Who contributed to Spring on July 10, 2026?

2 developers shipped this update, including dependabot[bot] and TimurRakhmatullin86.

What were the notable Spring updates?

Delegate Maven plugin versions to Spring Boot BOM, Align gRPC version management with Spring Boot, and Update Couchbase vector store to use Spring Boot-managed client.

Jul 10, 2026

$ the-wire · showcase

SPRING AI REALIGNS DEPENDENCY MANAGEMENT ACROSS VECTOR STORES

By RepoJournal · Filed 06:59 UTC on July 10, 2026 · About Spring · Composed from the cited sources · methodology

2 people shipped this

dependabot[bot] @dependabot[bot] 2 cited

TimurRakhmatullin86 @TimurRakhmatullin86 1 cited

Spring AI is consolidating version management across gRPC, Maven plugins, and Couchbase clients to delegate entirely to Spring Boot's BOM, cutting maintenance overhead and preventing dependency drift.

Spring AI shipped three major alignment commits that strip out redundant version properties across vector store modules [1][2][3]. The gRPC consolidation removes explicit per-module overrides for the Qdrant, Milvus, and Weaviate integrations, letting Spring Boot's BOM take the wheel [2]. Couchbase bumps from 3.9.1 to 3.11.3 via the same mechanism [3]. Maven plugin versions now flow from Spring Boot rather than living in Spring AI's root pom [1]. Meanwhile, Spring Security tightened its build matrix to check only JDK 17, cutting CI time by ditching the redundant JDK 21 job [4]. Logback 1.5.38 rolled out across Session and Security repos, fixing a typo in HardenedObjectInputStream that was silently dropping Throwable white-filtering [5][6]. Spring AI also fixed a critical native resource leak in TransformersEmbeddingModel where OrtSession and HuggingFaceTokenizer were never released on bean destruction [7]. Spring Security made wildcards a minor-version concern only, moving from patch-level management to major.minor targeting for 7.0.x [8].

Action items

→ Update Spring AI integrations to latest dependency management - verify Couchbase, gRPC, and Maven versions flow from Spring Boot spring-projects/spring-ai [plan]
→ Patch Logback to 1.5.38 in Spring Security and Session deployments to restore Throwable filtering spring-projects/spring-security [plan]
→ Review TransformersEmbeddingModel bean lifecycle in production - native resource leak on context shutdown spring-projects/spring-ai [monitor]

References

[1] Delegate Maven plugin versions to Spring Boot BOM ↗ spring-projects/spring-ai
[2] Align gRPC version management with Spring Boot ↗ spring-projects/spring-ai
[3] Update Couchbase vector store to use Spring Boot-managed client ↗ spring-projects/spring-ai
[4] Check Only JDK 17 ↗ spring-projects/spring-security
[5] Bump ch.qos.logback:logback-core from 1.5.37 to 1.5.38 ↗ spring-projects/spring-session
[6] Bump ch.qos.logback:logback-classic from 1.5.37 to 1.5.38 ↗ spring-projects/spring-security
[7] Close native resources in `TransformersEmbeddingModel` ↗ spring-projects/spring-ai
[8] Move Wildcards to Minor Versions ↗ spring-projects/spring-security