Spring Framework7.0.8.1

⚠️ Attention Required

• in Spring Framework 7.0.8.1, ForwardedHeaderFilter (Spring MVC) and ForwardedHeaderTransformer (WebFlux) each provide a boolean constructor argument whether to use the standard "Forwarded" header or the "X-Forwarded" alternative headers. A separate property turns on and off use of "X-Forwarded-Prefix". While the default constructor preserves the existing behavior, we recommend to use the new constructor to explicitly specify which forwarded headers to use to make the processing more deterministic and aligned with what is expected from the proxy. Please, see the updated Security Considerations section for details. In 7.1 with spring-projects/spring-framework#37072 the default constructor is deprecated and marked for removal.

🐞 Bug Fixes

• Fix CVE-2026-47883
• Fix CVE-2026-47884
• Fix CVE-2026-47885
• Fix CVE-2026-47886
• Fix CVE-2026-47887
• Fix CVE-2026-47888
• Fix CVE-2026-47889
• Fix CVE-2026-47890
• Fix CVE-2026-47891
• Fix CVE-2026-47892
• Fix CVE-2026-47893
• Fix CVE-2026-59280
• Fix CVE-2026-59281
• Fix CVE-2026-59282
• Fix CVE-2026-59283
• Fix CVE-2026-59313
• Fix CVE-2026-59314
• Ensure consistent ButtonTag value attribute processing

🔨 Dependency Upgrades

• Upgrade to Micrometer 1.16.6.1 and Tracing 1.6.6.1
• Upgrade to Reactor 2025.0.6.1