Update spring-cloud-config

[spring-cloud-config-server-auto]

This PR contains the following updates:

Package	Change	Age	Confidence
org.springframework.cloud:spring-cloud-config-server (source)	5.0.4 → 5.0.5
org.springframework.cloud:spring-cloud-config-monitor (source)	5.0.4 → 5.0.5
org.springframework.cloud:spring-cloud-dependencies (source)	2025.1.2 → 2025.1.3
org.springframework.boot	4.0.5 → 4.1.1

---

Release Notes

spring-cloud/spring-cloud-config (org.springframework.cloud:spring-cloud-config-server)

v5.0.5: 5.0.5

Security

• CVE-2026-47836 — Spring Cloud Config Server Susceptible To TOCTOU Attack When Using SVN
• CVE-2026-47837 — Spring Cloud Config Server Monitor Endpoint Does Not Validate Webhook Requests
• CVE-2026-47894 — Spring Cloud Config Server Native Environment Repository Exposure
• CVE-2026-59315 — Spring Cloud Config Monitor Denial of Service

What's Changed

• docs: document .json alternative format endpoint and add URL pattern table by @​won-seoop in #​3245
• GH-572: Document Config Server behavior when Git backend is unavailable by @​won-seoop in #​3251
• docs: expand Config Server security guide by @​won-seoop in #​3247
• Expand embedded server docs with standalone vs embedded trade-offs (GH-1203) by @​won-seoop in #​3249
• Document sharing configuration across a subset of applications (GH-618) by @​won-seoop in #​3250
• Support Git-style searchPaths with wildcards in AWS S3 buckets (#​2812) by @​tomy8964 in #​2958
• Bump antora from 3.2.0-alpha.12 to 3.2.0-rc.2 in /docs by @​dependabot[bot] in #​3255
• Bump actions/checkout from 6 to 7 by @​dependabot[bot] in #​3253
• Fix native file monitor relative URI handling by @​hutiefang76 in #​3258
• Bump actions/setup-java from 5.4.0 to 5.5.0 by @​dependabot[bot] in #​3259
• Ignore release train workflow files in Dependabot by @​ryanjbaxter in #​3263
• Bump org.apache.maven.plugins:maven-jar-plugin from 3.5.0 to 3.5.1 by @​dependabot[bot] in #​3264
• Bump @​springio/antora-extensions from 1.14.12 to 1.14.13 in /docs by @​dependabot[bot] in #​3268
• Use '=' instead in encryption-and-decryption.adoc and server.adoc by @​ngocnhan-tran1996 in #​3269

New Contributors

• @​won-seoop made their first contribution in #​3245
• @​tomy8964 made their first contribution in #​2958
• @​hutiefang76 made their first contribution in #​3258

Full Changelog: spring-cloud/spring-cloud-config@v5.0.4...v5.0.5

spring-cloud/spring-cloud-release (org.springframework.cloud:spring-cloud-dependencies)

v2025.1.3

Security

This release train contains fixes for 17 CVEs across 5 modules.

Spring Cloud Commons 5.0.3

• CVE-2026-59284 — Spring Cloud Commons no allow list for writable env actuator endpoint

Spring Cloud Config 5.0.5

• CVE-2026-47836 — Spring Cloud Config Server Susceptible To TOCTOU Attack When Using SVN
• CVE-2026-47837 — Spring Cloud Config Server Monitor Endpoint Does Not Validate Webhook Requests
• CVE-2026-47894 — Spring Cloud Config Server Native Environment Repository Exposure
• CVE-2026-59315 — Spring Cloud Config Monitor Denial of Service

Spring Cloud Function 5.0.4

• CVE-2026-59291 — Potential arbitrary file read and SSRF vulnerability in Spring Cloud Function
• CVE-2026-59297 — Spring Cloud Function can incorrectly determine if URI is secure
• CVE-2026-59298 — Potential for improper filtering of HTTP headers in Spring Cloud Function
• CVE-2026-59299 — Composition lookup can potentially poison base function in Spring Cloud Function
• CVE-2026-59300 — Potential for logging sensitive data in Spring Cloud Function AWS
• CVE-2026-59301 — Potential for logging sensitive data in Spring Cloud Function Azure

Spring Cloud Gateway 5.0.3

• CVE-2026-47879 — Spring Cloud Gateway SSRF and native file access with gRPC

Spring Cloud Stream 5.0.3

• CVE-2026-59302 — Potential for logging sensitive data in Spring Cloud Stream
• CVE-2026-59303 — Dynamic destination cache size is not properly bound in Spring Cloud Stream
• CVE-2026-59304 — Improper caching of the original content type in Spring Cloud Stream Avro
• CVE-2026-59305 — Partition interceptor may be improperly added while sending message
• CVE-2026-59306 — Potential for deserialization of untrusted types in Spring Cloud Stream

What's Included

• Spring Cloud Build 5.0.3 (issues)
• Spring Cloud Function 5.0.4 (issues)
• Spring Cloud Stream 5.0.3 (issues)
• Spring Cloud Commons 5.0.3 (issues)
• Spring Cloud Bus 5.0.3 (issues)
• Spring Cloud Task 5.0.2 (issues)
• Spring Cloud Config 5.0.5 (issues)
• Spring Cloud Netflix 5.0.2 (issues)
• Spring Cloud Openfeign 5.0.3 (issues)
• Spring Cloud Consul 5.0.3 (issues)
• Spring Cloud Circuitbreaker 5.0.3 (issues)
• Spring Cloud Gateway 5.0.3 (issues)
• Spring Cloud Zookeeper 5.0.2 (issues)
• Spring Cloud Kubernetes 5.0.3 (issues)
• Spring Cloud Vault 5.0.2 (issues)

What's Changed

• Bump com.github.jknack:handlebars from 4.5.1 to 4.5.2 by @​dependabot[bot] in #​520
• Bump com.github.jknack:handlebars from 4.5.1 to 4.5.2 by @​dependabot[bot] in #​521
• Bump actions/checkout from 6 to 7 by @​dependabot[bot] in #​522
• Bump antora from 3.2.0-alpha.12 to 3.2.0-rc.2 in /docs by @​dependabot[bot] in #​524
• Bump com.github.jknack:handlebars from 4.5.2 to 4.5.3 by @​dependabot[bot] in #​528
• Bump com.github.jknack:handlebars from 4.5.2 to 4.5.3 by @​dependabot[bot] in #​527
• Bump com.github.jknack:handlebars from 4.5.3 to 4.5.4 by @​dependabot[bot] in #​533
• Bump com.github.jknack:handlebars from 4.5.3 to 4.5.4 by @​dependabot[bot] in #​532
• Bump @​springio/antora-extensions from 1.14.12 to 1.14.13 in /docs by @​dependabot[bot] in #​534

Full Changelog: spring-cloud/spring-cloud-release@v2025.1.2...v2025.1.3

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[spring-cloud-config-server-auto]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.