Spring Framework 7.1 Release Notes

This is a preview page for Spring Framework 7.1.0, scheduled for November 2026.

Upgrading From Spring Framework 7.0

Baseline Upgrades

This new generation raises its minimum requirements for the following:

• Jackson 3.1 for LTS support
• Hibernate ORM 7.3 support; runtime compatibility with Hibernate ORM 7.1 and 7.2 is retained for the time being.

Removed APIs

Breaking Changes

JAXB message converter auto-detection

We noticed that the JAXB message converter can consume a lot of CPU resources at runtime, even if XML isn't being used by the application. The "jakarta.xml.bind:jakarta.xml.bind-api" dependency is very common in Servlet applications and is often auto-detected by HttpMessageConverters as a valid choice.

As of Framework 7.1, HttpMessageConverters will not auto-detect JAXB converters for server applications. RestTemplate and RestClient will still detect it, because the CPU overhead there is less important.

You can bring back this converter in your server application with the following configuration:

@Configuration(proxyBeanMethods = false)
class JaxbConverterConfiguration implements WebMvcConfigurer {

	@Override
	public void configureMessageConverters(HttpMessageConverters.ServerBuilder builder) {
		builder.withXmlConverter(new Jaxb2RootElementHttpMessageConverter());
	}
}

HandlerMappingIntrospector removed

This class was mainly for internal use by Spring Security. However, given that it implemented CorsConfigurationSource and that it was a bean, some applications may have see the absence of a CorsConfigurationSource bean. This was never an intended use of HandlerMappingIntrospector and there is no direct replacement nor remediation advice which would depend on the details of the actual application and use case.

Deprecations

• As announced in the state of HTTP clients in Spring blog post, RestTemplate and related types are formally deprecated as of 7.1. Their actual removal is scheduled for Spring Framework 8.0 (not yet scheduled).
• The default constructors of ForwardedHeaderFilter (Spring MVC) and ForwardedHeaderTransformer (WebFlux) have been deprecated in favour of a new one with a boolean argument whether to use the standard "Forwarded" header or the "X-Forwarded" alternative headers. A separate property enables use of "X-Forwarded-Prefix" if needed. This makes forwarded header processing more deterministic and aligned with what is expected from the proxy. Please, see the updated Security Considerations section, as well as related changes in Spring Boot https://github.com/spring-projects/spring-boot/issues/51030.
• The AllEncompassingFormHttpMessageConverter is deprecated in favor of the new MultipartHttpMessageConverter. It is not configured by default anymore in HTTP clients and server applications.
• The disallowedFields property of DataBinder is deprecated as it is fragile and easy to get out of sync with the actual properties over time. Please use constructor binding, a model object designed for the expected inputs, or allowedFields instead.

New and Noteworthy

Improved Multipart support

Before Spring Framework 7.1, Multipart payloads could be read/written in Spring MVC applications with the Servlet Multipart Resolver support. RestTemplate and RestClient could send Multipart requests thanks to the FormHttpMessageConverter. This means HTTP clients could not read multipart responses and you couldn't thoroughly test your Multipart endpoints with RestTestClient.

As of 7.1, Spring Framework now dedicates FormHttpMessageConverter to URL encoded forms and ships a new MultipartHttpMessageConverter that can write and read Multipart payloads.

Check out in the reference documentation how RestClient can parse Multipart responses as MultiValueMap and how you can use RestTestClient to test your Multipart server endpoints.

When using RestTestClient with MockMvc, integration tests will now support handling multipart requests sent by RestTestClient.