RepoJournal
Spring

@spring-projects

Spring Framework, Spring Boot, and the JVM enterprise layer

Pick a date

  1. Wed 10 jun
  2. Thu 11 jun
  3. Fri 12 jun
  4. Sat 13 jun
  5. Sun 14 jun
  6. Mon 15 jun
  7. Tue 16 jun
  8. Wed 17 jun
  9. Thu 18 jun
  10. Sat 27 jun
  11. Sun 28 jun
  12. Mon 29 jun
  13. Tue 30 jun
  14. Wed 1 jul
  15. Thu 2 jul
  16. Fri 3 jul
  17. Sat 4 jul
  18. Sun 5 jul
  19. Mon 6 jul
  20. Tue 7 jul
  21. Wed 8 jul
  22. Thu 9 jul
  23. Fri 10 jul
  24. Sat 11 jul
  25. Sun 12 jul
  26. Mon 13 jul
  27. Tue 14 jul
  28. Wed 15 jul
  29. Thu 16 jul
  30. Today 18 jul
Topics: Java Full archive →

The Wire · Showcase

SPRING FRAMEWORK TIGHTENS RESOURCE SECURITY, NEO4J FIXES CONVERSION LOGIC

By RepoJournal · Filed · About Spring

dependabot Brian Clozel ilgrosso
3 people shipped this
dependabot @dependabot 1 cited Brian Clozel @bclozel 1 cited ilgrosso @ilgrosso 1 cited

Spring Framework reinstated critical resource location validation checks that prevent unauthorized static resource resolution in sensitive directories.

Spring Framework merged a fix that restores invalid resource location checks [2], closing a gap where certain paths were incorrectly treated as valid. This matters: the original removal in gh-36695 created a security surface that's now sealed. Meanwhile, Spring Data Neo4j shipped a propertyType matching fix [3] that corrects how custom conversions are resolved, addressing edge cases where type matching could fail silently during persistence operations. On the dependency front, Spring AMQP bumped JUnit to 6.1.2 [1], a patch release that tightens test infrastructure. These are maintenance-grade updates across the stack, no breaking changes, no emergency patches required.

Action items

References

  1. [1] Bump org.junit:junit-bom from 6.1.1 to 6.1.2 ↗ spring-projects/spring-amqp
  2. [2] Reinstate invalid resource location checks spring-projects/spring-framework
  3. [3] Fixing propertyType matching for custom conversions ↗ spring-projects/spring-data-neo4j

Quick answers

What shipped in Spring on July 18, 2026?
Spring Framework reinstated critical resource location validation checks that prevent unauthorized static resource resolution in sensitive directories. In total, 2 commits and 2 pull requests landed.
Who contributed to Spring on July 18, 2026?
3 developers shipped this update, including dependabot, Brian Clozel, and ilgrosso.
What were the notable Spring updates?
Bump org.junit:junit-bom from 6.1.1 to 6.1.2, Reinstate invalid resource location checks, and Fixing propertyType matching for custom conversions.

More from @spring-projects

Spring @spring-projects

SPRING BOOT CLEANS HOUSE WHILE INTEGRATION FIXES KAFKA BATCH MODE

Spring Boot is removing deprecated code and exposing critical NIO APIs, while Spring Integration ships a fix for Kafka batch processing that was breaking downstream splitters.

Stéphane Nicoll gichanGim zxuhan BoykoAlex +2
java 37 shipped 1-min read
Spring @spring-projects

SPRING BOOT FIXES LAZY INITIALIZATION TRAP THAT BREAKS JPA APPS

Spring Boot patched a critical dependency loop where JPA configuration was forcing early instantiation of every AsyncTaskExecutor bean in your app, even when background bootstrapping wasn't enabled.

Ns Stéphane Nicoll dhruv-15-03 Jens Schauder +4
java 33 shipped 1-min read
Spring @spring-projects

SPRING BOOT PLUGS FILE HANDLE LEAK IN IMAGE BUILDPACK

Spring Boot's image buildpack was leaking file handles and orphaning temp files when resolving missing builder images, but a fix just landed to clean up both the streams and the intermediate artifacts.

SebTardif Stéphane Nicoll Tran Ngoc Nhan dependabot +1
java 16 shipped 1-min read
Spring @spring-projects

SPRING-AI FIXES CRITICAL TOOL CALLING BUG THAT BROKE OPENAI STRICT MODE

The `strict` parameter in OpenAI tool calling was silently failing across all Spring AI implementations because it was serialized in the wrong place in the payload.

prachipanditrao Taewoong Kim dependabot Brian Clozel
java 8 shipped 1-min read

Daily updates, in your inbox

Follow Spring

Spring Framework, Spring Boot, and the JVM enterprise layer We'll email you a link to confirm first.

Free. Confirm via email. Unsubscribe in one click.

— or follow the whole beat:

Elsewhere on the wire

CachyOS @cachyos

PACKAGE UPDATES ROLL ACROSS AUR DERIVED AND PROTON CACHYOS

Claude Desktop jumped to 1.22209.0, Zen Browser patched to 1.21.8b, and documentation fixes landed across the stack overnight.

Pete Viri Piotr Gorski Matias Peter Jung +2
infra 43 shipped 1-min read
Elixir & Phoenix Elixir & Phoenix

ELIXIR CUTS EXPONENTIAL GROWTH IN BDD INTERSECTIONS, PHOENIX LIVE VIEW SKIPS CLONES ON STABLE LISTS

The compiler just got smarter about preventing exponential blowup in type intersection logic, while Phoenix Live View stops wastefully copying keyed comprehensions that aren't moving.

José Valim Alexander Gubarev preciz SteffenDE
elixir 16 shipped 1-min read
.NET @dotnet

ASPNETCORE TIGHTENS AUTHORIZATION METADATA EVERYWHERE, BLAZOR DEBUGGING EXITS

Authorization policies now work consistently across all routing paths, not just endpoint middleware, while Blazor templates drop their deprecated WebAssembly debugging hook.

Javier Calvarro Nelson Copilot MayaKirova ilonatommy +4
dotnet 58 shipped 2-min read
FastAPI & Pydantic FastAPI & Pydantic

PYDANTIC TIGHTENS TYPE CHECKER ALIGNMENT AHEAD OF NEXT RELEASE

Pydantic just bumped mypy to 2.3.0 and pyright to 1.1.411, signaling a push to keep type checking in lockstep with the core validation engine.

Viicos
python 4 shipped 1-min read