@Test
+		fun test() {
+			willReturn(1L).given(dateService).getDate(false)
+			assertThat(dateService.getDate(false)).isEqualTo(1L)
+
+			willReturn(2L).given(dateService).getDate(false)
+			assertThat(dateService.getDate(false)).isEqualTo(2L) // <3>
+		}
+	}
+----
+<1> Override the `CacheManager` bean for this test.
+<2> Replace it with a `NoOpCacheManager`, so `@Cacheable` never actually caches anything.
+<3> No longer masked by a stale cache entry, since every call reaches the spy.
+======

framework-docs/modules/ROOT/pages/testing/annotations/integration-spring/annotation-testbean.adoc

@@ -171,3 +171,15 @@ Similarly, when overriding a bean created by a `FactoryBean`, the `FactoryBean`
 replaced with a singleton bean corresponding to the value returned from the `@TestBean`
 factory method.
 ====
+
+[NOTE]
+====
+`@TestBean` uses the `REPLACE` or `REPLACE_OR_CREATE`
+xref:testing/testcontext-framework/bean-overriding.adoc#testcontext-bean-overriding-strategy[strategy
+for bean overrides], which registers the value returned from the factory method directly
+as the bean, bypassing the container's normal bean post-processing. Consequently, none of
+the Spring AOP advice that would otherwise apply to the original bean (for example,
+`@Transactional`, `@Cacheable`, or `@Retryable`) is present on the override instance. See
+xref:testing/testcontext-framework/bean-overriding.adoc#testcontext-bean-overriding-aop-proxies[Bean
+Overrides and Spring AOP Proxies] for details.
+====

framework-docs/modules/ROOT/pages/testing/mockmvc/htmlunit/webdriver.adoc

@@ -3,7 +3,7 @@
 
 In the previous sections, we have seen how to use MockMvc in conjunction with the raw
 HtmlUnit APIs. In this section, we use additional abstractions within the Selenium
-https://docs.seleniumhq.org/projects/webdriver/[WebDriver] to make things even easier.
+https://www.selenium.dev/documentation/webdriver/[WebDriver] to make things even easier.
 
 [[mockmvc-server-htmlunit-webdriver-why]]
 == Why WebDriver and MockMvc?
@@ -12,8 +12,8 @@ We can already use HtmlUnit and MockMvc, so why would we want to use WebDriver?
 Selenium WebDriver provides a very elegant API that lets us easily organize our code. To
 better show how it works, we explore an example in this section.
 
-NOTE: Despite being a part of https://docs.seleniumhq.org/[Selenium], WebDriver does not
-require a Selenium Server to run your tests.
+NOTE: Despite being a part of https://www.selenium.dev/documentation/[Selenium],
+WebDriver does not require a Selenium Server to run your tests.
 
 Suppose we need to ensure that a message is created properly. The tests involve finding
 the HTML form input elements, filling them out, and making various assertions.
@@ -308,7 +308,7 @@ interested. These are of type `WebElement`. WebDriver's
 https://github.com/SeleniumHQ/selenium/wiki/PageFactory[`PageFactory`] lets us remove a
 lot of code from the HtmlUnit version of `CreateMessagePage` by automatically resolving
 each `WebElement`. The
-https://seleniumhq.github.io/selenium/docs/api/java/org/openqa/selenium/support/PageFactory.html#initElements-org.openqa.selenium.WebDriver-java.lang.Class-[`PageFactory#initElements(WebDriver,Class<T>)`]
+https://www.selenium.dev/selenium/docs/api/java/org/openqa/selenium/support/PageFactory.html#initElements-org.openqa.selenium.WebDriver-java.lang.Class-[`PageFactory#initElements(WebDriver,Class<T>)`]
 method automatically resolves each `WebElement` by using the field name and looking it up
 by the `id` or `name` of the element within the HTML page.
 <3> We can use the
@@ -352,7 +352,7 @@ interested. These are of type `WebElement`. WebDriver's
 https://github.com/SeleniumHQ/selenium/wiki/PageFactory[`PageFactory`] lets us remove a
 lot of code from the HtmlUnit version of `CreateMessagePage` by automatically resolving
 each `WebElement`. The
-https://seleniumhq.github.io/selenium/docs/api/java/org/openqa/selenium/support/PageFactory.html#initElements-org.openqa.selenium.WebDriver-java.lang.Class-[`PageFactory#initElements(WebDriver,Class<T>)`]
+https://www.selenium.dev/selenium/docs/api/java/org/openqa/selenium/support/PageFactory.html#initElements-org.openqa.selenium.WebDriver-java.lang.Class-[`PageFactory#initElements(WebDriver,Class<T>)`]
 method automatically resolves each `WebElement` by using the field name and looking it up
 by the `id` or `name` of the element within the HTML page.
 <3> We can use the

framework-docs/modules/ROOT/pages/testing/testcontext-framework/bean-overriding.adoc

@@ -90,3 +90,67 @@ Alternatively, the user can directly provide the bean name in the custom annotat
 `BeanOverrideProcessor` implementations may also internally compute a bean name based on
 a convention or some other method.
 ====
+
+[[testcontext-bean-overriding-aop-proxies]]
+== Bean Overrides and Spring AOP Proxies
+
+Beans in a Spring `ApplicationContext` are frequently wrapped in an AOP proxy — for
+example, to support `@Transactional`, `@Cacheable`, or `@Retryable` semantics. Whether an
+overridden bean retains such a proxy depends on the `BeanOverrideStrategy` used to create
+the override.
+
+* Overrides that use the `REPLACE` or `REPLACE_OR_CREATE` strategy (such as `@TestBean`
+  and `@MockitoBean`) register their override instance directly as a manual singleton,
+  which bypasses the container's normal bean post-processing. Consequently, the override
+  instance is a bare object: none of the AOP advice that would otherwise apply to the
+  original bean (`@Transactional`, `@Cacheable`, `@Retryable`, method security, and so
+  on) is present.
+* Overrides that use the `WRAP` strategy (such as `@MockitoSpyBean`) capture an early
+  reference to the original bean and use it to create the override instance, before the
+  rest of the container's post-processors — including the one responsible for creating
+  AOP proxies — have run. Consequently, if the original bean would have been proxied,
+  that proxy is still created, but it now wraps the override instance instead of the
+  original bean. The bean that ends up in the `ApplicationContext`, and that is injected
+  into collaborating beans and test classes, is therefore the AOP proxy, with the
+  override instance as its target — not the bare override instance itself.
+
+The following diagrams illustrate the resulting shape of the bean for each strategy, from
+the perspective of a caller invoking a method on the injected bean.
+
+With the `REPLACE` or `REPLACE_OR_CREATE` strategy, there is no AOP proxy at all: the
+caller invokes the override instance directly.
+
+[source]
+----
+caller
+  │
+  ▼
+[ override instance ]
+----
+
+With the `WRAP` strategy, any AOP proxy that would normally have wrapped the original
+bean is still created, but now wraps the override instance instead:
+
+[source]
+----
+caller
+  │
+  ▼
+[ AOP proxy ]          (for example, retry, caching, or transaction advice)
+  │
+  │  delegates to its target
+  ▼
+[ override instance ]  (for example, a Mockito spy created by @MockitoSpyBean)
+----
+
+For a `WRAP`-based override such as `@MockitoSpyBean`, the "wrapping" performed by the
+AOP proxy is unrelated to the manner in which the resulting Mockito spy itself "wraps"
+the original bean instance it was created from. The proxy shown above determines which
+object a caller actually invokes, whereas the spy's relationship to the original
+instance only determines what happens when an unstubbed method is invoked on the spy: it
+falls through to that instance's real behavior.
+
+This distinction has practical consequences when combining bean overrides with Mockito's
+stubbing and verification APIs. See
+xref:testing/annotations/integration-spring/annotation-mockitobean.adoc#spring-testing-annotation-beanoverriding-mockitospybean-aop-proxies[`@MockitoSpyBean`
+and Spring AOP Proxies] for details.

framework-docs/modules/ROOT/pages/testing/unit.adoc

@@ -99,6 +99,11 @@ mock to configure expectations on it and perform verifications. For Spring's cor
 utilities, see {spring-framework-api}/aop/support/AopUtils.html[`AopUtils`] and
 {spring-framework-api}/aop/framework/AopProxyUtils.html[`AopProxyUtils`].
 
+TIP: For guidance on using `AopTestUtils` together with `@MockitoSpyBean` when the spied
+bean is wrapped in a Spring AOP proxy, see
+xref:testing/annotations/integration-spring/annotation-mockitobean.adoc#spring-testing-annotation-beanoverriding-mockitospybean-aop-proxies[`@MockitoSpyBean`
+and Spring AOP Proxies].
+
 {spring-framework-api}/test/util/ReflectionTestUtils.html[`ReflectionTestUtils`] is a
 collection of reflection-based utility methods. You can use these methods in testing
 scenarios where you need to change the value of a constant, set a non-`public` field,

framework-docs/modules/ROOT/pages/web/webflux/controller/ann-initbinder.adoc

@@ -107,7 +107,4 @@ Kotlin::
 
 
 [[webflux-ann-initbinder-model-design]]
-== Model Design
-[.small]#xref:web/webmvc/mvc-controller/ann-initbinder.adoc#mvc-ann-initbinder-model-design[See equivalent in the Servlet stack]#
-
-include::partial$web/web-data-binding-model-design.adoc[]
+NOTE: For more guidance on model design, please see xref:web/webflux/data-binding.adoc[Data Binding].

framework-docs/modules/ROOT/pages/web/webflux/data-binding.adoc

@@ -0,0 +1,36 @@
+[[webflux-data-binding]]
+= Data Binding
+:page-section-summary-toc: 1
+
+[.small]#xref:web/webmvc/mvc-data-binding.adoc[See equivalent in the Servlet stack]#
+
+Data binding is a mechanism that binds string parameters onto an object graph with type conversion.
+It is a core mechanism of the Spring Framework that helps with application configuration.
+In web applications it makes it easy to access query parameters and form data through richly typed objects rather than through maps of string values.
+
+To learn more about the data binding mechanism, including constructor and setter binding, property name syntax, type conversion,
+and more, see xref:core/validation/data-binding.adoc[Data binding] in the Core Technologies section.
+
+For annotated controllers, data binding applies to a
+xref:web/webflux/controller/ann-methods/modelattrib-method-args.adoc[@ModelAttribute] method argument.
+For functional endpoints, use the `bind` method of xref:web/webflux-functional.adoc#webflux-fn-request[ServerRequest].
+
+TIP: For browser applications with annotated controllers, you can use
+xref:web/webflux/controller/ann-modelattrib-methods.adoc[@ModelAttribute methods]
+to initialize additional model attributes for use in rendered views.
+
+Each request uses a separate `WebDataBinder` instance.
+For annotated controllers, this instance can be customized through
+xref:web/webflux/controller/ann-initbinder.adoc[@InitBinder methods] within a controller, or
+across controllers through xref:web/webmvc/mvc-controller/ann-advice.adoc[Controller Advice].
+For functional endpoints, use overloaded `ServerRequest.bind` methods.
+
+
+
+
+[[webflux-data-binding-design]]
+== Model Design
+[.small]#xref:web/webmvc/mvc-data-binding.adoc#mvc-data-binding-design[See equivalent in the Servlet stack]#
+
+include::partial$web/web-data-binding-model-design.adoc[]
+

framework-docs/modules/ROOT/pages/web/webflux/reactive-spring.adoc

@@ -338,21 +338,26 @@ include::partial$web/forwarded-headers.adoc[]
 [[webflux-forwarded-headers-transformer]]
 === ForwardedHeaderTransformer
 
-`ForwardedHeaderTransformer` is a component that modifies the host, port, and scheme of
-the request, based on forwarded headers, and then removes those headers. If you declare
-it as a bean with the name `forwardedHeaderTransformer`, it will be
+`ForwardedHeaderTransformer` is a component that modifies the request to match information
+from the standard `"Forwarded"` or `"X-Forwarded"` headers, and also removes those headers
+to eliminate further impact. If you declare it as a bean with the name
+`forwardedHeaderTransformer`, it will be
 xref:web/webflux/reactive-spring.adoc#webflux-web-handler-api-special-beans[detected] and used.
 
-
 [[webflux-forwarded-headers-security]]
 === Security Considerations
 
-There are security considerations for forwarded headers since an application cannot know
-if the headers were added by a proxy, as intended, or by a malicious client. This is why
-a proxy at the boundary of trust should be configured to remove untrusted forwarded traffic coming
-from the outside. You can also configure the `ForwardedHeaderTransformer` with
-`removeOnly=true`, in which case it removes but does not use the headers.
+Forwarded headers are intended to be set by trusted proxies and never allowed in from the
+outside. A proxy at the edge of trust must remove forwarded headers including both the
+standard `"Forwarded"` and `"X-Forwarded"` headers, regardless of which one they use,
+to protect applications which may check both.
 
+When creating `ForwardedHeaderTransformer` you can specify whether to use the
+standard `"Forwarded"` or `"X-Forwarded"` headers. A separate property on the transformer
+lets you turn use of `"X-Forwarded-Prefix"` on and off.
+
+`ForwardedHeaderTransformer`  can be configured in `removeOnly` mode, in which case it removes
+forwarded headers from the request without using them.
 
 [[webflux-filters]]
 == Filters

framework-docs/modules/ROOT/pages/web/webmvc/filters.adoc

@@ -24,7 +24,7 @@ ignoring further handling via `FORWARD` dispatches. The filter also provides con
 over whether the `Filter` gets involved in `ASYNC` and `ERROR` dispatches.
 
 Servlet filters can be configured in `web.xml` or via Servlet annotations.
-In a Spring Boot application , you can
+In a Spring Boot application, you can
 {spring-boot-docs}/how-to/webserver.html#howto.webserver.add-servlet-filter-listener.spring-bean[declare Filter's as beans]
 and Boot will have them configured.
 
@@ -51,20 +51,29 @@ include::partial$web/forwarded-headers.adoc[]
 [[filters-forwarded-headers-non-forwardedheaderfilter]]
 === ForwardedHeaderFilter
 
-`ForwardedHeaderFilter` is a Servlet filter that modifies the request in order to
-a) change the host, port, and scheme based on `Forwarded` headers, and b) to remove those
-headers to eliminate further impact. The filter relies on wrapping the request, and
-therefore it must be ordered ahead of other filters, such as `RequestContextFilter`, that
-should work with the modified and not the original request.
+`ForwardedHeaderFilter` is a Servlet filter that modifies the request to match information
+from the standard `"Forwarded"` or `"X-Forwarded"` headers, and also removes those headers
+to eliminate further impact. The filter wraps the request and must be ordered ahead
+of other filters such as `RequestContextFilter` in order for all downstream
+handlers to see the modified request.
+
 
 [[filters-forwarded-headers-security]]
 === Security Considerations
 
-There are security considerations for forwarded headers since an application cannot know
-if the headers were added by a proxy, as intended, or by a malicious client. This is why
-a proxy at the boundary of trust should be configured to remove untrusted `Forwarded`
-headers that come from the outside. You can also configure the `ForwardedHeaderFilter`
-with `removeOnly=true`, in which case it removes but does not use the headers.
+Forwarded headers are intended to be set by trusted proxies and never allowed in from the
+outside. A proxy at the edge of trust must remove forwarded headers including both the
+standard `"Forwarded"` and `"X-Forwarded"` headers, regardless of which one they use,
+to protect applications which may check both.
+
+When creating `ForwardedHeaderFilter` you can specify whether to use the
+standard `"Forwarded"` or `"X-Forwarded"` headers. A separate property on the filter
+lets you turn use of `"X-Forwarded-Prefix"` on and off.
+
+`ForwardedHeaderFilter` can be configured in `removeOnly` mode, in which case it removes
+forwarded headers from the request without using them.
+
+
 
 [[filters-forwarded-headers-dispatcher]]
 === Dispatcher Types

framework-docs/modules/ROOT/pages/web/webmvc/mvc-controller/ann-initbinder.adoc

@@ -107,7 +107,4 @@ Kotlin::
 
 
 [[mvc-ann-initbinder-model-design]]
-== Model Design
-[.small]#xref:web/webflux/controller/ann-initbinder.adoc#webflux-ann-initbinder-model-design[See equivalent in the Reactive stack]#
-
-include::partial$web/web-data-binding-model-design.adoc[]
+NOTE: For more guidance on model design, please see xref:web/webmvc/mvc-data-binding.adoc[Data Binding].

framework-docs/modules/ROOT/pages/web/webmvc/mvc-data-binding.adoc

@@ -0,0 +1,34 @@
+[[mvc-data-binding]]
+= Data Binding
+:page-section-summary-toc: 1
+
+[.small]#xref:web/webflux/data-binding.adoc[See equivalent in the Reactive stack]#
+
+Data binding is a mechanism that binds string parameters onto an object graph with type conversion.
+It is a core mechanism of the Spring Framework that helps with application configuration.
+In web applications it makes it easy to access query parameters and form data through richly typed objects rather than through maps of string values.
+
+To learn more about the data binding mechanism, including constructor and setter binding, property name syntax, type conversion,
+and more, see xref:core/validation/data-binding.adoc[Data binding] in the Core Technologies section.
+
+For annotated controllers, data binding applies to a
+xref:web/webmvc/mvc-controller/ann-methods/modelattrib-method-args.adoc[@ModelAttribute] method argument.
+For functional endpoints, use the `bind` method of xref:web/webmvc-functional.adoc#webmvc-fn-request[ServerRequest].
+
+TIP: For browser applications with annotated controllers, you can use
+xref:web/webmvc/mvc-controller/ann-modelattrib-methods.adoc[@ModelAttribute methods]
+to initialize additional model attributes for use in rendered views.
+
+Each request uses a separate `WebDataBinder` instance.
+For annotated controllers, this instance can be customized through
+xref:web/webmvc/mvc-controller/ann-initbinder.adoc[@InitBinder methods] within a controller, or
+across controllers through xref:web/webmvc/mvc-controller/ann-advice.adoc[Controller Advice].
+For functional endpoints, use overloaded `ServerRequest.bind` methods.
+
+
+
+[[mvc-data-binding-design]]
+== Model Design
+[.small]#xref:web/webflux/data-binding.adoc#webflux-data-binding-design[See equivalent in the Reactive stack]#
+
+include::partial$web/web-data-binding-model-design.adoc[]

framework-docs/modules/ROOT/pages/web/webmvc/mvc-uri-building.adoc

@@ -112,8 +112,8 @@ Kotlin::
 
 NOTE: As of 5.1, `ServletUriComponentsBuilder` ignores information from the `Forwarded` and
 `X-Forwarded-*` headers, which specify the client-originated address. Consider using the
-xref:web/webmvc/filters.adoc#filters-forwarded-headers[`ForwardedHeaderFilter`] to extract and use or to discard
-such headers.
+xref:web/webmvc/filters.adoc#filters-forwarded-headers[`ForwardedHeaderFilter`]
+to extract and use or to discard such headers.
 
 
 [[mvc-links-to-controllers]]
@@ -261,8 +261,8 @@ Kotlin::
 
 NOTE: As of 5.1, `MvcUriComponentsBuilder` ignores information from the `Forwarded` and
 `X-Forwarded-*` headers, which specify the client-originated address. Consider using the
-xref:web/webmvc/filters.adoc#filters-forwarded-headers[ForwardedHeaderFilter] to extract and use or to discard
-such headers.
+xref:web/webmvc/filters.adoc#filters-forwarded-headers[ForwardedHeaderFilter] to extract
+and use or to discard such headers.
 
 
 [[mvc-links-to-controllers-from-views]]

framework-docs/modules/ROOT/partials/web/forwarded-headers.adoc

@@ -1,15 +1,30 @@
-As a request goes through proxies such as load balancers the host, port, and
-scheme may change, and that makes it a challenge to create links that point to the correct
-host, port, and scheme from a client perspective.
+As a request goes through a chain of proxies, request details such as the scheme, host,
+port, remote address, and local address change. Proxies can insert headers that keep track of
+the hops, and that can help to restore the request from the original client's perspective.
+This allows an application to create self-reference links for external clients.
+
+There are two alternatives for headers that proxies can use:
+
+- {rfc-site}/rfc7239[RFC 7239] defines the `"Forwarded"` HTTP header, a single header with
+individual attributes for each component in the chain of proxied requests with the
+following syntax.
+- `"X-Forwarded-"` prefixed headers are the original approach that predates the standard
+and uses a separate header for each request component.
+
+The Spring Framework supports both approaches. Most proxies today support the original
+`"X-Forwarded"` headers only as a de facto standard.
+
+WARNING: For maximum security, a proxy at the edge of trust must be configured to reset both
+the standard `"Forwarded"` and `"X-Forwarded-"` headers regardless of which ones are chosen
+for use. Likewise, when configuring forwarded header handling in Spring, you need to indicate
+which type of headers to use. More on security considerations later in this section.
+
 
-{rfc-site}/rfc7239[RFC 7239] defines the `Forwarded` HTTP header
-that proxies can use to provide information about the original request.
 
 [[forwarded-headers-non-standard]]
-=== Non-standard Headers
+=== X-Forwarded Headers
 
-There are other non-standard headers, too, including `X-Forwarded-Host`, `X-Forwarded-Port`,
-`X-Forwarded-Proto`, `X-Forwarded-Ssl`, `X-Forwarded-Prefix`, and `X-Forwarded-For`.
+This section describes supported `"X-Forwarded"` headers.
 
 [[x-forwarded-host]]
 ==== X-Forwarded-Host

framework-docs/modules/ROOT/partials/web/web-data-binding-model-design.adoc

@@ -1,91 +1,53 @@
-xref:core/validation/data-binding.adoc[Data binding] for web requests involves
-binding request parameters to a model object. By default, request parameters can be bound
-to any public property of the model object, which means malicious clients can provide
-extra values for properties that exist in the model object graph, but are not expected to
-be set. This is why model object design requires careful consideration.
+Data binding involves binding untrusted input onto application objects.
+For security reasons, it's crucial to ensure that input is properly constrained to expected fields only.
+This section provides guidance for safe binding.
 
-TIP: The model object, and its nested object graph is also sometimes referred to as a
-_command object_, _form-backing object_, or _POJO_ (Plain Old Java Object).
+First, prefer **immutable object design** for web binding purposes.
+It is safe because a constructor naturally constrains binding to expected inputs.
+You can use a Java record or a class with a primary constructor, and either can have further nested objects.
+See xref:core/validation/data-binding.adoc#data-binding-constructor-binding[Constructor Binding] for details.
 
-A good practice is to use a _dedicated model object_ rather than exposing your domain
-model such as JPA or Hibernate entities for web data binding. For example, on a form to
-change an email address, create a `ChangeEmailForm` model object that declares only
-the properties required for the input:
+Another option for safe binding is to use **dedicated objects** designed for the expected input.
+Such objects, even if mutable, are safe because they constrain binding to the expected inputs.
 
-[source,java,indent=0,subs="verbatim,quotes"]
-----
-	public class ChangeEmailForm {
-
-		private String oldEmailAddress;
-		private String newEmailAddress;
-
-		public void setOldEmailAddress(String oldEmailAddress) {
-			this.oldEmailAddress = oldEmailAddress;
-		}
-
-		public String getOldEmailAddress() {
-			return this.oldEmailAddress;
-		}
-
-		public void setNewEmailAddress(String newEmailAddress) {
-			this.newEmailAddress = newEmailAddress;
-		}
-
-		public String getNewEmailAddress() {
-			return this.newEmailAddress;
-		}
-
-	}
-----
-
-Another good practice is to apply
-xref:core/validation/data-binding.adoc#data-binding-constructor-binding[constructor binding],
-which uses only the request parameters it needs for constructor arguments, and any other
-input is ignored. This is in contrast to property binding which by default binds every
-request parameter for which there is a matching property.
-
-If neither a dedicated model object nor constructor binding is sufficient, and you must
-use property binding, we strongly recommend registering `allowedFields` patterns (case
-sensitive) on `WebDataBinder` in order to prevent unexpected properties from being set.
+Domain objects such as JPA or Hibernate entities are generally not safe for web binding
+as they likely contain more properties than the expected inputs.
+For such cases, it's crucial to declare the properties to expose for binding.
 For example:
 
 [source,java,indent=0,subs="verbatim,quotes"]
 ----
 	@Controller
-	public class ChangeEmailController {
+	public class PersonController {
 
 		@InitBinder
 		void initBinder(WebDataBinder binder) {
-			binder.setAllowedFields("oldEmailAddress", "newEmailAddress");
+			// See Javadoc for supported pattern syntax
+			binder.setAllowedFields("firstName", "lastName", "*Address");
 		}
-
-		// @RequestMapping methods, etc.
-
 	}
 ----
 
-You can also register `disallowedFields`  patterns (case insensitive). However,
-"allowed" configuration is preferred over "disallowed" as it is more explicit and less
-prone to mistakes.
+NOTE: It is also possible to configure `disallowedFields`, but that's fragile, and
+due to be https://github.com/spring-projects/spring-framework/issues/36802[deprecated] in Spring Framework 7.1.
+It is easy to overlook fields or introduce additional fields over time that should also be excluded.
 
-By default, constructor and property binding are both used. If you want to use
-constructor binding only, you can set the `declarativeBinding` flag on `WebDataBinder`
-through an `@InitBinder` method either locally within a controller or globally through an
-`@ControllerAdvice`. Turning this flag on ensures that only constructor binding is used
-and that property binding is not used unless `allowedFields` patterns are configured.
-For example:
+By default, `DataBinder` applies both constructor and setter binding.
+This is fine with immutable objects and dedicated objects, but for domain objects, you must
+remember to set `allowedFields`. To ensure data binding is only used in declarative style where
+expected inputs are explicitly declared, you can set  `declarativeBinding` on `DataBinder`.
+That applies constructor binding always, and setter binding conditionally if `allowedFields` is set.
+The following shows how to set this flag globally, or
+you can also narrow it through attributes on `ControllerAdvice`:
 
 [source,java,indent=0,subs="verbatim,quotes"]
 ----
-	@Controller
-	public class MyController {
+	@ControllerAdvice
+	public class ControllerConfig {
 
 		@InitBinder
 		void initBinder(WebDataBinder binder) {
 			binder.setDeclarativeBinding(true);
 		}
-
-		// @RequestMapping methods, etc.
-
 	}
 ----

framework-docs/package.json

@@ -1,11 +1,11 @@
 {
   "dependencies": {
-    "antora": "3.2.0-alpha.11",
+    "antora": "3.2.0-alpha.12",
     "@antora/atlas-extension": "1.0.0-alpha.5",
-    "@antora/collector-extension": "1.0.2",
+    "@antora/collector-extension": "1.0.3",
     "@asciidoctor/tabs": "1.0.0-beta.6",
-    "@springio/antora-extensions": "1.14.7",
-    "fast-xml-parser": "5.3.8",
-    "@springio/asciidoctor-extensions": "1.0.0-alpha.17"
+    "@springio/antora-extensions": "1.14.12",
+    "fast-xml-parser": "5.7.0",
+    "@springio/asciidoctor-extensions": "1.0.0-alpha.18"
   }
 }

framework-docs/src/main/java/org/springframework/docs/integration/jms/jmssending/JmsQueueSender.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2024 the original author or authors.
+ * Copyright 2002-present the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

framework-docs/src/main/java/org/springframework/docs/integration/jms/jmssendingconversion/JmsSenderWithConversion.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2024 the original author or authors.
+ * Copyright 2002-present the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

framework-docs/src/main/java/org/springframework/docs/integration/jms/jmssendingpostprocessor/JmsClientWithPostProcessor.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2024 the original author or authors.
+ * Copyright 2002-present the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

framework-docs/src/main/java/org/springframework/docs/web/webmvc/mvcservlet/AppConfig.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2025 the original author or authors.
+ * Copyright 2002-present the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

framework-docs/src/main/java/org/springframework/docs/web/webmvc/mvcservlet/MyWebApplicationInitializer.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2025 the original author or authors.
+ * Copyright 2002-present the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

framework-docs/src/main/java/org/springframework/docs/web/webmvc/mvcservlet/mvcanncustomerservletcontainererrorpage/ErrorController.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2025 the original author or authors.
+ * Copyright 2002-present the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

framework-docs/src/main/java/org/springframework/docs/web/webmvc/mvcservlet/mvccontainerconfig/MyFilterDispatcherServletInitializer.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2025 the original author or authors.
+ * Copyright 2002-present the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

framework-docs/src/main/java/org/springframework/docs/web/webmvc/mvcservlet/mvccontainerconfig/MyWebAppInitializer.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2025 the original author or authors.
+ * Copyright 2002-present the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

framework-docs/src/main/java/org/springframework/docs/web/webmvc/mvcservlet/mvccontainerconfig/MyWebApplicationInitializer.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2025 the original author or authors.
+ * Copyright 2002-present the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

framework-docs/src/main/java/org/springframework/docs/web/webmvc/mvcservlet/mvccontainerconfig/MyXmlDispatcherServletInitializer.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2025 the original author or authors.
+ * Copyright 2002-present the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

framework-docs/src/main/java/org/springframework/docs/web/webmvc/mvcservlet/mvcloggingsensitivedata/MyInitializer.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2025 the original author or authors.
+ * Copyright 2002-present the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

framework-docs/src/main/java/org/springframework/docs/web/webmvc/mvcservlet/mvcmultipartresolverstandard/AppInitializer.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2025 the original author or authors.
+ * Copyright 2002-present the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

framework-docs/src/main/java/org/springframework/docs/web/webmvc/mvcservlet/mvcservletcontexthierarchy/MyWebAppInitializer.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2025 the original author or authors.
+ * Copyright 2002-present the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

framework-docs/src/main/kotlin/org/springframework/docs/web/webmvc/mvcservlet/AppConfig.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2025 the original author or authors.
+ * Copyright 2002-present the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

framework-docs/src/main/kotlin/org/springframework/docs/web/webmvc/mvcservlet/MyWebApplicationInitializer.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2025 the original author or authors.
+ * Copyright 2002-present the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

framework-docs/src/main/kotlin/org/springframework/docs/web/webmvc/mvcservlet/mvcanncustomerservletcontainererrorpage/ErrorController.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2025 the original author or authors.
+ * Copyright 2002-present the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

framework-docs/src/main/kotlin/org/springframework/docs/web/webmvc/mvcservlet/mvccontainerconfig/MyFilterDispatcherServletInitializer.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2025 the original author or authors.
+ * Copyright 2002-present the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

framework-docs/src/main/kotlin/org/springframework/docs/web/webmvc/mvcservlet/mvccontainerconfig/MyWebAppInitializer.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2025 the original author or authors.
+ * Copyright 2002-present the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

framework-docs/src/main/kotlin/org/springframework/docs/web/webmvc/mvcservlet/mvccontainerconfig/MyWebApplicationInitializer.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2025 the original author or authors.
+ * Copyright 2002-present the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

framework-docs/src/main/kotlin/org/springframework/docs/web/webmvc/mvcservlet/mvccontainerconfig/MyXmlDispatcherServletInitializer.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2025 the original author or authors.
+ * Copyright 2002-present the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

framework-docs/src/main/kotlin/org/springframework/docs/web/webmvc/mvcservlet/mvcloggingsensitivedata/MyInitializer.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2025 the original author or authors.
+ * Copyright 2002-present the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

framework-docs/src/main/kotlin/org/springframework/docs/web/webmvc/mvcservlet/mvcmultipartresolverstandard/AppInitializer.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2025 the original author or authors.
+ * Copyright 2002-present the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

framework-docs/src/main/kotlin/org/springframework/docs/web/webmvc/mvcservlet/mvcservletcontexthierarchy/MyWebAppInitializer.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2025 the original author or authors.
+ * Copyright 2002-present the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

framework-platform/framework-platform.gradle

@@ -8,15 +8,15 @@ javaPlatform {
 
 dependencies {
 	api(platform("com.fasterxml.jackson:jackson-bom:2.20.2"))
-	api(platform("io.micrometer:micrometer-bom:1.16.5"))
-	api(platform("io.netty:netty-bom:4.2.12.Final"))
-	api(platform("io.projectreactor:reactor-bom:2025.0.5"))
+	api(platform("io.micrometer:micrometer-bom:1.16.7"))
+	api(platform("io.netty:netty-bom:4.2.17.Final"))
+	api(platform("io.projectreactor:reactor-bom:2025.0.7"))
 	api(platform("io.rsocket:rsocket-bom:1.1.5"))
-	api(platform("org.apache.groovy:groovy-bom:5.0.5"))
-	api(platform("org.apache.logging.log4j:log4j-bom:2.25.4"))
+	api(platform("org.apache.groovy:groovy-bom:5.0.8"))
+	api(platform("org.apache.logging.log4j:log4j-bom:2.26.1"))
 	api(platform("org.assertj:assertj-bom:3.27.7"))
-	api(platform("org.eclipse.jetty:jetty-bom:12.1.7"))
-	api(platform("org.eclipse.jetty.ee11:jetty-ee11-bom:12.1.7"))
+	api(platform("org.eclipse.jetty:jetty-bom:12.1.12"))
+	api(platform("org.eclipse.jetty.ee11:jetty-ee11-bom:12.1.12"))
 	api(platform("org.jetbrains.kotlinx:kotlinx-coroutines-bom:1.10.2"))
 	api(platform("org.jetbrains.kotlinx:kotlinx-serialization-bom:1.9.0"))
 	api(platform("org.junit:junit-bom:6.0.3"))
@@ -26,12 +26,12 @@ dependencies {
 	constraints {
 		api("com.fasterxml:aalto-xml:1.3.4")
 		api("com.fasterxml.woodstox:woodstox-core:6.7.0")
-		api("com.github.ben-manes.caffeine:caffeine:3.2.3")
+		api("com.github.ben-manes.caffeine:caffeine:3.2.4")
 		api("com.github.librepdf:openpdf:1.3.43")
 		api("com.google.code.findbugs:findbugs:3.0.1")
 		api("com.google.code.findbugs:jsr305:3.0.2")
 		api("com.google.code.gson:gson:2.13.2")
-		api("com.google.protobuf:protobuf-java-util:4.34.1")
+		api("com.google.protobuf:protobuf-java-util:4.35.1")
 		api("com.h2database:h2:2.4.240")
 		api("com.jayway.jsonpath:json-path:2.10.0")
 		api("com.networknt:json-schema-validator:1.5.3")
@@ -96,10 +96,10 @@ dependencies {
 		api("org.apache.httpcomponents.client5:httpclient5:5.6")
 		api("org.apache.httpcomponents.core5:httpcore5-reactive:5.4.2")
 		api("org.apache.poi:poi-ooxml:5.5.1")
-		api("org.apache.tomcat.embed:tomcat-embed-core:11.0.20")
-		api("org.apache.tomcat.embed:tomcat-embed-websocket:11.0.20")
-		api("org.apache.tomcat:tomcat-util:11.0.20")
-		api("org.apache.tomcat:tomcat-websocket:11.0.20")
+		api("org.apache.tomcat.embed:tomcat-embed-core:11.0.24")
+		api("org.apache.tomcat.embed:tomcat-embed-websocket:11.0.24")
+		api("org.apache.tomcat:tomcat-util:11.0.24")
+		api("org.apache.tomcat:tomcat-websocket:11.0.24")
 		api("org.aspectj:aspectjrt:1.9.25")
 		api("org.aspectj:aspectjtools:1.9.25")
 		api("org.aspectj:aspectjweaver:1.9.25")
@@ -110,8 +110,8 @@ dependencies {
 		api("org.dom4j:dom4j:2.2.0")
 		api("org.easymock:easymock:5.6.0")
 		api("org.eclipse.angus:angus-mail:2.0.3")
-		api("org.eclipse.jetty:jetty-reactive-httpclient:4.1.4")
-		api("org.eclipse.persistence:org.eclipse.persistence.jpa:5.0.0")
+		api("org.eclipse.jetty:jetty-reactive-httpclient:4.1.5")
+		api("org.eclipse.persistence:org.eclipse.persistence.jpa:5.0.1")
 		api("org.eclipse:yasson:3.0.4")
 		api("org.ehcache:ehcache:3.10.8")
 		api("org.ehcache:jcache:1.0.1")
@@ -120,8 +120,8 @@ dependencies {
 		api("org.glassfish:jakarta.el:4.0.2")
 		api("org.graalvm.sdk:graal-sdk:22.3.1")
 		api("org.hamcrest:hamcrest:3.0")
-		api("org.hibernate.orm:hibernate-core:7.2.11.Final")
-		api("org.hibernate.validator:hibernate-validator:9.1.0.Final")
+		api("org.hibernate.orm:hibernate-core:7.2.24.Final")
+		api("org.hibernate.validator:hibernate-validator:9.1.3.Final")
 		api("org.hsqldb:hsqldb:2.7.4")
 		api("org.htmlunit:htmlunit:4.21.0")
 		api("org.javamoney:moneta:1.4.4")
@@ -138,7 +138,6 @@ dependencies {
 		api("org.seleniumhq.selenium:selenium-java:4.41.0")
 		api("org.skyscreamer:jsonassert:1.5.3")
 		api("org.testng:testng:7.12.0")
-		api("org.webjars:underscorejs:1.8.3")
 		api("org.webjars:webjars-locator-lite:1.1.0")
 		api("org.xmlunit:xmlunit-assertj:2.10.4")
 		api("org.xmlunit:xmlunit-matchers:2.10.4")

gradle.properties

@@ -1,4 +1,4 @@
-version=7.0.7
+version=7.0.9
 
 org.gradle.caching=true
 org.gradle.jvmargs=-Xmx2048m

gradle/ide.gradle

@@ -7,7 +7,6 @@ apply plugin: 'eclipse'
 eclipse.jdt {
 	sourceCompatibility = 17
 	targetCompatibility = 17
-	javaRuntimeName = "JavaSE-17"
 }
 
 // Replace classpath entries with project dependencies (GRADLE-1116)

gradle/spring-module.gradle

@@ -84,6 +84,8 @@ javadoc {
 		// cross-module @see and @link references which are only reachable
 		// when running the global 'framework-api:javadoc' task.
 		addBooleanOption('Werror', false)
+		// do not ship 4MB of web fonts for single modules
+		addBooleanOption("-no-fonts", true)
 	}
 
 	// Attempt to suppress warnings due to cross-module @see and @link references.

gradle/wrapper/gradle-wrapper.properties

@@ -1,7 +1,9 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-9.4.1-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-9.7.0-bin.zip
 networkTimeout=10000
+retries=0
+retryBackOffMs=500
 validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME
 zipStorePath=wrapper/dists

gradlew

@@ -20,7 +20,7 @@
 
 ##############################################################################
 #
-#   Gradle start up script for POSIX generated by Gradle.
+#   gradlew start up script for POSIX generated by Gradle.
 #
 #   Important for running:
 #
@@ -29,7 +29,7 @@
 #       bash, then to run this script, type that shell name before the whole
 #       command line, like:
 #
-#           ksh Gradle
+#           ksh gradlew
 #
 #       Busybox and similar reduced shells will NOT work, because this script
 #       requires all of these POSIX shell features:
@@ -57,7 +57,7 @@
 #       Darwin, MinGW, and NonStop.
 #
 #   (3) This script is generated from the Groovy template
-#       https://github.com/gradle/gradle/blob/2d6327017519d23b96af35865dc997fcb544fb40/platforms/jvm/plugins-application/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt
+#       https://github.com/gradle/gradle/blob/3d91ce3b8caaf77ad09f381f43615b715b53f72c/platforms/jvm/plugins-application/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt
 #       within the Gradle project.
 #
 #       You can find Gradle at https://github.com/gradle/gradle/.

gradlew.bat

@@ -19,12 +19,12 @@
 @if "%DEBUG%"=="" @echo off
 @rem ##########################################################################
 @rem
-@rem  Gradle startup script for Windows
+@rem  gradlew startup script for Windows
 @rem
 @rem ##########################################################################
 
-@rem Set local scope for the variables with windows NT shell
-if "%OS%"=="Windows_NT" setlocal
+@rem Set local scope for the variables, and ensure extensions are enabled
+setlocal EnableExtensions
 
 set DIRNAME=%~dp0
 if "%DIRNAME%"=="" set DIRNAME=.
@@ -51,7 +51,7 @@ echo. 1>&2
 echo Please set the JAVA_HOME variable in your environment to match the 1>&2
 echo location of your Java installation. 1>&2
 
-goto fail
+"%COMSPEC%" /c exit 1
 
 :findJavaFromJavaHome
 set JAVA_HOME=%JAVA_HOME:"=%
@@ -65,29 +65,18 @@ echo. 1>&2
 echo Please set the JAVA_HOME variable in your environment to match the 1>&2
 echo location of your Java installation. 1>&2
 
-goto fail
+"%COMSPEC%" /c exit 1
 
 :execute
 @rem Setup the command line
 
 
 
-@rem Execute Gradle
-"%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -jar "%APP_HOME%\gradle\wrapper\gradle-wrapper.jar" %*
+@rem Execute gradlew
+@rem endlocal doesn't take effect until after the line is parsed and variables are expanded
+@rem which allows us to clear the local environment before executing the java command
+endlocal & "%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -jar "%APP_HOME%\gradle\wrapper\gradle-wrapper.jar" %* & call :exitWithErrorLevel
 
-:end
-@rem End local scope for the variables with windows NT shell
-if %ERRORLEVEL% equ 0 goto mainEnd
-
-:fail
-rem Set variable GRADLE_EXIT_CONSOLE if you need the _script_ return code instead of
-rem the _cmd.exe /c_ return code!
-set EXIT_CODE=%ERRORLEVEL%
-if %EXIT_CODE% equ 0 set EXIT_CODE=1
-if not ""=="%GRADLE_EXIT_CONSOLE%" exit %EXIT_CODE%
-exit /b %EXIT_CODE%
-
-:mainEnd
-if "%OS%"=="Windows_NT" endlocal
-
-:omega
+:exitWithErrorLevel
+@rem Use "%COMSPEC%" /c exit to allow operators to work properly in scripts
+"%COMSPEC%" /c exit %ERRORLEVEL%

settings.gradle

@@ -1,5 +1,5 @@
 plugins {
-	id "io.spring.develocity.conventions" version "0.0.22"
+	id "io.spring.develocity.conventions" version "0.0.25"
 }
 
 include "spring-aop"

spring-aop/src/main/java/org/springframework/aop/aspectj/MethodInvocationProceedingJoinPoint.java

@@ -163,7 +163,7 @@ public class MethodInvocationProceedingJoinPoint implements ProceedingJoinPoint,
 
 	@Override
 	public String toString() {
-		return "execution(" + getSignature().toString() + ")";
+		return "execution(" + getSignature() + ")";
 	}
 
 

spring-aspects/src/main/java/org/springframework/beans/factory/aspectj/AbstractDependencyInjectionAspect.aj

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2014 the original author or authors.
+ * Copyright 2002-present the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

spring-aspects/src/main/java/org/springframework/beans/factory/aspectj/AbstractInterfaceDrivenDependencyInjectionAspect.aj

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2020 the original author or authors.
+ * Copyright 2002-present the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

spring-aspects/src/main/java/org/springframework/beans/factory/aspectj/AnnotationBeanConfigurerAspect.aj

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2023 the original author or authors.
+ * Copyright 2002-present the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

spring-aspects/src/main/java/org/springframework/beans/factory/aspectj/GenericInterfaceDrivenDependencyInjectionAspect.aj

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2017 the original author or authors.
+ * Copyright 2002-present the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

spring-aspects/src/main/java/org/springframework/cache/aspectj/AbstractCacheAspect.aj

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2014 the original author or authors.
+ * Copyright 2002-present the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

spring-aspects/src/main/java/org/springframework/cache/aspectj/AnnotationCacheAspect.aj

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2013 the original author or authors.
+ * Copyright 2002-present the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

spring-aspects/src/main/java/org/springframework/cache/aspectj/JCacheCacheAspect.aj

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2014 the original author or authors.
+ * Copyright 2002-present the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

spring-aspects/src/main/java/org/springframework/scheduling/aspectj/AbstractAsyncExecutionAspect.aj

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2016 the original author or authors.
+ * Copyright 2002-present the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

spring-aspects/src/main/java/org/springframework/scheduling/aspectj/AnnotationAsyncExecutionAspect.aj

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2024 the original author or authors.
+ * Copyright 2002-present the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.