Spring 7 is the foundation, while Boot is the on-ramp
Spring Framework 7 supplies the shared programming model beneath Spring Boot and the rest of the Spring family. Its core container handles configuration and dependency injection. Separate modules cover messaging, transactions, persistence, testing, and web applications. Teams can select jars instead of taking the whole repository.
The web choice is genuinely two-track. Spring MVC targets the Servlet stack, including controllers, views, CORS, and WebSocket support. WebFlux is the reactive stack and can run without a Servlet container. That breadth helps organizations with several application styles, but it makes the raw framework a poor beginner tutorial. The official overview directs new users to Spring Boot and start.spring.io, where generated project structure removes many early decisions.
What happened when we ran it
Our sandbox checked out commit 5ab70bb with 3 CPUs and 8 GB of RAM, then worked inside framework-docs/. Npm installed 232 packages in 37 seconds and used 50 MB on disk. The package exposed no build script or target and no test script or target, so the harness skipped both steps. The documentation dependencies installed; Spring's Java modules were neither built nor tested.
Npm audit reported 11 known vulnerabilities in that documentation environment: 1 critical, 1 high, and 9 moderate. The measurement block does not identify affected packages or reachable application code, so it cannot support a claim about risk in applications that use Spring jars. It does support a narrower conclusion: anyone publishing the reference site from this commit should inspect and resolve the npm report instead of treating the 37-second install as a clean result.
The main source build needs JDK 25 and the Gradle wrapper
The current main-branch build guide requires Git and JDK 25, then uses ./gradlew build to compile, test, and produce jars, distributions, and documentation. First use downloads Gradle and build dependencies into the user's cache. Our Node 22 harness did not execute any of those Gradle commands.
That distinction matters in a repository with 11,337 files, roughly 1,549,087 source lines, and a 61 MB checkout. The lab scan found 14 CI workflow files, no Dockerfile, and no root tests directory. Contributors also follow code-style files, IDE import instructions, signed-off commits, and issue or pull-request conventions. Application developers normally consume released artifacts. Building main is for framework contributors, integrators testing a patch, or teams verifying a release against their own stack.
Java 17 and Jakarta EE 9 set the minimum application baseline
Spring Framework 6.0 and newer require Java 17+, according to the official overview. The same generation moved its enterprise API baseline from javax packages to Jakarta EE 9 and the jakarta namespace. That affects Servlet, persistence, validation, messaging, and other integrations. A team on an older JDK or application server must plan the platform migration before changing Spring dependencies, because compiler and namespace errors can spread through application and library code.
The framework supports embedded-server applications, traditional server deployments, batch work, and standalone programs. It integrates selected Jakarta specifications instead of implementing the entire Jakarta EE platform. Spring MVC works on the Servlet API, while WebFlux can use a different server model. This flexibility is useful in a mixed estate. It also means the right compatibility matrix depends on the modules, JDK, server, ORM, and surrounding Spring projects in each application.
Version 7.0.9 makes proxy and SpEL choices explicit
The v7.0.9 release notes carry two attention notices, and both deserve upgrade tests. Forwarded-header support gained constructor choices between the standard Forwarded header and X-Forwarded alternatives, plus separate prefix handling. The default preserves prior behavior in 7.0.9, but the release recommends explicit selection to match the proxy. This is security-sensitive because trusting forwarded headers changes how an application understands its external request address and scheme.
The same 7.0.9 release disables compiled expressions by default in SimpleEvaluationContext. Trusted-expression users can opt back in through the builder, with the documented warning that compilation removes safety guards used during interpreted evaluation. These are reasonable corrections, yet they show why a Spring point release needs release-note review. Proxy tests and expression tests belong in an upgrade checklist even when public APIs appear source compatible.
495 issues and pull requests sit inside active daily triage
GitHub showed 60,216 stars and 495 combined issues and pull requests when fetched. The last push was September 1, 2026, and v7.0.9 shipped on August 20. Recent activity included new web optimizations, AOT-cache discussion, closed bug reports, declined proposals, and documentation corrections. The raw count is large because GitHub combines both item types; the same-day movement shows a maintained queue rather than an untouched backlog.
Contribution rules explain how that queue is managed. Questions go to Stack Overflow, bug reports should include a minimal reproduction, new items begin in triage, and accepted fixes receive target milestones. Pull requests target main and require a signed-off commit. For a framework used across many application stacks, the process gives design decisions and regressions a public record.
The 232-package result only covers the docs toolchain
Our run found useful friction in the documentation subproject, especially 11 advisories and absent npm build and test targets. It did not answer whether the Java build passes, how fast Spring starts, or whether an application survives a version upgrade. A serious evaluation should generate a small Boot application, add only the required Spring modules, and run the organization's database, proxy, serialization, transaction, and security cases on the intended JDK.
Spring Framework is the sensible default when an organization already speaks Spring or needs its deep Java integration model. The upstream source has 1.55 million lines and 495 combined issues and pull requests, while applications import only the modules they select. New services should usually enter through Spring Boot. Teams with native-image or minimal-service priorities should compare Quarkus and Micronaut using the same workload before committing.