5.0.5

Security

• CVE-2026-47836 — Spring Cloud Config Server Susceptible To TOCTOU Attack When Using SVN
• CVE-2026-47837 — Spring Cloud Config Server Monitor Endpoint Does Not Validate Webhook Requests
• CVE-2026-47894 — Spring Cloud Config Server Native Environment Repository Exposure
• CVE-2026-59315 — Spring Cloud Config Monitor Denial of Service

What's Changed

• docs: document .json alternative format endpoint and add URL pattern table by @won-seoop in #3245
• GH-572: Document Config Server behavior when Git backend is unavailable by @won-seoop in #3251
• docs: expand Config Server security guide by @won-seoop in #3247
• Expand embedded server docs with standalone vs embedded trade-offs (GH-1203) by @won-seoop in #3249
• Document sharing configuration across a subset of applications (GH-618) by @won-seoop in #3250
• Support Git-style searchPaths with wildcards in AWS S3 buckets (#2812) by @tomy8964 in #2958
• Bump antora from 3.2.0-alpha.12 to 3.2.0-rc.2 in /docs by @dependabot[bot] in #3255
• Bump actions/checkout from 6 to 7 by @dependabot[bot] in #3253
• Fix native file monitor relative URI handling by @hutiefang76 in #3258
• Bump actions/setup-java from 5.4.0 to 5.5.0 by @dependabot[bot] in #3259
• Ignore release train workflow files in Dependabot by @ryanjbaxter in #3263
• Bump org.apache.maven.plugins:maven-jar-plugin from 3.5.0 to 3.5.1 by @dependabot[bot] in #3264
• Bump @springio/antora-extensions from 1.14.12 to 1.14.13 in /docs by @dependabot[bot] in #3268
• Use '=' instead in encryption-and-decryption.adoc and server.adoc by @ngocnhan-tran1996 in #3269

New Contributors

• @won-seoop made their first contribution in #3245
• @tomy8964 made their first contribution in #2958
• @hutiefang76 made their first contribution in #3258

Full Changelog: v5.0.4...v5.0.5