Who contributed to Spring on July 21, 2026?

4 developers shipped this update, including dependabot, Stéphane Nicoll, BoykoAlex, and Artem Bilan.

What were the notable Spring updates?

GH-11185: Fix concurrency in the AcceptOnceFileListFilter, Fix race condition in LockRegistries, and Support parameters for MySql limit clause.

Jul 21, 2026

$ the-wire · showcase

SPRING INTEGRATION PATCHES CRITICAL CONCURRENCY BUG IN FILE FILTER

By RepoJournal · Filed 07:01 UTC on July 21, 2026 · About Spring · Composed from the cited sources · methodology

4 people shipped this

Artem Bilan @artembilan 3 cited

Stéphane Nicoll @snicoll 2 cited

BoykoAlex @BoykoAlex 2 cited

dependabot @dependabot 1 cited

Spring Integration shipped fixes for race conditions that could corrupt internal data structures under concurrent load, with auto-cherry-picks queued for the 7.0.x branch.

In brief

Spring Integration patches AcceptOnceFileListFilter concurrency bug (GH-11185). if you're using file filters in a multi-threaded context, this is a must-pull.
Spring Integration also fixed a race condition in LockRegistries. concurrent file access just got safer.
Spring Boot upgraded to Netty 4.2.16.Final. mostly stability fixes. boring in the best way.
Spring AMQP improved the Jackson message converter with cleaner type checking. small change, makes the code less weird to read.

The AcceptOnceFileListFilter race condition [1] is the story: a collision between the accept() method holding a lock and an unsynchronized remove() from another thread could corrupt the HashSet internal table. The fix swaps HashSet for ConcurrentHashMap.newKeySet(), eliminating the vulnerability entirely. Related concurrency fixes landed in LockRegistries [2], addressing over-eviction under concurrent runs in both JdbcLockRegistry and RedisLockRegistry. Spring Tools pushed two solid improvements: MySQL limit clause parameter support [3] closes a long-standing query builder gap, while org.json bumped to 20260719 [4] brings you current on JSON parsing. Spring Boot is running steady dependency hygiene across the stack, with Netty 4.2.16.Final [5], Maven Invoker Plugin 3.10.1 [6], and action runner bumps [8] keeping the CI pipeline tight. Spring AMQP fixed a subtle content-type matching bug [7] that could misfire Jackson message conversion when subtypes appeared elsewhere in the header.

Action items

→ If you run Spring Integration with AcceptOnceFileListFilter in a concurrent environment, pull the race condition fix immediately spring-projects/spring-integration [immediate]
→ Upgrade Spring Boot dependencies (Netty, Maven Invoker) in your next routine patch cycle spring-projects/spring-boot [plan]
→ Monitor Spring AMQP deployments for content-type edge cases if you send multipart or complex MIME types spring-projects/spring-amqp [monitor]

References

[1] GH-11185: Fix concurrency in the AcceptOnceFileListFilter ↗ spring-projects/spring-integration
[2] Fix race condition in LockRegistries ↗ spring-projects/spring-integration
[3] Support parameters for MySql limit clause ↗ spring-projects/spring-tools
[4] Update org.json to 20260719 ↗ spring-projects/spring-tools
[5] Upgrade to Netty 4.2.16.Final ↗ spring-projects/spring-boot
[6] Upgrade to Maven Invoker Plugin 3.10.1 ↗ spring-projects/spring-boot
[7] GH-3520: Idiomatic C/T check in the JacksonMessageConverter ↗ spring-projects/spring-amqp
[8] Bump actions/checkout from 7.0.0 to 7.0.1 ↗ spring-projects/spring-boot