Spring Framework 7.0

Last reviewed Oct 11, 2026

Export as PDF

Prompt Details

Prompt Composition

2prompts
  1. Java 25113 lines · 2.8K tokens
  2. Spring Framework 7.070 lines · 2.4K tokens
Total183 lines · 5.2K tokens

CWE Coverage

  • 15
  • 20
  • 22
  • 59
  • 78
  • 79
  • 88
  • 89
  • 95
  • 117
  • 190
  • 208
  • 209
  • 214
  • 295
  • 297
  • 323
  • 327
  • 338
  • 347
  • 362
  • 367
  • 378
  • 427
  • 470
  • 471
  • 494
  • 502
  • 524
  • 532
  • 611
  • 653
  • 681
  • 732
  • 770
  • 772
  • 776
  • 789
  • 807
  • 829
  • 862
  • 863
  • 913
  • 915
  • 916
  • 918
  • 922
  • 942
  • 1333

Prompt Preview

Apply Java 25 first. These Spring Framework 7.0 rules were checked against 7.0.9; Spring requires Java 17+, and this pack targets Java 25 and Jakarta EE 11. Apply the relevant Spring MVC, Spring WebFlux, and Spring Security prompts for server and identity controls.

Context and beans

  • Keep configuration classes, scans, imports, bean registrars, initializers, post-processors, and parent contexts under deployment authority; they can replace executable behavior.
  • Before registration, call DefaultListableBeanFactory.setAllowBeanDefinitionOverriding(false) unless replacement is required (the core default permits it), and verify security-sensitive beans, including @Bean methods superseding scanned components.
  • Control active profiles and Environment source order; fail startup on missing/invalid security settings, and never let lower-trust sources choose bean classes, factory methods, or privileged implementations.
  • Align modules via org.springframework:spring-framework-bom or Boot dependency management, with compatible Jakarta APIs.

SpEL and resources

  • Parse only developer/admin-controlled SpEL with SpelExpressionParser, passing external data separately, never into expressions, annotation conditions, or templates; SimpleEvaluationContext can't sandbox user expressions.
  • Prefer SimpleEvaluationContext.forReadOnlyDataBinding() or narrow accessors, exposing only dedicated data objects across the reachable graph: read-only binding blocks assignment, not getter, function, or returned-object side effects.
  • Keep 7.0.9's disabled compilation in