Who contributed to Spring on May 20, 2026?

2 developers shipped this update, including artembilan and mjd507.

What were the notable Spring updates?

GH-10988: Align HTTP Cross-Origin with Spring MVC, Remove spring-ai-spring-cloud-bindings, and Add message_store pattern in `IntegrationPatternType`.

@spring-projects

Spring Framework, Spring Boot, and the JVM enterprise layer

github ↗

Pick a date

Topics: Java Full archive →

The Wire · Showcase

SPRING INTEGRATION FIXES CORS DEFAULTS TO MATCH MVC, SPRING AI SHEDS CLOUD BINDINGS

By RepoJournal · Filed 06:04 UTC on May 20, 2026 · About Spring

2 people shipped this

artembilan @artembilan 1 cited

mjd507 @mjd507 1 cited

Spring Integration shipped a critical CORS alignment fix that brings HTTP and WebFlux modules into sync with Spring MVC's stricter defaults, while Spring AI removes a deprecated cloud bindings dependency in a significant API cleanup.

The CORS fix [1] addresses a security-relevant mismatch where Spring Integration was allowing origins and credentials that Spring MVC now blocks by default. This auto-cherrypicks to 7.0.x and 6.5.x branches, meaning your existing integrations may need configuration review if you rely on permissive CORS settings. Over in Spring AI, the removal of spring-ai-spring-cloud-bindings [2] signals a strategic move away from cloud-specific binding patterns; if you're using those bindings for Kubernetes or CloudFoundry deployments, migration planning starts now. Spring GraphQL also shipped a fix for a JSON syntax error in GraphiQL's XSRF support [4] that was silently breaking token injection on cookie presence. The rest of the briefing is maintenance work: Spring Integration adds message_store pattern support [3], Spring AMQP improves ack failure visibility with warn-level logging [5], and PostgreSQL driver gets bumped to 42.7.11 [6].

Action items

→ Review CORS configuration in Spring Integration HTTP/WebFlux modules against new Spring MVC defaults spring-projects/spring-integration [plan]
→ Plan migration away from spring-ai-spring-cloud-bindings if currently in use spring-projects/spring-ai [plan]
→ Test GraphiQL XSRF token flow if you rely on cookie-based CSRF protection spring-projects/spring-graphql [monitor]
→ Update PostgreSQL driver to 42.7.11 in integration-samples builds spring-projects/spring-integration-samples [plan]

References

[1] GH-10988: Align HTTP Cross-Origin with Spring MVC ↗ spring-projects/spring-integration
[2] Remove spring-ai-spring-cloud-bindings spring-projects/spring-ai
[3] Add message_store pattern in `IntegrationPatternType` ↗ spring-projects/spring-integration
[4] Fix JSON syntax error in GraphiQL XSRF support spring-projects/spring-graphql
[5] GH-3418: Warn on ack failure in the `AbstractAdaptableMessageListener` spring-projects/spring-amqp
[6] Bump PostgreSQL version to `42.7.11` spring-projects/spring-integration-samples

Quick answers

What shipped in Spring on May 20, 2026?: Spring Integration shipped a critical CORS alignment fix that brings HTTP and WebFlux modules into sync with Spring MVC's stricter defaults, while Spring AI removes a deprecated cloud bindings dependency in a significant API cleanup. In total, 15 commits and 3 pull requests landed.
Who contributed to Spring on May 20, 2026?: 2 developers shipped this update, including artembilan and mjd507.
What were the notable Spring updates?: GH-10988: Align HTTP Cross-Origin with Spring MVC, Remove spring-ai-spring-cloud-bindings, and Add message_store pattern in `IntegrationPatternType`.

SPRING BOOT KILLS RESTTEMPLATE, SPRING AI GAINS IMAGE GEN

Spring Boot is deprecating RestTemplate across its entire ecosystem, forcing a migration to RestClient as the Framework itself moves on [ref:1].

java 20 shipped 1-min read

@spring-projects 1 day ago

SPRING BOOT DOCUMENTATION CLEANUP CONTINUES WHILE ECOSYSTEM UPGRADES LOGBACK

Spring Boot is methodically fixing its generated documentation examples as the broader ecosystem shifts to Logback 1.6.0, which removed deprecated APIs.

java 35 shipped 1-min read

@spring-projects 2 days ago

SPRING AI HARDENS ERROR HANDLING, REDIS VECTORSTORE SHEDS BANDWIDTH BLOAT

Spring AI is tightening its security posture on two fronts: MCP server transports now strip exception messages from error responses, while RedisVectorStore cuts network waste by 37 KB per embedding lookup.

java 12 shipped 2-min read

@spring-projects 3 days ago

SPRING BOOT TIGHTENS NULLABILITY CHECKS, FRAMEWORK CLEANS HOUSE

Spring Boot merged improvements to Nullaway 0.13.8 that correctly handle Map#remove nullability, while Spring Framework shipped targeted fixes for logging clarity and documentation.

java 17 shipped 1-min read

Elsewhere on the wire

AI Agents about 9 hours ago

CLAUDE OPUS 5 LANDS ACROSS THE STACK

The newest Anthropic model is now live in langchain, Cline, and llama-index, with native support for extended reasoning and 1M context windows.

ai-agents 28 shipped 1-min read

Local LLMs about 9 hours ago

OLLAMA LANDS LAGUNA SUPPORT AND CRUSHES MEMORY LEAKS WHILE SGLANG HITS V0.5.16 WITH CONFIDENCE-DRIVEN SPECULATIVE DECODING

Ollama shipped three critical performance and reliability fixes for Metal residency and concurrent access patterns, while SGL-Lang released 0.5.16 with a new speculative algorithm hitting 383.7 tok/s on DeepSeek-V4.