spring-projects/spring-framework

Dependencies

The Spring Framework is conservative with third-party dependencies. Most modules pull in their dependencies as optional, leaving the version choice to the consumer.

Compile-time dependencies (transitively visible)

Library	Used in	Notes
`org.apache.commons:commons-logging`	`spring-core`	The JCL logging facade
`org.jspecify:jspecify`	All modules (annotations only)	Nullness annotations
Repackaged ASM	`spring-core` (shaded)	Bytecode manipulation
Repackaged CGLIB	`spring-core` (shaded)	Class subclass-based proxying
Repackaged Objenesis	`spring-core` (shaded)	Bypass-constructor instance creation
Repackaged JavaPoet	`spring-core` (shaded; AOT only)	Java source generation

The four shaded libraries (ASM, CGLIB, Objenesis, JavaPoet) are not visible to user code under their original package names — Spring repackages them under org.springframework.* to avoid version conflicts.

Optional dependencies declared by modules

These are common but not pulled transitively. Applications choose versions.

Web stacks

Dependency	Module	When pulled
`jakarta.servlet:jakarta.servlet-api`	`spring-web`, `spring-webmvc`, `spring-websocket`	Servlet-based runtime
`io.projectreactor:reactor-core`	`spring-core`, `spring-webflux`, `spring-r2dbc`	Reactive types
`io.projectreactor.netty:reactor-netty`	`spring-webflux`	Default reactive HTTP server / client
`org.eclipse.jetty:jetty-server`	`spring-web`	Jetty support
`org.apache.tomcat:tomcat-core`	`spring-web`	Tomcat support
`io.undertow:undertow-core`	`spring-webflux`	Undertow support
`org.apache.httpcomponents.client5:httpclient5`	`spring-web`	RestClient/RestTemplate transport

JSON / serialization

Dependency	Module	When pulled
`com.fasterxml.jackson.core:jackson-databind`	`spring-web`	Jackson JSON
`com.fasterxml.jackson.dataformat:jackson-dataformat-xml`	`spring-web`	Jackson XML
`com.fasterxml.jackson.dataformat:jackson-dataformat-smile`	`spring-web`	Smile binary JSON
`com.fasterxml.jackson.dataformat:jackson-dataformat-cbor`	`spring-web`	CBOR
`com.google.code.gson:gson`	`spring-web`	Gson alternative
`org.jetbrains.kotlinx:kotlinx-serialization-json`	many	Kotlin Serialization
`com.google.protobuf:protobuf-java`	`spring-web`	Protocol Buffers

XML

Dependency	Module	When pulled
`jakarta.xml.bind:jakarta.xml.bind-api`	`spring-oxm`	JAXB
`org.glassfish.jaxb:jaxb-runtime`	`spring-oxm`	JAXB runtime

Data

Dependency	Module	When pulled
`jakarta.persistence:jakarta.persistence-api`	`spring-orm`	JPA API
`org.hibernate.orm:hibernate-core`	`spring-orm`	Hibernate
`io.r2dbc:r2dbc-spi`	`spring-r2dbc`	R2DBC
`org.eclipse.persistence:eclipselink`	`spring-orm`	EclipseLink JPA provider

Messaging

Dependency	Module	When pulled
`jakarta.jms:jakarta.jms-api`	`spring-jms`	JMS API
`io.rsocket:rsocket-core`	`spring-messaging`	RSocket

Caching

Dependency	Module	When pulled
`com.github.ben-manes.caffeine:caffeine`	`spring-context-support`	Caffeine cache
`javax.cache:cache-api`	`spring-context-support`	JSR-107 JCache

Validation

Dependency	Module	When pulled
`jakarta.validation:jakarta.validation-api`	`spring-context`	Bean Validation API
`org.hibernate.validator:hibernate-validator`	`spring-context`	Hibernate Validator implementation

Observability

Dependency	Module	When pulled
`io.micrometer:micrometer-observation`	`spring-jms`, `spring-web`, others	Observation API
`io.micrometer:micrometer-core`	(transitive)	Metrics

Templating

Dependency	Module	When pulled
`org.freemarker:freemarker`	`spring-webmvc`, `spring-webflux`, `spring-context-support`	FreeMarker views
`org.apache.groovy:groovy-templates`	`spring-webmvc`, `spring-webflux`	Groovy templates

Scheduling

Dependency	Module	When pulled
`org.quartz-scheduler:quartz`	`spring-context-support`	Quartz scheduler

Test dependencies

Used only by the framework's own tests, not surfaced to users:

org.junit.jupiter:junit-jupiter — JUnit 5
org.mockito:mockito-core, mockito-junit-jupiter — Mockito
io.mockk:mockk — MockK (Kotlin)
org.assertj:assertj-core — AssertJ
org.apache.logging.log4j:log4j-core — Log4j 2 for test logging

Kotlin support

Dependency	Used in	Required at runtime?
`org.jetbrains.kotlin:kotlin-stdlib`	All Kotlin extension files	Only if you use Kotlin
`org.jetbrains.kotlin:kotlin-reflect`	`spring-beans`, `spring-expression`, others	For Kotlin reflection use cases
`org.jetbrains.kotlinx:kotlinx-coroutines-core`	various	For coroutines support

The Kotlin version used by the build is kotlinVersion=2.3.20 (gradle.properties).