Who contributed to Spring on June 14, 2026?

1 developer shipped this update, including dependabot[bot].

What were the notable Spring updates?

Bump esbuild from 0.25.0 to 0.28.1 in /javascript, Bump com.google.protobuf:protobuf-bom from 4.35.0 to 4.35.1, and RetryingTest for TcpOutboundGatewayTests.testGoodNetGWTimeout.

@spring-projects

Spring Framework, Spring Boot, and the JVM enterprise layer

github ↗

Pick a date

Topics: Java Full archive →

The Wire · Showcase

ESBUILD PATCHES CRITICAL HTTP REQUEST FLAW IN SPRING SECURITY

By RepoJournal · Filed 06:03 UTC on June 14, 2026 · About Spring

1 person shipped this

dependabot[bot] @dependabot[bot] 2 cited

Spring Security shipped an emergency esbuild bump overnight that closes a local development server vulnerability allowing backslash injection in HTTP requests.

The esbuild update from 0.25.0 to 0.28.1 [1] addresses GHSA-g7r4-m6w7-qqqr, a security issue where the development server was accepting malformed HTTP requests containing backslash characters that should have been rejected. This matters if you're running Spring Security's JavaScript toolchain in local development. Ship this upgrade before your next build. In parallel, Spring Integration quietly bumped protobuf-bom to 4.35.1 [2], a patch release with no breaking changes. On the reliability front, Spring Integration merged a retry harness for TcpOutboundGatewayTests that was cherry-picked to the 7.0.x branch [3], stabilizing flaky timeout tests. Spring Boot fixed a subtle auto-config bug [4] where SpringReactiveOpaqueTokenIntrospector was loading without WebFlux on the classpath, causing ClassNotFoundException on BodyInserters.

Action items

→ Upgrade esbuild in spring-security to 0.28.1 before next deploy spring-projects/spring-security [immediate]
→ Merge protobuf-bom 4.35.1 to spring-integration spring-projects/spring-integration [plan]
→ Review Spring Boot 50764 fix if you use SpringReactiveOpaqueTokenIntrospector without WebFlux spring-projects/spring-boot [monitor]

References

[1] Bump esbuild from 0.25.0 to 0.28.1 in /javascript ↗ spring-projects/spring-security
[2] Bump com.google.protobuf:protobuf-bom from 4.35.0 to 4.35.1 ↗ spring-projects/spring-integration
[3] RetryingTest for TcpOutboundGatewayTests.testGoodNetGWTimeout spring-projects/spring-integration
[4] Stop auto-config of SpringReactiveOpaqueTokenIntrospector w/o WebFlux spring-projects/spring-boot

Quick answers

What shipped in Spring on June 14, 2026?: Spring Security shipped an emergency esbuild bump overnight that closes a local development server vulnerability allowing backslash injection in HTTP requests. In total, 2 commits and 2 pull requests landed.
Who contributed to Spring on June 14, 2026?: 1 developer shipped this update, including dependabot[bot].
What were the notable Spring updates?: Bump esbuild from 0.25.0 to 0.28.1 in /javascript, Bump com.google.protobuf:protobuf-bom from 4.35.0 to 4.35.1, and RetryingTest for TcpOutboundGatewayTests.testGoodNetGWTimeout.

SPRING FIXES STALE PROPERTY ACCESS BUG, ELASTICSEARCH CUTS JSON OVERHEAD

Spring Framework plugged a SpEL evaluation context bug that could serve stale cached properties between expression evaluations, while Spring Data Elasticsearch eliminated wasteful intermediate JSON serialization in search hit field conversion.

java 10 shipped 1-min read

@spring-projects 2 days ago

SPRING DATA ELASTICSEARCH GOES SERVERLESS, BOOT FIXES OTLP TYPE BUG

Spring Data Elasticsearch now supports serverless deployments with a new ElasticsearchServerType enum, while Spring Boot patches a stale metadata reference that broke OTLP logging transport configuration.

java 19 shipped 1-min read

@spring-projects 3 days ago

SPRING BOOT KILLS RESTTEMPLATE, SPRING AI GAINS IMAGE GEN

Spring Boot is deprecating RestTemplate across its entire ecosystem, forcing a migration to RestClient as the Framework itself moves on [ref:1].

java 20 shipped 1-min read

@spring-projects 4 days ago

SPRING BOOT DOCUMENTATION CLEANUP CONTINUES WHILE ECOSYSTEM UPGRADES LOGBACK

Spring Boot is methodically fixing its generated documentation examples as the broader ecosystem shifts to Logback 1.6.0, which removed deprecated APIs.

java 35 shipped 1-min read

Elsewhere on the wire

AI Agents about 21 hours ago

CLINE SHIPS FIVE CRITICAL AGENT FIXES AFTER END-TO-END TESTING BLITZ

Saoudrizwan just landed a cascade of fixes that prevent the agent loop from running wild, stop file reads from resolving to the wrong directory, and plug the compaction pipeline.

ai-agents 16 shipped 2-min read

Local LLMs about 21 hours ago

LLAMA.CPP SHIPS MINIMAX-M3 SPARSE ATTENTION, VLLM UNLOCKS HETEROGENEOUS PREFILL-DECODE

The inference stack gets a new model architecture and a fundamental shift in how prefill and decode can run on different hardware configurations.

+10

llms 125 shipped 1-min read

@CachyOS about 21 hours ago

GLIBC 2.43 REBUILD SHIPS, INSTALLER JUMPS TO C++26

CachyOS pushed glibc 2.43 through the pipeline while the CLI installer upgraded its C++ standard to C++26, signaling a major refresh across core infrastructure.

infra 97 shipped 1-min read

Elixir & Phoenix about 21 hours ago

ECTO FIXES SUBQUERY PLANNING IN JOINS, ELIXIR PATCHES IEX PARSING

Ecto's query planner now handles subqueries correctly in interpolated join filters, while Elixir fixes a syntax error that broke 'not in' as a continuation operator in IEx.