下个版本，spring-core版本能升级下吗？5.x官方不维护了，并且还有高危漏洞，谢谢

[jaimyjie]

Search before asking

• I searched in the issues and found nothing similar.

Motivation

下个版本，spring-core版本能升级下吗？5.x官方不维护了，并且还有高危漏洞，谢谢

Solution

No response

Alternatives

No response

Anything else?

No response

Are you willing to submit a PR?

• I'm willing to submit a PR!

[bengbengbalabalabeng]

According to the official CVE description, CVE‑2025‑41249 is only triggered under the following conditions:

• Spring performs annotation detection on methods inherited from parameterized superclasses or interfaces with unbounded generics
• And the application relies on these annotations for method‑level authorization (e.g., @EnableMethodSecurity, @PreAuthorize, etc.)

The fesod project does not use Spring Security and does not rely on Spring’s method‑level security annotations. The fesod-shaded module only includes the ASM/CGLIB utility classes from spring-core and does not contain annotation‑processing or security‑related code. Therefore, the vulnerable code paths are never invoked, and the conditions required to trigger this vulnerability do not exist in this project.

So this vulnerability does not affect this project.

[delei]

Currently, spring-core is not a dependency of fesod.