Bump org.springdoc:springdoc-openapi-starter-webmvc-ui from 3.0.3 to 3.1.1

[dependabot]

Bumps org.springdoc:springdoc-openapi-starter-webmvc-ui from 3.0.3 to 3.1.1.

Release notes

Sourced from org.springdoc:springdoc-openapi-starter-webmvc-ui's releases.

springdoc-openapi v3.1.1 released!

Security

• GHSA-6f5m-mhjg-qwxq – MCP tool callbacks do not encode path parameters, allowing request retargeting
• GHSA-4v2q-56v7-2cpw – MCP transport, admin and dashboard endpoints are exposed by default
• GHSA-m4cg-mhpg-rh2r – MCP audit events record credentials and request/response bodies without redaction
• GHSA-5f9r-4mc4-qh3c – Unbounded MCP pending-confirmation store allows memory exhaustion
• GHSA-jcgg-59c8-w4wh – MCP request context in a ThreadLocal can leak headers between concurrent WebFlux requests
• GHSA-rhhx-6j8h-8cvw – Unbounded per-locale OpenAPI cache allows memory exhaustion via Accept-Language
• GHSA-c925-vm88-mpp9 – Scalar starters trust client-supplied forwarded headers and render from a shared mutable bean
• CVE-2026-75838 – Cross-site scripting in the DOMPurify bundled with swagger-ui, addressed by upgrading swagger-ui to 5.32.14

Added

• #3340 – Describe JsonNullable values without their Java wrapper
• #3325 – Manage the swagger artifacts in springdoc-openapi-bom, so that modules holding only the annotations stay in lockstep
• #3321 – Add springdoc.login-endpoint.username-example and springdoc.login-endpoint.password-example to document the Spring Security login endpoint

Changed

• MCP is now opt-in. Set springdoc.ai.mcp.enabled=true, and springdoc.ai.mcp.dashboard-enabled=true for the dashboard
• The Scalar starters no longer register forwarded-header handling. Set server.forward-headers-strategy=framework (or native) behind a trusted proxy
• Add springdoc.cache.max-entries (default 100) to bound the per-locale OpenAPI cache
• Add springdoc.ai.mcp.audit.redact (default true) to mask secrets in MCP audit events
• Document that the MCP approval flow is a confirmation step, not an authorization control
• Document the security policy and the release versioning scheme
• #3351 – java.time.Duration, LocalTime and OffsetTime are now resolved by swagger-core instead of being forced to a bare string, so they carry a format (duration and partial-time respectively for the first two)
• A property whose type only implements Set indirectly (LinkedHashSet, TreeSet, …) is now described with uniqueItems: true, following swagger-api/swagger-core#5265
• Upgrade swagger-core to version 2.2.55
• Upgrade swagger-ui to version 5.32.14

Fixed

• #3328, #3337 – /v3/api-docs fails with a NullPointerException when spring-hateoas is on the classpath without HateoasProperties
• #3314 – Json Processing Exception occurred is logged for every constrained parameter whose schema is not a JsonSchema
• #3317 – An injected HttpHeaders parameter is described as a schema
• #3332 – The properties a Kotlin entity inherits from an @Embeddable are missing from the Spring Data REST schemas
• #3320 – @Order and Ordered ignored when applying customizers
• #3319 – A Page nested in another schema is not replaced by PagedModel
• #3313 – Springdoc auto-configurations rely on unspecified auto-configuration ordering
• #3331 – Validation annotations declared inside Optional parameters are dropped
• #3322 – Validation annotations on a container's type argument leak between parameters
• #3315 – An OAS 3.1 JsonSchema cannot be cloned through JSON
• #3300 – TYPE_USE annotations on @ParameterObject fields are not passed along
• #3341 – Stabilize Spring Data Sort and Pageable schema property order
• #3338 – Kotlin nullability interpretation of the Any? type
• #3136 – A Spring Data REST association to a non-exported entity expands its @EmbeddedId and @MapsId fields recursively in the response schemas
• The Spring Data REST response post-processing rewrote an association property in place, so the …Response refs could leak into the schema shared with the request body representation

New Contributors

... (truncated)

Changelog

Sourced from org.springdoc:springdoc-openapi-starter-webmvc-ui's changelog.

[3.1.1] - 2026-09-06

Security

• GHSA-6f5m-mhjg-qwxq – MCP tool callbacks do not encode path parameters, allowing request retargeting
• GHSA-4v2q-56v7-2cpw – MCP transport, admin and dashboard endpoints are exposed by default
• GHSA-m4cg-mhpg-rh2r – MCP audit events record credentials and request/response bodies without redaction
• GHSA-5f9r-4mc4-qh3c – Unbounded MCP pending-confirmation store allows memory exhaustion
• GHSA-jcgg-59c8-w4wh – MCP request context in a ThreadLocal can leak headers between concurrent WebFlux requests
• GHSA-rhhx-6j8h-8cvw – Unbounded per-locale OpenAPI cache allows memory exhaustion via Accept-Language
• GHSA-c925-vm88-mpp9 – Scalar starters trust client-supplied forwarded headers and render from a shared mutable bean
• CVE-2026-75838 – Cross-site scripting in the DOMPurify bundled with swagger-ui, addressed by upgrading swagger-ui to 5.32.14

Added

• #3340 – Describe JsonNullable values without their Java wrapper
• #3325 – Manage the swagger artifacts in springdoc-openapi-bom, so that modules holding only the annotations stay in lockstep
• #3321 – Add springdoc.login-endpoint.username-example and springdoc.login-endpoint.password-example to document the Spring Security login endpoint

Changed

• MCP is now opt-in. Set springdoc.ai.mcp.enabled=true, and springdoc.ai.mcp.dashboard-enabled=true for the dashboard
• The Scalar starters no longer register forwarded-header handling. Set server.forward-headers-strategy=framework (or native) behind a trusted proxy
• Add springdoc.cache.max-entries (default 100) to bound the per-locale OpenAPI cache
• Add springdoc.ai.mcp.audit.redact (default true) to mask secrets in MCP audit events
• Document that the MCP approval flow is a confirmation step, not an authorization control
• Document the security policy and the release versioning scheme
• #3351 – java.time.Duration, LocalTime and OffsetTime are now resolved by swagger-core instead of being forced to a bare string, so they carry a format (duration and partial-time respectively for the first two)
• A property whose type only implements Set indirectly (LinkedHashSet, TreeSet, …) is now described with uniqueItems: true, following swagger-api/swagger-core#5265
• Upgrade swagger-core to version 2.2.55
• Upgrade swagger-ui to version 5.32.14

Fixed

• #3328, #3337 – /v3/api-docs fails with a NullPointerException when spring-hateoas is on the classpath without HateoasProperties
• #3314 – Json Processing Exception occurred is logged for every constrained parameter whose schema is not a JsonSchema
• #3317 – An injected HttpHeaders parameter is described as a schema
• #3332 – The properties a Kotlin entity inherits from an @Embeddable are missing from the Spring Data REST schemas
• #3320 – @Order and Ordered ignored when applying customizers
• #3319 – A Page nested in another schema is not replaced by PagedModel
• #3313 – Springdoc auto-configurations rely on unspecified auto-configuration ordering
• #3331 – Validation annotations declared inside Optional parameters are dropped
• #3322 – Validation annotations on a container's type argument leak between parameters
• #3315 – An OAS 3.1 JsonSchema cannot be cloned through JSON
• #3300 – TYPE_USE annotations on @ParameterObject fields are not passed along
• #3341 – Stabilize Spring Data Sort and Pageable schema property order
• #3338 – Kotlin nullability interpretation of the Any? type
• #3136 – A Spring Data REST association to a non-exported entity expands its @EmbeddedId and @MapsId fields recursively in the response schemas
• The Spring Data REST response post-processing rewrote an association property in place, so the …Response refs could leak into the schema shared with the request body representation

... (truncated)

Commits

• 1cc87a7 [maven-release-plugin] prepare release v3.1.1
• 4e8ac26 docs: record the swagger-ui 5.32.14 upgrade as a security fix for 3.1.1
• 958c79a Merge swagger-core 2.2.55 upgrade
• cf7d7c7 Upgrade swagger-core to 2.2.55
• 186adb3 Record the swagger-core 2.2.54 upgrade in the changelog
• 2498ffb Merge pull request #3351 from Mattias-Sehlstedt/update-swagger-core
• d78abd9 upgrade swagger-core from 2.2.53 to 2.2.54
• 9f7f099 Rewrite a copy of a Spring Data REST association property
• f47060e Record #3321 in the changelog and align the buildRequestBody indent
• ccb2fc0 Merge pull request #3323 from Mattias-Sehlstedt/feature/3321-login-example-va...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)