RepoJournal
Spring @spring-projects
107 wires and counting
$ status: archived — this briefing has stopped; the archive stays readable. browse live briefings →

$ status

wire 2026-06-14
stories 4
GitHub RSS Archive Reviews

© 2026 RepoJournal Home Showcase How it works Privacy

$ the-wire · showcase

ESBUILD PATCHES CRITICAL HTTP REQUEST FLAW IN SPRING SECURITY

By RepoJournal · Filed · About Spring · Composed from the cited sources · methodology

dependabot[bot]
1 person shipped this
dependabot[bot] @dependabot[bot] 2 cited

Spring Security shipped an emergency esbuild bump overnight that closes a local development server vulnerability allowing backslash injection in HTTP requests.

The esbuild update from 0.25.0 to 0.28.1 [1] addresses GHSA-g7r4-m6w7-qqqr, a security issue where the development server was accepting malformed HTTP requests containing backslash characters that should have been rejected. This matters if you're running Spring Security's JavaScript toolchain in local development. Ship this upgrade before your next build. In parallel, Spring Integration quietly bumped protobuf-bom to 4.35.1 [2], a patch release with no breaking changes. On the reliability front, Spring Integration merged a retry harness for TcpOutboundGatewayTests that was cherry-picked to the 7.0.x branch [3], stabilizing flaky timeout tests. Spring Boot fixed a subtle auto-config bug [4] where SpringReactiveOpaqueTokenIntrospector was loading without WebFlux on the classpath, causing ClassNotFoundException on BodyInserters.

$ ls spring-projects/reviews/ # the step-back reads

the week in review Spring Kafka fixes multi-value JSON header loss the month in review Spring standardizes release trains while security patches and batch fixes surface
Full archive → Weekly reviews →

Quick answers

What shipped in Spring on June 14, 2026?
Spring Security shipped an emergency esbuild bump overnight that closes a local development server vulnerability allowing backslash injection in HTTP requests. In total, 2 commits and 2 pull requests landed.
Who contributed to Spring on June 14, 2026?
1 developer shipped this update, including dependabot[bot].
What were the notable Spring updates?
Bump esbuild from 0.25.0 to 0.28.1 in /javascript, Bump com.google.protobuf:protobuf-bom from 4.35.0 to 4.35.1, and RetryingTest for TcpOutboundGatewayTests.testGoodNetGWTimeout.
♥

$ log @spring-projects --recent

Kubernetes probe groups keep their defaults; multi-segment health paths land 90 shipped Kafka config building centralized, async listener results awaited on stop 52 shipped Spring Data moves to JSqlParser 5.4 and Hibernate 7.4.8.Final 11 shipped Spring Batch deprecates setters for required dependencies 5 shipped

$ log --all # elsewhere on the wire

Agent Security Quiet day in agent security as guard coverage reaches four clients Alignment & Post-training verl defaults Ascend RL mode, open-instruct unblocks SFT packing

$ ls showcases/

Safety Evals AI Red Teaming Agent Security Interpretability Alignment & Post-training

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.