fix(deps): update dependency org.springdoc:springdoc-openapi-starter-webmvc-ui to v3

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
org.springdoc:springdoc-openapi-starter-webmvc-ui (source)	2.9.1 → 3.1.1

---

Release Notes

springdoc/springdoc-openapi (org.springdoc:springdoc-openapi-starter-webmvc-ui)

v3.1.1

Security

• GHSA-6f5m-mhjg-qwxq – MCP tool callbacks do not encode path parameters, allowing request retargeting
• GHSA-4v2q-56v7-2cpw – MCP transport, admin and dashboard endpoints are exposed by default
• GHSA-m4cg-mhpg-rh2r – MCP audit events record credentials and request/response bodies without redaction
• GHSA-5f9r-4mc4-qh3c – Unbounded MCP pending-confirmation store allows memory exhaustion
• GHSA-jcgg-59c8-w4wh – MCP request context in a ThreadLocal can leak headers between concurrent WebFlux requests
• GHSA-rhhx-6j8h-8cvw – Unbounded per-locale OpenAPI cache allows memory exhaustion via Accept-Language
• GHSA-c925-vm88-mpp9 – Scalar starters trust client-supplied forwarded headers and render from a shared mutable bean
• CVE-2026-75838 – Cross-site scripting in the DOMPurify bundled with swagger-ui, addressed by upgrading swagger-ui to 5.32.14

Added

• #​3340 – Describe JsonNullable values without their Java wrapper
• #​3325 – Manage the swagger artifacts in springdoc-openapi-bom, so that modules holding only the annotations stay in lockstep
• #​3321 – Add springdoc.login-endpoint.username-example and springdoc.login-endpoint.password-example to document the Spring Security login endpoint

Changed

• MCP is now opt-in. Set springdoc.ai.mcp.enabled=true, and springdoc.ai.mcp.dashboard-enabled=true for the dashboard
• The Scalar starters no longer register forwarded-header handling. Set server.forward-headers-strategy=framework (or native) behind a trusted proxy
• Add springdoc.cache.max-entries (default 100) to bound the per-locale OpenAPI cache
• Add springdoc.ai.mcp.audit.redact (default true) to mask secrets in MCP audit events
• Document that the MCP approval flow is a confirmation step, not an authorization control
• Document the security policy and the release versioning scheme
• #​3351 – java.time.Duration, LocalTime and OffsetTime are now resolved by swagger-core instead of being forced to a bare string, so they carry a format (duration and partial-time respectively for the first two)
• A property whose type only implements Set indirectly (LinkedHashSet, TreeSet, …) is now described with uniqueItems: true, following swagger-api/swagger-core#5265
• Upgrade swagger-core to version 2.2.55
• Upgrade swagger-ui to version 5.32.14

Fixed

• #​3328, #​3337 – /v3/api-docs fails with a NullPointerException when spring-hateoas is on the classpath without HateoasProperties
• #​3314 – Json Processing Exception occurred is logged for every constrained parameter whose schema is not a JsonSchema
• #​3317 – An injected HttpHeaders parameter is described as a schema
• #​3332 – The properties a Kotlin entity inherits from an @Embeddable are missing from the Spring Data REST schemas
• #​3320 – @Order and Ordered ignored when applying customizers
• #​3319 – A Page nested in another schema is not replaced by PagedModel
• #​3313 – Springdoc auto-configurations rely on unspecified auto-configuration ordering
• #​3331 – Validation annotations declared inside Optional parameters are dropped
• #​3322 – Validation annotations on a container's type argument leak between parameters
• #​3315 – An OAS 3.1 JsonSchema cannot be cloned through JSON
• #​3300 – TYPE_USE annotations on @ParameterObject fields are not passed along
• #​3341 – Stabilize Spring Data Sort and Pageable schema property order
• #​3338 – Kotlin nullability interpretation of the Any? type
• #​3136 – A Spring Data REST association to a non-exported entity expands its @EmbeddedId and @MapsId fields recursively in the response schemas
• The Spring Data REST response post-processing rewrote an association property in place, so the …Response refs could leak into the schema shared with the request body representation

v3.1.0

Added

• #​3269 – Add mechanism to disable nullable for Kotlin properties
• Allow request-specific Swagger UI index transformation

Changed

• Upgrade Spring Boot to version 4.1.0
• Upgrade Spring AI to version 2.0.0
• Upgrade swagger-core to version 2.2.52
• Upgrade swagger-ui to version 5.32.11
• #​3307 – Act upon SonarQube warnings
• #​3306 – Act upon SonarQube warnings

Fixed

• #​3304 – Kotlin parent class's field is not properly marked as nullable
• #​3294 – Duplicated path getting swagger-config
• #​3293 – Inconsistent OpenAPI schema naming with SNAKE_CASE: some Java record fields remain camelCase
• #​3292 – Make WebProperties and WebMvcProperties optional in SwaggerConfig
• #​3284 – Upgrade swagger-core from version 2.2.48 to 2.2.49
• #​3282 – Preserve version from nest() predicate across all routes in nest
• #​3281 – Stabilize Spring Data Page schema property order
• #​3274 – Description disappears from the generated json after upgrade to 3.0.3
• #​3270 – Validation annotation of ParameterObject property applied to PathVariable with the same name, even in unrelated endpoints
• #​3266 – Upgrade swagger-core from version 2.2.47 to 2.2.48
• #​3263 – Null key for a Map not allowed in JSON

v3.0.3

Compare Source

Added

• #​3246 – Add Springdoc OpenAPI MCP (Model Context Protocol) support
• #​3256 – Auto-set nullable: true for Kotlin nullable types in schema properties
• #​3239 – Add support for the @Range constraint validation annotation
• #​3244 – Handle default values for LocalDate

Changed

• Upgrade Spring Boot to version 4.0.5
• Upgrade swagger-core to version 2.2.47
• Upgrade swagger-ui to version 5.32.2
• #​3260 – @ConditionalOnClass(HateoasProperties.class) in SpringDocHateoasConfiguration
• Forwards all MCP non-transport headers to downstream methods
• Dynamically resolve the base path from window.location.pathname for MCP UI

Fixed

• #​3258 – Setting API Version Required when using WebFlux breaks the Swagger UI
• #​3259 – Annotated Generic properties getting applied to sibling properties
• #​3255 – Direction enum: fixed visibility scope of group order so that setGroupsOrder method can be used
• #​3247 – Preserve YAML group URLs in Swagger UI
• #​3245 – Upgrade swagger-core from version 2.2.43 to 2.2.45
• #​3235 – PropertyResolverUtils retains a JsonNode when reading an ExtensionProperty annotation
• #​3226 – Propagate JsonView context when resolving Page<T> schema

v3.0.2

Compare Source

Added

• #​3229 – Add support for Spring Framework API Versioning with Functional Endpoints
• #​3208 – Add springdoc.swagger-ui.document-title property

Changed

• Upgrade Spring Boot to version 4.0.3
• Upgrade swagger-core to version 2.2.43
• Upgrade swagger-ui to version 5.32.0
• Upgrade Scalar to version 0.5.55

Fixed

• #​3232 – Gracefully handle springdoc endpoint paths during API version resolution
• #​3230 – Scalar source URLs resolve to null/<groupName> on second request when using GroupedOpenApi
• #​3228 – springdoc-openapi-starter 3.x doesn't depend on org.springframework.boot:spring-boot-starter
• #​3220 – Reachability metadata not compatible with GraalVM 25
• #​3195 – Application won't compile when OpenApi and spring-boot-data-rest is present
• #​3193 – OpenApi field in SpringDocConfigProperties does not comply with camel case naming conventions
• #​3215 – Type annotation not considered when Kotlin is not present
• #​3199 – Prevent duplicate _links in allOf child schemas
• #​3198 – Property resolution for parameter default values
• #​3206 – Upgrade swagger-core from version 2.2.41 to 2.2.42

v3.0.1

Compare Source

Added

• #​3122 – Add log notifications when SpringDocs / Scalar are enabled by default
• #​3123 – Add support for serving static resources
• #​3151 – Add @Order to ApplicationReadyEvent listener
• #​3158 – Add support for API groups in Scalar
• #​3187 – Add Scalar WebMVC and WebFlux support
• #​3185 – Disable creation of blank GitHub issues (GitHub settings & workflow)
• #​3186 – Decouple Web Server APIs following Spring Boot modularization
• #​3131 – Improve warning messages when documentation is explicitly enabled
• #​3183 – Remove unused operations consumer from route builder methods
• #​3141 – Change handling so useReturnTypeSchema is evaluated at HTTP status code level instead of method level

Changed

• Upgrade Spring Boot to version 4.0.1
• Upgrade swagger-core to version 2.2.41
• Upgrade swagger-ui to version 5.31.0
• Upgrade Scalar to version 0.4.3

Fixed

• #​3133 – Fix regression where content type from Swagger @RequestBody did not take precedence
• #​3146 – Fix WebJar resource handler mappings for Swagger UI resources
• #​3168 – Support @Schema annotations on Kotlin value classes
• #​3178 – Fix regression when generating documentation for Kotlin LinkedHashSet
• #​3170 – Fix warnings when setting title and description in application.yml
• #​3173 – Fix /v3/api-docs returning Base64-encoded response with Spring Framework 7.0.2
• #​3155 – Fix native image support regression with SpringDoc 3.0 and Spring Boot 4.0

v3.0.0

Compare Source

Added

• #​2975 - Spring Framework 7 - Initial API versioning support
• #​3123 - Support static resources for webflux

Changed

• Upgrade to Spring Boot 4.0.0
• Upgrade to Scalar 0.4.3

Fixed

• #​3131 - Warning messages when docs are explicitly enabled
• #​3121 - NPE in KotlinDeprecatedPropertyCustomizer - resolvedSchema is null

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.