[dependabot]

Bumps org.springdoc:springdoc-openapi-starter-webmvc-ui from 3.1.1 to 3.2.0.

Release notes

Sourced from org.springdoc:springdoc-openapi-starter-webmvc-ui's releases.

springdoc-openapi v3.2.0 released!

Spring Boot 4.1.x line (built on Spring Boot 4.1.2).

⚠️ Changes you may notice

• Default API version (#3354): the default API version is now only listed in the version header or query parameter of the operations that actually serve it (a handler mapped to it, or one without a version). Operations mapped only to other versions no longer show it as an allowed value or as their default. This also fixes the HTTP 500 raised when the version parameter declared @Schema(allowableValues).
• Newly required properties (#3360, #3361): the PagedModel / PageMetadata properties and the amount / currency properties of MonetaryAmount are now marked as required, as they are always serialized. Generated clients will see them as non-nullable.
• Scalar 0.6 (#3359): upgraded to 0.6.83. The first tag is now open by default, and model links changed from #model/name to #models/Name.
• Scalar's standalone integration (#3387): with the Swagger UI or API-only starters, Scalar's own auto-configuration is no longer disabled by springdoc. If you have com.scalar.maven on the classpath and don't want it, set scalar.enabled=false.

New

• Opt-in nullability for Java models (#3382): springdoc.model-converters.java-nullable-property-customizer.enabled=true marks properties annotated with @Nullable (JSpecify, Spring, JSR-305) as nullable, including $ref and oneOf properties, without changing shared components.
• Polymorphic oneOf as reusable components (#3390): springdoc.model-converters.polymorphic-converter.one-of-as-ref=true, with the name suffix set by springdoc.model-converters.polymorphic-converter.one-of-ref-suffix (Variant by default).
• ParameterCustomizer can read type-use annotations, including inside Optional<@MyAnnotation Foo> (#3370).
• MCP tools are registered with a McpStatelessSyncServer, for the Spring AI STATELESS protocol (#3388).

Fixed

• @ResponseStatus on a controller class is applied to its operations (#3352).
• An injected WebSession is no longer documented as a query parameter in WebFlux (#3355).
• The application no longer fails to start with Spring HATEOAS on the classpath but no LinkRelationProvider bean (#3364).
• WebAsyncTask return types are unwrapped (#3368).
• A JSpecify @Nullable on a controller parameter makes its schema nullable (#3377).
• Nullable Kotlin properties described by a oneOf (e.g. sealed classes) are documented as nullable (#3381).
• Gradle builds no longer lift Jackson 2 above the version managed by Spring Boot (#3373).

Security

• The MCP dashboard no longer pre-fills the OAuth2 token endpoint, client id and client secret, and warns when the token endpoint is not HTTPS.

Dependencies

Spring Boot 4.1.2 · swagger-ui 5.34.0 · Scalar 0.6.83 · Spring AI 2.0.1 · Spring Cloud Function 5.0.5 · spring-security-oauth2-authorization-server managed by Spring Boot (7.1.2)

Thanks to all the contributors of this release: @​MaxFreedomPollard, @​kdelay, @​arimu1, @​dpkass, @​anupamchaubey, @​Mattias-Sehlstedt, @​Naresh7175, @​ys0v9, @​sharanggupta, @​itd-sw, @​gwr0-0, @​Tework123, @​awinishere.

Changelog

Sourced from org.springdoc:springdoc-openapi-starter-webmvc-ui's changelog.

[3.2.0] - 2026-10-24

Added

• #3370 – A ParameterCustomizer can read the type-use annotations of a parameter, including the ones declared on the value wrapped in an Optional, such as Optional<@MyAnnotation Foo>
• #3382 – Mark the Java properties annotated with @Nullable (JSpecify, Spring, JSR-305) as nullable in their schema, including $ref and oneOf properties. Opt-in with springdoc.model-converters.java-nullable-property-customizer.enabled=true
• #3390 – Add springdoc.model-converters.polymorphic-converter.one-of-as-ref to emit the polymorphic oneOf unions as reusable component schemas, named after the parent schema with the suffix set by springdoc.model-converters.polymorphic-converter.one-of-ref-suffix (Variant by default)
• #3388 – Register the MCP tools with a McpStatelessSyncServer, for the STATELESS protocol

Changed

• The MCP dashboard no longer pre-fills the OAuth2 token endpoint, client id and client secret. The form shows hints instead, and warns when the token endpoint is not HTTPS
• #3354 – The default API version is only listed in the header or query parameter of the operations that serve it: a handler method mapped to it, or one without a version
• #3360 – The properties of Spring Data PagedModel and its PageMetadata are now marked as required, as they are always serialized
• #3361 – The amount and currency properties of MonetaryAmount are now marked as required
• #3359 – Upgrade Scalar to version 0.6.83. The first tag is now open by default, and the links to models changed from #model/name to #models/Name
• #3383 – Upgrade Spring AI to version 2.0.1. The MCP SDK version is now the one required by Spring AI
• Upgrade spring-boot to version 4.1.2
• Upgrade swagger-ui to version 5.34.0
• Upgrade spring-cloud-function to version 5.0.5
• Use the spring-security-oauth2-authorization-server version managed by Spring Boot (7.1.2) instead of 2.0.0-M2

Fixed

• #3352 – A @ResponseStatus on a controller class is now applied to the responses of its operations
• #3355 – An injected WebSession parameter is no longer documented as a query parameter in WebFlux applications
• #3354 – /v3/api-docs no longer fails when an API version parameter declares @Schema(allowableValues)
• #3364 – The application no longer fails to start when Spring HATEOAS is on the classpath without a LinkRelationProvider bean
• #3368 – A WebAsyncTask return type is now unwrapped, so its response is described by its result type
• #3377 – A JSpecify @Nullable on a controller method parameter now makes its schema nullable
• #3381 – A nullable Kotlin property described by a oneOf schema, such as a sealed class, is now documented as nullable
• #3387 – Scalar's own integration works again with the Swagger UI and API-only starters: only the Springdoc Scalar starters replace it
• #3373 – springdoc no longer lifts Jackson 2 above the version managed by Spring Boot in Gradle builds

Commits

• 6b79ced [maven-release-plugin] prepare release v3.2.0
• 689fc13 Describe the nullable property customizer flags in the configuration metadata
• 7a1b506 Correct the LocalTime format in the changelog entry of gh-3351
• 96245a2 Upgrade Scalar to 0.6.83
• c494456 Build against the GA versions of the optional Spring dependencies
• 2d4595f Restore the changelog entries lost in the unreleased fixed section
• dd807bd Upgrade swagger-ui to version 5.34.0
• e649960 Upgrade spring-boot to 4.1.2
• b170ca8 Use the Jackson 2 managed by Spring Boot
• ae52fe7 Register the MCP tools with a McpStatelessSyncServer
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

This change is 

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: nanotaboada/java.samples.spring.boot
• Branch: master
• File: .coderabbit.yaml
• Commit: 2cbc59f
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: a7e4c3fb-dd6e-44ef-8ea5-f0c21a3bea5d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (2cbc59f) to head (9a2d542).

Additional details and impacted files

@@             Coverage Diff             @@
##              master      #391   +/-   ##
===========================================
  Coverage     100.00%   100.00%           
  Complexity        32        32           
===========================================
  Files              3         3           
  Lines             90        90           
  Branches           8         8           
===========================================
  Hits              90        90           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.