Who contributed to Spring on July 14, 2026?

5 developers shipped this update, including SebTardif, Stéphane Nicoll, Tran Ngoc Nhan, dependabot, and cppwfs.

What were the notable Spring updates?

Resources are not cleaned up when resolving an image that is not yet present in the builder, Merge pull request #50919 from SebTardif, and Merge pull request #50931 from ngocnhan-tran1996.

@spring-projects

Spring Framework, Spring Boot, and the JVM enterprise layer

github ↗

Pick a date

Topics: Java Full archive →

The Wire · Showcase

SPRING BOOT PLUGS FILE HANDLE LEAK IN IMAGE BUILDPACK

By RepoJournal · Filed 07:00 UTC on July 14, 2026 · About Spring

5 people shipped this

Stéphane Nicoll @snicoll 2 cited

dependabot @dependabot 2 cited

SebTardif @SebTardif 1 cited

Tran Ngoc Nhan @ngocnhan-tran1996 1 cited

cppwfs @cppwfs 1 cited

Spring Boot's image buildpack was leaking file handles and orphaning temp files when resolving missing builder images, but a fix just landed to clean up both the streams and the intermediate artifacts.

The buildpack's ExportedLayers class was materializing exported layers as temp files without proper cleanup [1], leaving `create-builder-scratch-source-*` files scattered across your system temp directory and keeping InputStreams open. The patch [2] closes those streams and deletes the intermediate tar files, eliminating the resource leak entirely. Elsewhere across the projects, Spring Boot also corrected a documentation bug where the MongoDB health indicator was listed under the wrong configuration key [3][4], a fix that ships now to prevent confusion on your next integration. Spring Security picked up routine dependency bumps: Hibernate ORM to 7.4.5 [5] and JUnit to 6.1.2 [6], both maintenance releases with no breaking changes. Spring AMQP standardized its TOML naming conventions to match Spring Integration [7], improving consistency across the stack.

Action items

→ Update Spring Boot to pull the image buildpack stream cleanup fix spring-projects/spring-boot [plan]
→ Check your MongoDB health indicator config keys against the corrected documentation spring-projects/spring-boot [monitor]
→ Merge the dependency bumps in Spring Security at your next maintenance window spring-projects/spring-security [plan]

References

[1] Resources are not cleaned up when resolving an image that is not yet present in the builder ↗ spring-projects/spring-boot
[2] Merge pull request #50919 from SebTardif spring-projects/spring-boot
[3] Merge pull request #50931 from ngocnhan-tran1996 spring-projects/spring-boot
[4] Table of auto-configured HealthIndicators lists the wrong key for MongoHealthIndicator ↗ spring-projects/spring-boot
[5] Bump org.hibernate.orm:hibernate-core from 7.4.4.Final to 7.4.5.Final ↗ spring-projects/spring-security
[6] Bump org.junit:junit-bom from 6.1.1 to 6.1.2 ↗ spring-projects/spring-security
[7] SA to use same toml naming as SI (#3516) spring-projects/spring-amqp

Quick answers

What shipped in Spring on July 14, 2026?: Spring Boot's image buildpack was leaking file handles and orphaning temp files when resolving missing builder images, but a fix just landed to clean up both the streams and the intermediate artifacts. In total, 9 commits and 7 pull requests landed.
Who contributed to Spring on July 14, 2026?: 5 developers shipped this update, including SebTardif, Stéphane Nicoll, Tran Ngoc Nhan, dependabot, and cppwfs.
What were the notable Spring updates?: Resources are not cleaned up when resolving an image that is not yet present in the builder, Merge pull request #50919 from SebTardif, and Merge pull request #50931 from ngocnhan-tran1996.

SPRING-AI FIXES CRITICAL TOOL CALLING BUG THAT BROKE OPENAI STRICT MODE

The `strict` parameter in OpenAI tool calling was silently failing across all Spring AI implementations because it was serialized in the wrong place in the payload.

java 8 shipped 1-min read

@spring-projects 2 days ago

SPRING-AI FIXES SILENT DATA LOSS IN BATCH EMBEDDING STRATEGY

A critical bug in TokenCountBatchingStrategy was dropping duplicate documents during batch processing, silently returning fewer embeddings than requested.

java 9 shipped 1-min read

@spring-projects 3 days ago

SPRING INTEGRATION FIXES CRITICAL LOCK REGISTRY BUG BLOCKING DISTRIBUTED SYSTEMS

Spring Integration shipped an emergency fix for JdbcLockRegistry that was causing false application hangs when different keys collided on shared locks.

java 10 shipped 1-min read

@spring-projects 4 days ago

SPRING AI REALIGNS DEPENDENCY MANAGEMENT ACROSS VECTOR STORES

Spring AI is consolidating version management across gRPC, Maven plugins, and Couchbase clients to delegate entirely to Spring Boot's BOM, cutting maintenance overhead and preventing dependency drift.

java 21 shipped 1-min read

— or follow the whole beat:

Elsewhere on the wire

@cachyos about 4 hours ago

CACHYOS LINUX 7.2-RC3 SHIPS WITH HARDWARE FIXES AND EXPANDED LANGUAGE SUPPORT

CachyOS Linux 7.2-rc3-1 is live with Razer Blade speaker fixes and v4l2loopback updates, while the package installer now speaks Turkish and Azerbaijani.

infra 63 shipped 1-min read

Elixir & Phoenix about 4 hours ago

PHOENIX LIVE VIEW PATCHES SCHEME VALIDATION BYPASS

Phoenix LiveView 1.2.7 ships an emergency security fix for a scheme validation bypass that could let attackers inject malicious URLs into your application.

elixir 6 shipped 1-min read

@dotnet about 4 hours ago

RUNTIME FIXES DECIMAL AND BIGINTEGER ROUNDING BUGS THAT LOST PRECISION

Three critical numeric conversion bugs that silently corrupted precision in decimal, BigInteger, and floating-point math are now fixed across the stack.

dotnet 122 shipped 1-min read

FastAPI & Pydantic about 4 hours ago

FASTAPI AND SQLMODEL LOCK DOWN DEPENDENCY MANAGEMENT, PYDANTIC MYPY PLUGIN GETS PRECISION FIXES

Both FastAPI and SQLModel are replacing noisy weekly Dependabot updates with smarter automation, while Pydantic's type checker integration finally handles edge cases that have been breaking real codebases.

python 21 shipped 1-min read