diff --git a/framework-docs/src/docs/dist/license.txt b/framework-docs/src/docs/dist/license.txt
index a5fb64294f3..8181e9e47a5 100644
--- a/framework-docs/src/docs/dist/license.txt
+++ b/framework-docs/src/docs/dist/license.txt
@@ -200,6 +200,7 @@
See the License for the specific language governing permissions and
limitations under the License.
+
=======================================================================
SPRING FRAMEWORK ${version} SUBCOMPONENTS:
@@ -212,7 +213,7 @@ code for these subcomponents is subject to the terms and
conditions of the following licenses.
->>> ASM 9.1 (org.ow2.asm:asm:9.1, org.ow2.asm:asm-commons:9.1):
+>>> ASM 9.9.1 (org.ow2.asm:asm:9.9.1):
Copyright (c) 2000-2011 INRIA, France Telecom
All rights reserved.
@@ -249,10 +250,8 @@ Copyright (c) 1999-2009, OW2 Consortium
>>> CGLIB 3.3 (cglib:cglib:3.3):
-Per the LICENSE file in the CGLIB JAR distribution downloaded from
-https://github.com/cglib/cglib/releases/download/RELEASE_3_3_0/cglib-3.3.0.jar,
-CGLIB 3.3 is licensed under the Apache License, version 2.0, the text of which
-is included above.
+Per the LICENSE file in the CGLIB distribution, CGLIB 3.3 is licensed
+under the Apache License, version 2.0, the text of which is included above.
>>> JavaPoet 1.13.0 (com.squareup:javapoet:1.13.0):
@@ -263,18 +262,18 @@ JavaPoet 1.13.0 is licensed under the Apache License, version 2.0, the text of
which is included above.
->>> Objenesis 3.4 (org.objenesis:objenesis:3.4):
+>>> Objenesis 3.5 (org.objenesis:objenesis:3.5):
-Per the LICENSE file in the Objenesis ZIP distribution downloaded from
-http://objenesis.org/download.html, Objenesis 3.4 is licensed under the
+Per the LICENSE file in the Objenesis distribution downloaded from
+http://objenesis.org/download.html, Objenesis 3.5 is licensed under the
Apache License, version 2.0, the text of which is included above.
-Per the NOTICE file in the Objenesis ZIP distribution downloaded from
+Per the NOTICE file in the Objenesis distribution downloaded from
http://objenesis.org/download.html and corresponding to section 4d of the
Apache License, Version 2.0, in this case for Objenesis:
Objenesis
-Copyright 2006-2019 Joe Walnes, Henri Tremblay, Leonardo Mesquita
+Copyright 2006-2026 Joe Walnes, Henri Tremblay, Leonardo Mesquita
===============================================================================
diff --git a/spring-core/spring-core.gradle b/spring-core/spring-core.gradle
index 4efdde03f08..8c5ddf96db7 100644
--- a/spring-core/spring-core.gradle
+++ b/spring-core/spring-core.gradle
@@ -15,7 +15,7 @@ multiRelease {
}
def javapoetVersion = "1.13.0"
-def objenesisVersion = "3.4"
+def objenesisVersion = "3.5"
configurations {
java21Api.extendsFrom(api)
diff --git a/spring-core/src/main/java/org/springframework/asm/Attribute.java b/spring-core/src/main/java/org/springframework/asm/Attribute.java
index 9e68aea8069..e40675c264a 100644
--- a/spring-core/src/main/java/org/springframework/asm/Attribute.java
+++ b/spring-core/src/main/java/org/springframework/asm/Attribute.java
@@ -95,7 +95,7 @@ public class Attribute {
* a Code attribute that contains labels.
* @deprecated no longer used by ASM.
*/
- @Deprecated
+ @Deprecated(forRemoval = false)
protected Label[] getLabels() {
return new Label[0];
}
@@ -174,6 +174,7 @@ public class Attribute {
* ClassReader overrides {@link ClassReader#readLabel}. Hence {@link #read(ClassReader, int, int,
* char[], int, Label[])} must not manually create {@link Label} instances.
*
+ * @param classReader the class that contains the attribute to be read.
* @param bytecodeOffset a bytecode offset in a method.
* @param labels the already created labels, indexed by their offset. If a label already exists
* for bytecodeOffset this method does not create a new one. Otherwise it stores the new label
diff --git a/spring-core/src/main/java/org/springframework/asm/ClassReader.java b/spring-core/src/main/java/org/springframework/asm/ClassReader.java
index 5fc6edbe7e8..c379a115ef4 100644
--- a/spring-core/src/main/java/org/springframework/asm/ClassReader.java
+++ b/spring-core/src/main/java/org/springframework/asm/ClassReader.java
@@ -100,7 +100,7 @@ public class ClassReader {
* @deprecated Use {@link #readByte(int)} and the other read methods instead. This field will
* eventually be deleted.
*/
- @Deprecated
+ @Deprecated(forRemoval = false)
// DontCheck(MemberName): can't be renamed (for backward binary compatibility).
public final byte[] b;
@@ -197,7 +197,7 @@ public class ClassReader {
// Check the class' major_version. This field is after the magic and minor_version fields, which
// use 4 and 2 bytes respectively.
// SPRING PATCH: leniently try to parse newer class files as well
- // if (checkClassVersion && readShort(classFileOffset + 6) > Opcodes.V26) {
+ // if (checkClassVersion && readShort(classFileOffset + 6) > Opcodes.V27) {
// throw new IllegalArgumentException(
// "Unsupported class file major version " + readShort(classFileOffset + 6));
// }
@@ -3550,6 +3550,9 @@ public class ClassReader {
final char[] charBuffer,
final int codeAttributeOffset,
final Label[] labels) {
+ if (length > classFileBuffer.length - offset) {
+ throw new IllegalArgumentException();
+ }
for (Attribute attributePrototype : attributePrototypes) {
if (attributePrototype.type.equals(type)) {
return attributePrototype.read(
diff --git a/spring-core/src/main/java/org/springframework/asm/ClassWriter.java b/spring-core/src/main/java/org/springframework/asm/ClassWriter.java
index 0c59b7cd150..2a24e8b06b6 100644
--- a/spring-core/src/main/java/org/springframework/asm/ClassWriter.java
+++ b/spring-core/src/main/java/org/springframework/asm/ClassWriter.java
@@ -897,7 +897,7 @@ public class ClassWriter extends ClassVisitor {
* @deprecated this method is superseded by {@link #newHandle(int, String, String, String,
* boolean)}.
*/
- @Deprecated
+ @Deprecated(forRemoval = false)
public int newHandle(
final int tag, final String owner, final String name, final String descriptor) {
return newHandle(tag, owner, name, descriptor, tag == Opcodes.H_INVOKEINTERFACE);
diff --git a/spring-core/src/main/java/org/springframework/asm/Handle.java b/spring-core/src/main/java/org/springframework/asm/Handle.java
index 717be9b82b4..c39edaa4eae 100644
--- a/spring-core/src/main/java/org/springframework/asm/Handle.java
+++ b/spring-core/src/main/java/org/springframework/asm/Handle.java
@@ -71,7 +71,7 @@ public final class Handle {
* @deprecated this constructor has been superseded by {@link #Handle(int, String, String, String,
* boolean)}.
*/
- @Deprecated
+ @Deprecated(forRemoval = false)
public Handle(final int tag, final String owner, final String name, final String descriptor) {
this(tag, owner, name, descriptor, tag == Opcodes.H_INVOKEINTERFACE);
}
diff --git a/spring-core/src/main/java/org/springframework/asm/MethodVisitor.java b/spring-core/src/main/java/org/springframework/asm/MethodVisitor.java
index 7fc511d4e62..38450513944 100644
--- a/spring-core/src/main/java/org/springframework/asm/MethodVisitor.java
+++ b/spring-core/src/main/java/org/springframework/asm/MethodVisitor.java
@@ -414,7 +414,7 @@ public abstract class MethodVisitor {
* @param descriptor the method's descriptor (see {@link Type}).
* @deprecated use {@link #visitMethodInsn(int, String, String, String, boolean)} instead.
*/
- @Deprecated
+ @Deprecated(forRemoval = false)
public void visitMethodInsn(
final int opcode, final String owner, final String name, final String descriptor) {
int opcodeAndSource = opcode | (api < Opcodes.ASM5 ? Opcodes.SOURCE_DEPRECATED : 0);
diff --git a/spring-core/src/main/java/org/springframework/asm/Opcodes.java b/spring-core/src/main/java/org/springframework/asm/Opcodes.java
index c2ddd099d81..73f166ed9d4 100644
--- a/spring-core/src/main/java/org/springframework/asm/Opcodes.java
+++ b/spring-core/src/main/java/org/springframework/asm/Opcodes.java
@@ -291,6 +291,7 @@ public interface Opcodes {
int V24 = 0 << 16 | 68;
int V25 = 0 << 16 | 69;
int V26 = 0 << 16 | 70;
+ int V27 = 0 << 16 | 71;
/**
* Version flag indicating that the class is using 'preview' features.
diff --git a/spring-core/src/main/java/org/springframework/objenesis/package-info.java b/spring-core/src/main/java/org/springframework/objenesis/package-info.java
index 166e59b9c83..7e9a71c1e3c 100644
--- a/spring-core/src/main/java/org/springframework/objenesis/package-info.java
+++ b/spring-core/src/main/java/org/springframework/objenesis/package-info.java
@@ -1,6 +1,6 @@
/**
* Spring's repackaging of
- * Objenesis 3.4
+ * Objenesis 3.5
* (with SpringObjenesis entry point; for internal use only).
*
* This repackaging technique avoids any potential conflicts with