RepoJournal
Spring

@spring-projects

Spring Framework, Spring Boot, and the JVM enterprise layer

What actually shipped in Spring, written up every day — commits, pull requests, releases, and security advisories.

One email a day. Unsubscribe in one click.

Pick a date

  1. Fri 12 jun
  2. Sat 13 jun
  3. Sun 14 jun
  4. Mon 15 jun
  5. Tue 16 jun
  6. Wed 17 jun
  7. Thu 18 jun
  8. Sat 27 jun
  9. Sun 28 jun
  10. Mon 29 jun
  11. Tue 30 jun
  12. Wed 1 jul
  13. Thu 2 jul
  14. Fri 3 jul
  15. Sat 4 jul
  16. Sun 5 jul
  17. Mon 6 jul
  18. Tue 7 jul
  19. Wed 8 jul
  20. Thu 9 jul
  21. Fri 10 jul
  22. Sat 11 jul
  23. Sun 12 jul
  24. Mon 13 jul
  25. Tue 14 jul
  26. Wed 15 jul
  27. Thu 16 jul
  28. Sat 18 jul
  29. Sun 19 jul
  30. Today 21 jul
Topics: Java Full archive →

The Wire · Showcase

SPRING INTEGRATION PATCHES CRITICAL CONCURRENCY BUG IN FILE FILTER

By RepoJournal · Filed · About Spring

Artem Bilan Stéphane Nicoll BoykoAlex dependabot
4 people shipped this
Artem Bilan @artembilan 3 cited Stéphane Nicoll @snicoll 2 cited BoykoAlex @BoykoAlex 2 cited dependabot @dependabot 1 cited

Spring Integration shipped fixes for race conditions that could corrupt internal data structures under concurrent load, with auto-cherry-picks queued for the 7.0.x branch.

The AcceptOnceFileListFilter race condition [1] is the story: a collision between the accept() method holding a lock and an unsynchronized remove() from another thread could corrupt the HashSet internal table. The fix swaps HashSet for ConcurrentHashMap.newKeySet(), eliminating the vulnerability entirely. Related concurrency fixes landed in LockRegistries [2], addressing over-eviction under concurrent runs in both JdbcLockRegistry and RedisLockRegistry. Spring Tools pushed two solid improvements: MySQL limit clause parameter support [3] closes a long-standing query builder gap, while org.json bumped to 20260719 [4] brings you current on JSON parsing. Spring Boot is running steady dependency hygiene across the stack, with Netty 4.2.16.Final [5], Maven Invoker Plugin 3.10.1 [6], and action runner bumps [8] keeping the CI pipeline tight. Spring AMQP fixed a subtle content-type matching bug [7] that could misfire Jackson message conversion when subtypes appeared elsewhere in the header.

One email a day. Unsubscribe in one click.

Action items

References

  1. [1] GH-11185: Fix concurrency in the AcceptOnceFileListFilter spring-projects/spring-integration
  2. [2] Fix race condition in LockRegistries spring-projects/spring-integration
  3. [3] Support parameters for MySql limit clause ↗ spring-projects/spring-tools
  4. [4] Update org.json to 20260719 ↗ spring-projects/spring-tools
  5. [5] Upgrade to Netty 4.2.16.Final spring-projects/spring-boot
  6. [6] Upgrade to Maven Invoker Plugin 3.10.1 spring-projects/spring-boot
  7. [7] GH-3520: Idiomatic C/T check in the JacksonMessageConverter spring-projects/spring-amqp
  8. [8] Bump actions/checkout from 7.0.0 to 7.0.1 ↗ spring-projects/spring-boot

Quick answers

What shipped in Spring on July 21, 2026?
Spring Integration shipped fixes for race conditions that could corrupt internal data structures under concurrent load, with auto-cherry-picks queued for the 7.0.x branch. In total, 54 commits and 7 pull requests landed.
Who contributed to Spring on July 21, 2026?
4 developers shipped this update, including dependabot, Stéphane Nicoll, BoykoAlex, and Artem Bilan.
What were the notable Spring updates?
GH-11185: Fix concurrency in the AcceptOnceFileListFilter, Fix race condition in LockRegistries, and Support parameters for MySql limit clause.

More from @spring-projects

Spring @spring-projects

SPRING INTEGRATION DEPENDENCY SWEEP: KOTLIN, JUNIT, MONGODB, AND GREENMAIL ALL PATCHED

Spring Integration is closing out routine maintenance across its test and database tooling, with Kotlin bumped two minor versions and MongoDB reactive streams bug fixed.

dependabot
java 4 shipped 1-min read
Spring @spring-projects

SPRING FRAMEWORK TIGHTENS RESOURCE SECURITY, NEO4J FIXES CONVERSION LOGIC

Spring Framework reinstated critical resource location validation checks that prevent unauthorized static resource resolution in sensitive directories.

dependabot Brian Clozel ilgrosso
java 4 shipped 1-min read
Spring @spring-projects

SPRING BOOT CLEANS HOUSE WHILE INTEGRATION FIXES KAFKA BATCH MODE

Spring Boot is removing deprecated code and exposing critical NIO APIs, while Spring Integration ships a fix for Kafka batch processing that was breaking downstream splitters.

Stéphane Nicoll gichanGim zxuhan BoykoAlex +2
java 37 shipped 1-min read
Spring @spring-projects

SPRING BOOT FIXES LAZY INITIALIZATION TRAP THAT BREAKS JPA APPS

Spring Boot patched a critical dependency loop where JPA configuration was forcing early instantiation of every AsyncTaskExecutor bean in your app, even when background bootstrapping wasn't enabled.

Ns Stéphane Nicoll dhruv-15-03 Jens Schauder +4
java 33 shipped 1-min read

Daily updates, in your inbox

Follow Spring

What actually shipped in Spring, written up every day — commits, pull requests, releases, and security advisories.

or

One email a day. Unsubscribe in one click. Read a past issue →

Elsewhere on the wire

CachyOS @cachyos

NORWAY MIRROR DOWN, KERNEL STACK SHIPS MAINTENANCE RELEASES

CachyOS infrastructure is reporting a downed Norway mirror while the kernel and toolchain stacks push routine version bumps across the board.

Piotr Gorski Matias miwakasa ptr1337 +2
infra 55 shipped 1-min read
Elixir & Phoenix Elixir & Phoenix

ECTO GAINS FRAGMENT COLUMN NAMING, PHOENIX PLUGS GET SMARTER

Ecto's new with_columns/2 lets you assign names to SQL fragments, while Phoenix now handles module plugs with options in pipe_through declarations.

José Valim AlexGx preciz Flo0807 +3
elixir 14 shipped 1-min read
Mobile platforms Mobile platforms

KOTLIN RIPS OUT INTERPRETER GUTS, FLUTTER PATCHES RENDERING PIPELINE

Kotlin is systematically removing its IR interpreter in a multi-commit cleanup that signals a major shift in how the compiler handles intermediate representation, while Flutter ships critical Vulkan safety fixes and expands autofill support.

Mohellebi Abdessalem jason-simmons Valentin Vignal jameskrupnik +7
mobile 115 shipped 2-min read
.NET @dotnet

MAUI 11 PREVIEW 6 SHIPS WITH 190 COMMITS, MACIOS FIXES GENERATOR FLAKINESS

.NET MAUI 11.0.0-preview.6 landed with significant platform improvements while dotnet/macios tackles a critical test parallelization bug that was silently dropping thread-safety calls from generated code.

kubaflo Shane Neuville rolfbjarne VincentBu +6
dotnet 59 shipped 2-min read
Want every project, not just this one?