On behalf of the team and everyone who has contributed, I am pleased to announce the 5.3.0 release of the Spring Tools for Visual Studio Code, Cursor, Eclipse, Theia, and Claude Code.

Hightlights

• Validation Improvements: Fixed false positive lints, inner record bean misdetection, and native query checks.
• Enhanced Stability: Resolved Boot MCP startup crashes, Eclipse AOT errors, and JMX connection bugs.
• Code Modernization: Switched from RestTemplate to RestClient and cleaned up legacy dependencies.

Detailed changes can be found in the release notes: https://github.com/spring-projects/spring-tools/releases/tag/5.3.0.RELEASE

CVE reports

This release addresses the following CVEs:

• CVE-2026-47858 "live information startup mode is vulnerable for remote code execution"
• CVE-2026-47873 "Spring Tools Docker integration publishes unauthenticated debug (JDWP) and JMX ports on all network interfaces"
• CVE-2026-47882 "Spring Boot DevTools remote secret generated with a non-cryptographic PRNG"
• CVE-2026-59326 "HTTP Proxy Credentials Logged in Plaintext by the Spring Boot Language Server"
• CVE-2026-59327 "Cleartext Storage of Spring Boot DevTools Remote Secret in Eclipse Launch"
• CVE-2026-59328 "Cross-Site Scripting in Eclipse Spring Boot Starter Wizard Dependency Tooltips"

Downloads

To download the distribution for Eclipse and find links to the marketplace entries for Visual Studio Code, Cursor, and Theia, please go visit:

• Spring Tools: https://spring.io/tools/

Next up is the 5.4.0 release, currently scheduled for mid September 2026.