springdoc-openapi Files

Security

• GHSA-rhhx-6j8h-8cvw – Unbounded per-locale OpenAPI cache allows memory exhaustion via Accept-Language
• GHSA-c925-vm88-mpp9 – Scalar starters trust client-supplied forwarded headers and render from a shared mutable bean
• CVE-2026-75838 – Cross-site scripting in the DOMPurify bundled with swagger-ui, addressed by upgrading swagger-ui to 5.32.14

Added

• [#3340] – Describe JsonNullable values without their Java wrapper
• [#3325] – Manage the swagger artifacts in springdoc-openapi-bom, so that modules holding only the annotations stay in lockstep
• [#3321] – Add springdoc.login-endpoint.username-example and springdoc.login-endpoint.password-example to document the Spring Security login endpoint

Changed

• The Scalar starters no longer register forwarded-header handling. Set server.forward-headers-strategy=framework (or native) behind a trusted proxy
• Add springdoc.cache.max-entries (default 100) to bound the per-locale OpenAPI cache
• Document the security policy and the release versioning scheme
• [#3351] – java.time.Duration, LocalTime and OffsetTime are now resolved by swagger-core instead of being forced to a bare string, so they carry a format (duration and partial-time respectively for the first two)
• A property whose type only implements Set indirectly (LinkedHashSet, TreeSet, …) is now described with uniqueItems: true, following [swagger-api/swagger-core#5265](https://github.com/swagger-api/swagger-core/issues/5265)
• Upgrade swagger-core to version 2.2.55
• Upgrade swagger-ui to version 5.32.14

Fixed

• [#3320] – @Order and Ordered ignored when applying customizers
• [#3319] – A Page nested in another schema is not replaced by PagedModel
• [#3313] – Springdoc auto-configurations rely on unspecified auto-configuration ordering
• [#3331] – Validation annotations declared inside Optional parameters are dropped
• [#3322] – Validation annotations on a container's type argument leak between parameters
• [#3315] – An OAS 3.1 JsonSchema cannot be cloned through JSON
• [#3314] – Json Processing Exception occurred is logged for every constrained parameter whose schema is not a JsonSchema
• [#3300] – TYPE_USE annotations on @ParameterObject fields are not passed along
• [#3341] – Stabilize Spring Data Sort and Pageable schema property order
• [#3338] – Kotlin nullability interpretation of the Any? type
• [#3332] – The properties a Kotlin entity inherits from an @Embeddable are missing from the Spring Data REST schemas
• [#3136] – A Spring Data REST association to a non-exported entity expands its @EmbeddedId and @MapsId fields recursively in the response schemas
• The Spring Data REST response post-processing rewrote an association property in place, so the …Response refs could leak into the schema shared with the request body representation
• [#3317] – Ignore an injected HttpHeaders parameter explicitly. The reported failure needs Spring Framework 7, where HttpHeaders stopped implementing MultiValueMap; on this line it is still covered by the Map entry of the ignore list, so this is regression cover rather than a behaviour change
• Harden the Spring Data REST response post-processing against an _embedded schema that carries no properties

Full Changelog: https://github.com/springdoc/springdoc-openapi/compare/v2.9.0...v2.9.1