Thymeleaf issue when upgrading to spring boot 3.5.14

[lheiniger]

Spring Boot Admin Server information

• Version: 3.5.8

• Spring Boot version: 3.5.14

• Webflux or Servlet application: servlet

Description

When i upgraded my spring boot app from 3.5.13 to 3.5.14, i get an HTTP 500 when the app tries to load variables.css

After dowgrading thymeleaf, the error disappears :

    <thymeleaf.version>3.1.3.RELEASE</thymeleaf.version>
    <thymeleaf-extras-data-attribute.version>2.0.1</thymeleaf-extras-data-attribute.version>
    <thymeleaf-extras-springsecurity.version>3.1.3.RELEASE</thymeleaf-extras-springsecurity.version>
    <thymeleaf-layout-dialect.version>3.4.0</thymeleaf-layout-dialect.version>

The error in my log is :

    org.thymeleaf.TemplateEngine             : [THYMELEAF][http-nio-8080-exec-4] Exception processing template "variables.css": Instantiation of new objects and access to static classes or parameters is forbidden in this context (template: "variables.css" - line 2, col 18)
    
    org.thymeleaf.exceptions.TemplateProcessingException: Instantiation of new objects and access to static classes or parameters is forbidden in this context (template: "variables.css" - line 2, col 18)
        at org.thymeleaf.spring6.expression.SPELVariableExpressionEvaluator.obtainComputedSpelExpression(SPELVariableExpressionEvaluator.java:319)
        at org.thymeleaf.spring6.expression.SPELVariableExpressionEvaluator.evaluate(SPELVariableExpressionEvaluator.java:159)
        at org.thymeleaf.standard.expression.VariableExpression.executeVariableExpression(VariableExpression.java:166)
        at org.thymeleaf.standard.expression.SimpleExpression.executeSimple(SimpleExpression.java:66)
        at org.thymeleaf.standard.expression.Expression.execute(Expression.java:109)
        at org.thymeleaf.standard.expression.Expression.execute(Expression.java:138)
        at org.thymeleaf.standard.processor.StandardUtextTagProcessor.doProcess(StandardUtextTagProcessor.java:87)
        at org.thymeleaf.processor.element.AbstractAttributeTagProcessor.doProcess(AbstractAttributeTagProcessor.java:74)
        at org.thymeleaf.processor.element.AbstractElementTagProcessor.process(AbstractElementTagProcessor.java:95)
        at org.thymeleaf.util.ProcessorConfigurationUtils$ElementTagProcessorWrapper.process(ProcessorConfigurationUtils.java:633)
        at org.thymeleaf.engine.ProcessorTemplateHandler.handleOpenElement(ProcessorTemplateHandler.java:1314)
        at org.thymeleaf.engine.OpenElementTag.beHandled(OpenElementTag.java:205)
        at org.thymeleaf.engine.TemplateModel.process(TemplateModel.java:136)
        at org.thymeleaf.engine.TemplateManager.parseAndProcess(TemplateManager.java:661)
        at org.thymeleaf.TemplateEngine.process(TemplateEngine.java:1103)
        at org.thymeleaf.TemplateEngine.process(TemplateEngine.java:1077)
        at org.thymeleaf.spring6.view.ThymeleafView.renderFragment(ThymeleafView.java:374)
        at org.thymeleaf.spring6.view.ThymeleafView.render(ThymeleafView.java:193)
        at org.springframework.web.servlet.DispatcherServlet.render(DispatcherServlet.java:1438)
        at org.springframework.web.servlet.DispatcherServlet.processDispatchResult(DispatcherServlet.java:1168)
        at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:1106)
        at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:979)
        at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:1014)
        at org.springframework.web.servlet.FrameworkServlet.doGet(FrameworkServlet.java:903)
        at jakarta.servlet.http.HttpServlet.service(HttpServlet.java:564)

[lheiniger]

i just saw you fixed this in master : #5285

I cannot upgrade to spring boot 4 yet, do you plan to fix this in 3.5.x ?

[SteKoe]

Hi @lheiniger,

I guess we will create another 3.5.x release.

[lheiniger]

@SteKoe : No real time pressure on my side since i can just downgrade thymeleaf, but that would be great, thanks :)

[cdprete]

There is more. Thymeleaf 3.1.5 which comes with Spring Boot 4.0.6 did it again 😮‍💨
A fix is available in #5322

[bytecoder-byte]

@SteKoe : We are experiencing the same issue after migrating the boot to 3.5.14. Is there a plan to release the fixes in another 3.5.x version soon? We are unable to migrate to Boot 4.x at this time and would greatly appreciate it if the fix could be pushed to the 3.5.x version.