The Wire · Showcase
SPRING BATCH GAINS LEGACY EXCEL STREAMING, SECURITY PATCHES ROLL ACROSS STACK
By RepoJournal · Filed · About Spring
Spring Batch Extensions shipped a low-memory streaming reader for legacy .xls files, while PostgreSQL security update lands across session management.
Spring Batch Extensions added `StreamingXlsItemReader<T>` [1] to handle binary BIFF8/HSSF files with the same memory efficiency as its existing XLSX counterpart, inheriting all configuration, mapping, and restart behavior from the proven `AbstractExcelItemReader` abstraction. The new reader plugs a gap for teams still dealing with legacy Excel workbooks in production batch jobs. Meanwhile, PostgreSQL 42.7.12 shipped a security fix [2] addressing CVE-2024-54291, a silent channel-binding downgrade vulnerability in SCRAM-SHA-256-PLUS authentication that Spring Session deployments should patch immediately. Spring Security bumped Hibernate ORM to 7.4.3.Final [3] and HttpClient to 5.6.2 [4], both maintenance releases bringing stability improvements. Spring Boot cleaned up unnecessary nullable annotations on local array variables [5], a small but signal change indicating tighter null-safety discipline across the framework.
Action items
- → Patch PostgreSQL driver to 42.7.12 immediately if using channel binding authentication spring-projects/spring-session [immediate]
- → Evaluate StreamingXlsItemReader for legacy Excel batch jobs to reduce memory footprint spring-projects/spring-batch-extensions [plan]
- → Update Hibernate and HttpClient transitive dependencies in Spring Security builds spring-projects/spring-security [monitor]
References
- [1] Add streaming ItemReader for legacy .xls files ↗ spring-projects/spring-batch-extensions
- [2] Bump org.postgresql:postgresql from 42.7.11 to 42.7.12 ↗ spring-projects/spring-session
- [3] Bump org.hibernate.orm:hibernate-core from 7.4.2.Final to 7.4.3.Final ↗ spring-projects/spring-security
- [4] Bump org.apache.httpcomponents.client5:httpclient5 from 5.6.1 to 5.6.2 ↗ spring-projects/spring-security
- [5] Remove unnecessary `@Nullable`s from local array variable declarations spring-projects/spring-boot
FAQ
- What changed in Spring on June 30, 2026?
- Spring Batch Extensions shipped a low-memory streaming reader for legacy .xls files, while PostgreSQL security update lands across session management.
- What should Spring teams do about it?
- Patch PostgreSQL driver to 42.7.12 immediately if using channel binding authentication • Evaluate StreamingXlsItemReader for legacy Excel batch jobs to reduce memory footprint • Update Hibernate and HttpClient transitive dependencies in Spring Security builds
- Which Spring repositories shipped on June 30, 2026?
- spring-projects/spring-batch-extensions, spring-projects/spring-session, spring-projects/spring-security, spring-projects/spring-boot