Visit NES for Spring Home Page
Spring Data REST 4.5.x Release Notes
2 versions
Comprehensive release notes and changelog for Spring Data REST 4.5.x, including security patches, bug fixes, and feature updates across all supported versions.
August 2026
4.5.15
Released Aug 28, 2026 Full Version:
4.5.13-spring-data-rest-4.5.15
Security Fixes
- An immutable aggregate PUT body can no longer replace persisted identifier and version values in
DomainObjectReader.readPut, so optimistic-lock checks can no longer be bypassed (medium severity, CVE-2026-47850). - JSON Patch write pointers can no longer target identifier or version properties, which
MappedPropertiesnow reports as non-writable, so authenticated clients can no longer overwrite persistence metadata (high severity, CVE-2026-47849).
Dependency Upgrades
- Spring Data Build (NES)
3.5.13-spring-data-build-3.5.15 - Spring Data Commons (NES)
3.5.13-spring-data-commons-3.5.15 - Spring Data JPA (NES)
3.5.13-spring-data-jpa-3.5.15 - Spring Data KeyValue (NES)
3.5.13-spring-data-keyvalue-3.5.15 - Spring Data MongoDB (NES)
4.5.13-spring-data-mongodb-4.5.15
July 2026
4.5.14
Released Jul 9, 2026 Full Version:
4.5.13-spring-data-rest-4.5.14
Notes
- This release originates from the open‑source Spring Data REST repository forked by HeroDevs. It encompasses modifications implemented by HeroDevs to ensure successful framework builds. This release contains no functional changes from Spring Data REST
4.5.13.
Dependency Upgrades
- Spring Data Build (NES)
3.5.13-spring-data-build-3.5.14 - Spring Data Commons (NES)
3.5.13-spring-data-commons-3.5.14 - Spring Data JPA (NES)
3.5.13-spring-data-jpa-3.5.14 - Spring Data KeyValue (NES)
3.5.13-spring-data-keyvalue-3.5.14 - Spring Data MongoDB (NES)
4.5.13-spring-data-mongodb-4.5.14
Stay in the loop
~/herodevs-spring-framework-support
herodevs@nes:open-source$ ./display-support-info.sh