[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
org.springdoc:springdoc-openapi-starter-webmvc-ui (source)	2.9.1 → 3.2.0

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

Release Notes

springdoc/springdoc-openapi (org.springdoc:springdoc-openapi-starter-webmvc-ui)

v3.2.0

Compare Source

Added

• #​3370 – A ParameterCustomizer can read the type-use annotations of a parameter, including the ones declared on the value wrapped in an Optional, such as Optional<@MyAnnotation Foo>
• #​3382 – Mark the Java properties annotated with @Nullable (JSpecify, Spring, JSR-305) as nullable in their schema, including $ref and oneOf properties. Opt-in with springdoc.model-converters.java-nullable-property-customizer.enabled=true
• #​3390 – Add springdoc.model-converters.polymorphic-converter.one-of-as-ref to emit the polymorphic oneOf unions as reusable component schemas, named after the parent schema with the suffix set by springdoc.model-converters.polymorphic-converter.one-of-ref-suffix (Variant by default)
• #​3388 – Register the MCP tools with a McpStatelessSyncServer, for the STATELESS protocol

Changed

• The MCP dashboard no longer pre-fills the OAuth2 token endpoint, client id and client secret. The form shows hints instead, and warns when the token endpoint is not HTTPS
• #​3354 – The default API version is only listed in the header or query parameter of the operations that serve it: a handler method mapped to it, or one without a version
• #​3360 – The properties of Spring Data PagedModel and its PageMetadata are now marked as required, as they are always serialized
• #​3361 – The amount and currency properties of MonetaryAmount are now marked as required
• #​3359 – Upgrade Scalar to version 0.6.83. The first tag is now open by default, and the links to models changed from #model/name to #models/Name
• #​3383 – Upgrade Spring AI to version 2.0.1. The MCP SDK version is now the one required by Spring AI
• Upgrade spring-boot to version 4.1.2
• Upgrade swagger-ui to version 5.34.0
• Upgrade spring-cloud-function to version 5.0.5
• Use the spring-security-oauth2-authorization-server version managed by Spring Boot (7.1.2) instead of 2.0.0-M2

Fixed

• #​3352 – A @ResponseStatus on a controller class is now applied to the responses of its operations
• #​3355 – An injected WebSession parameter is no longer documented as a query parameter in WebFlux applications
• #​3354 – /v3/api-docs no longer fails when an API version parameter declares @Schema(allowableValues)
• #​3364 – The application no longer fails to start when Spring HATEOAS is on the classpath without a LinkRelationProvider bean
• #​3368 – A WebAsyncTask return type is now unwrapped, so its response is described by its result type
• #​3377 – A JSpecify @Nullable on a controller method parameter now makes its schema nullable
• #​3381 – A nullable Kotlin property described by a oneOf schema, such as a sealed class, is now documented as nullable
• #​3387 – Scalar's own integration works again with the Swagger UI and API-only starters: only the Springdoc Scalar starters replace it
• #​3373 – springdoc no longer lifts Jackson 2 above the version managed by Spring Boot in Gradle builds

v3.1.1

Compare Source

Security

• GHSA-6f5m-mhjg-qwxq – MCP tool callbacks do not encode path parameters, allowing request retargeting
• GHSA-4v2q-56v7-2cpw – MCP transport, admin and dashboard endpoints are exposed by default
• GHSA-m4cg-mhpg-rh2r – MCP audit events record credentials and request/response bodies without redaction
• GHSA-5f9r-4mc4-qh3c – Unbounded MCP pending-confirmation store allows memory exhaustion
• GHSA-jcgg-59c8-w4wh – MCP request context in a ThreadLocal can leak headers between concurrent WebFlux requests
• GHSA-rhhx-6j8h-8cvw – Unbounded per-locale OpenAPI cache allows memory exhaustion via Accept-Language
• GHSA-c925-vm88-mpp9 – Scalar starters trust client-supplied forwarded headers and render from a shared mutable bean
• CVE-2026-75838 – Cross-site scripting in the DOMPurify bundled with swagger-ui, addressed by upgrading swagger-ui to 5.32.14

Added

• #​3340 – Describe JsonNullable values without their Java wrapper
• #​3325 – Manage the swagger artifacts in springdoc-openapi-bom, so that modules holding only the annotations stay in lockstep
• #​3321 – Add springdoc.login-endpoint.username-example and springdoc.login-endpoint.password-example to document the Spring Security login endpoint

Changed

• MCP is now opt-in. Set springdoc.ai.mcp.enabled=true, and springdoc.ai.mcp.dashboard-enabled=true for the dashboard
• The Scalar starters no longer register forwarded-header handling. Set server.forward-headers-strategy=framework (or native) behind a trusted proxy
• Add springdoc.cache.max-entries (default 100) to bound the per-locale OpenAPI cache
• Add springdoc.ai.mcp.audit.redact (default true) to mask secrets in MCP audit events
• Document that the MCP approval flow is a confirmation step, not an authorization control
• Document the security policy and the release versioning scheme
• #​3351 – java.time.Duration, LocalTime and OffsetTime are now resolved by swagger-core instead of being forced to a bare string, so they carry a format: duration, time-local and time respectively (partial-time for LocalTime after PrimitiveType.enablePartialTime())
• A property whose type only implements Set indirectly (LinkedHashSet, TreeSet, …) is now described with uniqueItems: true, following swagger-api/swagger-core#5265
• Upgrade swagger-core to version 2.2.55
• Upgrade swagger-ui to version 5.32.14

Fixed

• #​3328, #​3337 – /v3/api-docs fails with a NullPointerException when spring-hateoas is on the classpath without HateoasProperties
• #​3314 – Json Processing Exception occurred is logged for every constrained parameter whose schema is not a JsonSchema
• #​3317 – An injected HttpHeaders parameter is described as a schema
• #​3332 – The properties a Kotlin entity inherits from an @Embeddable are missing from the Spring Data REST schemas
• #​3320 – @Order and Ordered ignored when applying customizers
• #​3319 – A Page nested in another schema is not replaced by PagedModel
• #​3313 – Springdoc auto-configurations rely on unspecified auto-configuration ordering
• #​3331 – Validation annotations declared inside Optional parameters are dropped
• #​3322 – Validation annotations on a container's type argument leak between parameters
• #​3315 – An OAS 3.1 JsonSchema cannot be cloned through JSON
• #​3300 – TYPE_USE annotations on @ParameterObject fields are not passed along
• #​3341 – Stabilize Spring Data Sort and Pageable schema property order
• #​3338 – Kotlin nullability interpretation of the Any? type
• #​3136 – A Spring Data REST association to a non-exported entity expands its @EmbeddedId and @MapsId fields recursively in the response schemas
• The Spring Data REST response post-processing rewrote an association property in place, so the …Response refs could leak into the schema shared with the request body representation

v3.1.0

Compare Source

Added

• #​3269 – Add mechanism to disable nullable for Kotlin properties
• Allow request-specific Swagger UI index transformation

Changed

• Upgrade Spring Boot to version 4.1.0
• Upgrade Spring AI to version 2.0.0
• Upgrade swagger-core to version 2.2.52
• Upgrade swagger-ui to version 5.32.11
• #​3307 – Act upon SonarQube warnings
• #​3306 – Act upon SonarQube warnings

Fixed

• #​3304 – Kotlin parent class's field is not properly marked as nullable
• #​3294 – Duplicated path getting swagger-config
• #​3293 – Inconsistent OpenAPI schema naming with SNAKE_CASE: some Java record fields remain camelCase
• #​3292 – Make WebProperties and WebMvcProperties optional in SwaggerConfig
• #​3284 – Upgrade swagger-core from version 2.2.48 to 2.2.49
• #​3282 – Preserve version from nest() predicate across all routes in nest
• #​3281 – Stabilize Spring Data Page schema property order
• #​3274 – Description disappears from the generated json after upgrade to 3.0.3
• #​3270 – Validation annotation of ParameterObject property applied to PathVariable with the same name, even in unrelated endpoints
• #​3266 – Upgrade swagger-core from version 2.2.47 to 2.2.48
• #​3263 – Null key for a Map not allowed in JSON

v3.0.3

Compare Source

Added

• #​3246 – Add Springdoc OpenAPI MCP (Model Context Protocol) support
• #​3256 – Auto-set nullable: true for Kotlin nullable types in schema properties
• #​3239 – Add support for the @Range constraint validation annotation
• #​3244 – Handle default values for LocalDate

Changed

• Upgrade Spring Boot to version 4.0.5
• Upgrade swagger-core to version 2.2.47
• Upgrade swagger-ui to version 5.32.2
• #​3260 – @ConditionalOnClass(HateoasProperties.class) in SpringDocHateoasConfiguration
• Forwards all MCP non-transport headers to downstream methods
• Dynamically resolve the base path from window.location.pathname for MCP UI

Fixed

• #​3258 – Setting API Version Required when using WebFlux breaks the Swagger UI
• #​3259 – Annotated Generic properties getting applied to sibling properties
• #​3255 – Direction enum: fixed visibility scope of group order so that setGroupsOrder method can be used
• #​3247 – Preserve YAML group URLs in Swagger UI
• #​3245 – Upgrade swagger-core from version 2.2.43 to 2.2.45
• #​3235 – PropertyResolverUtils retains a JsonNode when reading an ExtensionProperty annotation
• #​3226 – Propagate JsonView context when resolving Page<T> schema

v3.0.2

Compare Source

Added

• #​3229 – Add support for Spring Framework API Versioning with Functional Endpoints
• #​3208 – Add springdoc.swagger-ui.document-title property

Changed

• Upgrade Spring Boot to version 4.0.3
• Upgrade swagger-core to version 2.2.43
• Upgrade swagger-ui to version 5.32.0
• Upgrade Scalar to version 0.5.55

Fixed

• #​3232 – Gracefully handle springdoc endpoint paths during API version resolution
• #​3230 – Scalar source URLs resolve to null/<groupName> on second request when using GroupedOpenApi
• #​3228 – springdoc-openapi-starter 3.x doesn't depend on org.springframework.boot:spring-boot-starter
• #​3220 – Reachability metadata not compatible with GraalVM 25
• #​3195 – Application won't compile when OpenApi and spring-boot-data-rest is present
• #​3193 – OpenApi field in SpringDocConfigProperties does not comply with camel case naming conventions
• #​3215 – Type annotation not considered when Kotlin is not present
• #​3199 – Prevent duplicate _links in allOf child schemas
• #​3198 – Property resolution for parameter default values
• #​3206 – Upgrade swagger-core from version 2.2.41 to 2.2.42

v3.0.1

Compare Source

Added

• #​3122 – Add log notifications when SpringDocs / Scalar are enabled by default
• #​3123 – Add support for serving static resources
• #​3151 – Add @Order to ApplicationReadyEvent listener
• #​3158 – Add support for API groups in Scalar
• #​3187 – Add Scalar WebMVC and WebFlux support
• #​3185 – Disable creation of blank GitHub issues (GitHub settings & workflow)
• #​3186 – Decouple Web Server APIs following Spring Boot modularization
• #​3131 – Improve warning messages when documentation is explicitly enabled
• #​3183 – Remove unused operations consumer from route builder methods
• #​3141 – Change handling so useReturnTypeSchema is evaluated at HTTP status code level instead of method level

Changed

• Upgrade Spring Boot to version 4.0.1
• Upgrade swagger-core to version 2.2.41
• Upgrade swagger-ui to version 5.31.0
• Upgrade Scalar to version 0.4.3

Fixed

• #​3133 – Fix regression where content type from Swagger @RequestBody did not take precedence
• #​3146 – Fix WebJar resource handler mappings for Swagger UI resources
• #​3168 – Support @Schema annotations on Kotlin value classes
• #​3178 – Fix regression when generating documentation for Kotlin LinkedHashSet
• #​3170 – Fix warnings when setting title and description in application.yml
• #​3173 – Fix /v3/api-docs returning Base64-encoded response with Spring Framework 7.0.2
• #​3155 – Fix native image support regression with SpringDoc 3.0 and Spring Boot 4.0

v3.0.0

Compare Source

Added

• #​2975 - Spring Framework 7 - Initial API versioning support
• #​3123 - Support static resources for webflux

Changed

• Upgrade to Spring Boot 4.0.0
• Upgrade to Scalar 0.4.3

Fixed

• #​3131 - Warning messages when docs are explicitly enabled
• #​3121 - NPE in KotlinDeprecatedPropertyCustomizer - resolvedSchema is null

v2.10.0: springdoc-openapi v2.10.0 released!

Compare Source

Spring Boot 3.5.x line (built on Spring Boot 3.5.16).

⚠️ Changes you may notice

• Newly required properties (#​3360, #​3361): the PagedModel / PageMetadata properties and the amount / currency properties of MonetaryAmount are now marked as required, as they are always serialized. Generated clients will see them as non-nullable.
• Scalar 0.6 (#​3359): upgraded to 0.6.83. The first tag is now open by default, and model links changed from #model/name to #models/Name.
• Scalar's standalone integration (#​3387): with the Swagger UI or API-only starters, Scalar's own auto-configuration is no longer disabled by springdoc. If you have com.scalar.maven on the classpath and don't want it, set scalar.enabled=false.

New

• Opt-in nullability for Java models (#​3382): springdoc.model-converters.java-nullable-property-customizer.enabled=true marks properties annotated with @Nullable (JSpecify, Spring, JSR-305) as nullable, including $ref and oneOf properties, without changing shared components.
• Polymorphic oneOf as reusable components (#​3390): springdoc.model-converters.polymorphic-converter.one-of-as-ref=true, with the name suffix set by springdoc.model-converters.polymorphic-converter.one-of-ref-suffix (Variant by default).
• ParameterCustomizer can read type-use annotations, including inside Optional<@MyAnnotation Foo> (#​3370).

Fixed

• @ResponseStatus on a controller class is applied to its operations (#​3352).
• An injected WebSession is no longer documented as a query parameter in WebFlux (#​3355).
• The application no longer fails to start with Spring HATEOAS on the classpath but no LinkRelationProvider bean (#​3364).
• WebAsyncTask return types are unwrapped (#​3368).
• A JSpecify @Nullable on a controller parameter makes its schema nullable (#​3377).
• Nullable Kotlin properties described by a oneOf (e.g. sealed classes) are documented as nullable (#​3381).
• Gradle builds no longer lift Jackson 2 above the version managed by Spring Boot (#​3373).

Dependencies

swagger-ui 5.34.0 · Scalar 0.6.83 · Spring Cloud Function 4.2.4 · commons-lang3 3.21.0

Thanks to all the contributors of this release: @​MaxFreedomPollard, @​kdelay, @​dpkass, @​anupamchaubey, @​Mattias-Sehlstedt, @​Naresh7175, @​ys0v9, @​sharanggupta, @​itd-sw, @​Tework123, @​awinishere.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud