Who contributed to Spring on June 8, 2026?

2 developers shipped this update, including dependabot[bot] and BoykoAlex.

@spring-projects

Spring Framework, Spring Boot, and the JVM enterprise layer

github ↗

Pick a date

Topics: Java Full archive →

The Wire · Showcase

SPRING FRAMEWORK PATCHES 16 CVES, LDAP TIGHTENS PASSWORD VALIDATION

By RepoJournal · Filed 22:44 UTC on June 8, 2026 · About Spring

2 people shipped this

dependabot[bot] @dependabot[bot] 1 cited

BoykoAlex @BoykoAlex 1 cited

Spring Framework 7.0.8 shipped overnight with a massive security update addressing 16 CVEs, while Spring LDAP closed a critical authentication bypass that could accept empty passwords as valid logins.

Spring Framework 7.0.8 [1] is a mandatory upgrade if you're on 7.0.x. The release fixes 16 security vulnerabilities including CVE-2026-41838 (predictable WebSocket session IDs) and CVE-2026-41839, with details in the Spring security blog. Spring LDAP 4.1.0 [2] ships concurrent with a critical fix [3] that rejects empty passwords in DirContextAuthenticationStrategy, closing a vulnerability where LDAP directories accepting unauthenticated binds could report false authentication success. This affects all versions relying on simple bind authentication. Spring Integration 7.0.x and 6.5.x got a lock handling fix [4] that blocks unlock operations until the key is actually removed from the cache, preventing race conditions on interrupted threads. Micrometer 1.17.0 [2] and 1.16.6 [5] maintenance releases landed across LDAP, Pulsar, and Framework with bug fixes for LongTaskTimer ArrayIndexOutOfBoundsException. Spring Tools added more Claude quick fixes [6] for the Code plugin while Framework merged SpEL operation tracking [7] to prevent expression DOS attacks via configurable operation limits.

Action items

→ Upgrade Spring Framework to 7.0.8 immediately - 16 CVEs including WebSocket session fixation spring-projects/spring-framework [immediate]
→ Update Spring LDAP to 4.1.0 or apply empty password validation patch to block authentication bypasses spring-projects/spring-ldap [immediate]
→ Cherry-pick Spring Integration lock fix to 7.0.x and 6.5.x branches to prevent race conditions spring-projects/spring-integration [plan]
→ Review SpEL expression limits configuration if evaluating untrusted expressions in your services spring-projects/spring-framework [plan]

References

[1] v7.0.8 ↗ spring-projects/spring-framework
[2] 4.1.0 ↗ spring-projects/spring-ldap
[3] Reject Empty Passwords in DirContextAuthenticationStrategy Implementations spring-projects/spring-ldap
[4] GH-11049: Block unlock until key is removed spring-projects/spring-integration
[5] Bump io.micrometer:micrometer-tracing-bom from 1.6.5 to 1.6.6 ↗ spring-projects/spring-pulsar
[6] Claude more quickfixes ↗ spring-projects/spring-tools
[7] Track operations during SpEL expression evaluation spring-projects/spring-framework

Quick answers

What shipped in Spring on June 8, 2026?: Spring Framework 7.0.8 shipped overnight with a massive security update addressing 16 CVEs, while Spring LDAP closed a critical authentication bypass that could accept empty passwords as valid logins. In total, 24 commits, 10 pull requests, and 5 releases landed.
Who contributed to Spring on June 8, 2026?: 2 developers shipped this update, including dependabot[bot] and BoykoAlex.
What were the notable Spring updates?: v7.0.8, 4.1.0, and Reject Empty Passwords in DirContextAuthenticationStrategy Implementations.

SPRING BOOT KILLS RESTTEMPLATE, SPRING AI GAINS IMAGE GEN

Spring Boot is deprecating RestTemplate across its entire ecosystem, forcing a migration to RestClient as the Framework itself moves on [ref:1].

java 20 shipped 1-min read

@spring-projects 1 day ago

SPRING BOOT DOCUMENTATION CLEANUP CONTINUES WHILE ECOSYSTEM UPGRADES LOGBACK

Spring Boot is methodically fixing its generated documentation examples as the broader ecosystem shifts to Logback 1.6.0, which removed deprecated APIs.

java 35 shipped 1-min read

@spring-projects 2 days ago

SPRING AI HARDENS ERROR HANDLING, REDIS VECTORSTORE SHEDS BANDWIDTH BLOAT

Spring AI is tightening its security posture on two fronts: MCP server transports now strip exception messages from error responses, while RedisVectorStore cuts network waste by 37 KB per embedding lookup.

java 12 shipped 2-min read

@spring-projects 3 days ago

SPRING BOOT TIGHTENS NULLABILITY CHECKS, FRAMEWORK CLEANS HOUSE

Spring Boot merged improvements to Nullaway 0.13.8 that correctly handle Map#remove nullability, while Spring Framework shipped targeted fixes for logging clarity and documentation.

java 17 shipped 1-min read

Elsewhere on the wire

AI Agents about 9 hours ago

CLAUDE OPUS 5 LANDS ACROSS THE STACK

The newest Anthropic model is now live in langchain, Cline, and llama-index, with native support for extended reasoning and 1M context windows.

ai-agents 28 shipped 1-min read

Local LLMs about 9 hours ago

OLLAMA LANDS LAGUNA SUPPORT AND CRUSHES MEMORY LEAKS WHILE SGLANG HITS V0.5.16 WITH CONFIDENCE-DRIVEN SPECULATIVE DECODING

Ollama shipped three critical performance and reliability fixes for Metal residency and concurrent access patterns, while SGL-Lang released 0.5.16 with a new speculative algorithm hitting 383.7 tok/s on DeepSeek-V4.