Support for Spring AI 2.0

[AdamWang93]

Hi Team,

We are facing a security issue caused by Spring AI 1.1.8. Spring AI just released v2.0 which can resolve the security issue, but Cloud SDK for AI doesn't work with Spring AI v2.0.

Is there any plan to release a new version to adapt the Spring AI v2.0?

Thank you and best regards,
Adam

[Jonas-Isr]

Hi @AdamWang93,

thanks for reaching out! We do have a migration to Spring AI v2 on the radar but we cannot offer any expected timeline for this at the moment.

Can you elaborate on the kind of issue you are facing with v1.1.8. currently?

Best,
Jonas

[AdamWang93]

Hi @Jonas-Isr,

Just attached the scan result in BlackDuck. Please check.

Thank you and best regards,
Adam

[Jonas-Isr]

It looks to me from your screenshot that you are using Spring AI Chat Client 1.1.7, not 1.1.8. So probably you are dragging in this dependency through something else than the AI SDK (which uses 1.1.8 in the current release).

Can you please make sure via your dependency management to use Spring AI 1.1.8 and check again if you see the vulnerability? Also, since this appears transitively and the actual problem is the Java MCP dependency, you might be able to use a higher version of that dependency with your current Spring AI version by pinning it if you want (I have not checked for compatibility myself).