RFI for Spring Framework Vulnerability Support Services

A government authority located in New York is seeking information to gather insights into vendor capabilities, service offerings, and best practices for supporting applications built on the Spring ecosystem. The agency needs to understand how vendors can provide critical services to enhance the security, robustness, and long-term stability of these applications. This request for information focuses on securing comprehensive, enterprise-grade extended support for the Spring Framework, with a specific focus on Spring Boot version 2.7.x and its related dependent projects. The scope of work covers five key areas including comprehensive enterprise support, secure artifact management, and extended lifecycle management and security patching. The agency also requires expert technical support alongside documentation and transition support. These services must address proactive vulnerability management, timely security patching, and access to vetted artifacts. Eligible respondents must be onshore USA organizations only. The agency specifies that the performance of the work will occur offsite. While the agency is looking for proposals to understand budget parameters, it has not signaled a specific budget range. Bidders must submit all questions regarding this request no later than June 24, 2026.