I am using the ehcache package from the spring-context-support JAR in my code. In the 6.0.x version, then entire package has been removed(refer to SS below). spring-context-support 6.0.x git repo I am looking for an alternative to this package or if it's been moved elsewhere.

I've tried searching for its alternative or if it has been moved to some other package as this has been done before as well. I tried searching the list of deprecated classes in 6.0.x, but classes of this package aren't mentioned there so I couldn't find a solution there as well.

Comment From: bclozel

This ehcache package was removed in d84ca2b as part of our baseline upgrade for Spring Framework 6.0. net.sf.ehcache is relying on JavaEE APIs (javax.*) and we had to remove this support when moving to Jakarta EE APIs.

Additionally, ehcache 2.x is almost EOL and ehcache3 is the direct replacement. You should revisit your dependency management to use org.ehcache:ehcache (with the jakarta classifier) instead and look into the official migration guide or reach out to the ehcache community for assistance. We did not replace org.springframework.cache.ehcache with an updated version, as using ehcache through the JCache API or its new native API is preferred.

I'll add a note about this in our upgrade section.

Comment From: ben-manes

ehcache3 is the direct replacement

I am unsure if that is actually true. According to one of the authors of Ehcache 3.x it was not designed to be used in cases where the cache would evict due to capacity, e.g. typical application caches with small resource limits. That was my use-case for using ehcache 1.x back in those days, and I think many users would likewise expect use an LRU cache for that purposes. If it was not designed for the same use-cases as the previous versions, then this could cause surprises during migration. I am more confused by this and past statements, and unsure if we have different concepts of what a cache and LRU mean, but regardless that is their design intent and why they have not resolved a denial of service exploitation because they view it as misuse by end users. If I am confused then I suspect others would be too.

Ehcache, at least by default, will indeed by unhappy if the cache is full and you keep adding to it, thus causing evictions to occur. […] The cache works super well but should never be full.