Who contributed to Spring on July 23, 2026?

5 developers shipped this update, including dimitarproynov, Taewoong Kim, artembilan, Brian Clozel, and Stéphane Nicoll.

What were the notable Spring updates?

Omit exception messages from error response bodies in the MCP server transports, Omit unused embeddings from RedisVectorStore search responses, and GH-3529: Fix concurrency in RabbitAmqpListenerContainer.ConsumerBatch.

@spring-projects

Spring Framework, Spring Boot, and the JVM enterprise layer

github ↗

Pick a date

Topics: Java Full archive →

The Wire · Showcase

SPRING AI HARDENS ERROR HANDLING, REDIS VECTORSTORE SHEDS BANDWIDTH BLOAT

By RepoJournal · Filed 07:01 UTC on July 23, 2026 · About Spring

5 people shipped this

Stéphane Nicoll @snicoll 2 cited

dimitarproynov @dimitarproynov 1 cited

Taewoong Kim @ultramancode 1 cited

artembilan @artembilan 1 cited

Brian Clozel @bclozel 1 cited

Spring AI is tightening its security posture on two fronts: MCP server transports now strip exception messages from error responses, while RedisVectorStore cuts network waste by 37 KB per embedding lookup.

In brief

Spring AI's MCP server transports now omit exception messages from error response bodies. less info leakage, cleaner logs. security by default beats explaining it later.
RedisVectorStore search responses no longer ship unused embeddings. sounds small until you're pushing millions of vectors. bandwidth and latency both drop.
Spring AMQP fixed a concurrency bug in RabbitMqListenerContainer.ConsumerBatch. if you're seeing phantom message duplicates, this one's for you.
Spring GraphQL now defers the WebSocket connection init flag. timing fix that squashes race conditions in real-time subscriptions.

The MCP server transport fix [1] closes a gap where exception messages could leak from session initialization, deletion, and response serialization failures. Those tool-level errors still surface normally through the callback pipeline, so legitimate debugging information stays intact; this just hardens the wire protocol. Meanwhile, RedisVectorStore search responses [2] were shipping unused embeddings back to clients on every query, burning roughly 37 KB per result for 3072-dimensional vectors multiplied by topK. The fix removes the embedding field from getReturnFields() and eliminates redundant inline return clauses, cutting unnecessary bandwidth without changing the API surface. On the messaging side, Spring AMQP merged a critical concurrency fix [3] for RabbitAmqpListenerContainer.ConsumerBatch, where releaseInternal() could fire simultaneously from scheduled tasks and batch fulfillment, creating duplicate release calls. The patch adds a lock and a released flag to serialize those operations safely. Spring GraphQL also tightened WebSocket ordering [4] to match the spec: connection_init handling now completes entirely before other messages are processed, eliminating a race condition that could violate protocol sequence guarantees. Spring Boot landed a handful of housekeeping fixes across 4.0.x and 4.1.x branches [5], [6], including servlet-API scope correction for h2-console and support for NestedConfigurationProperty on record accessors.

Action items

→ Upgrade Spring AI if you expose MCP server transports publicly; redeploy to stop leaking exception details spring-projects/spring-ai [plan]
→ Update Spring AMQP to pick up the ConsumerBatch concurrency fix before your next RabbitMQ deployment spring-projects/spring-amqp [plan]
→ Monitor Spring GraphQL WebSocket connections if you run GraphQL over WS; verify connection_init timing after upgrade spring-projects/spring-graphql [monitor]

References

[1] Omit exception messages from error response bodies in the MCP server transports ↗ spring-projects/spring-ai
[2] Omit unused embeddings from RedisVectorStore search responses spring-projects/spring-ai
[3] GH-3529: Fix concurrency in RabbitAmqpListenerContainer.ConsumerBatch ↗ spring-projects/spring-amqp
[4] Defer the setting of connection init flag in WebSocket handlers spring-projects/spring-graphql
[5] Fix servlet-api dependency scope for spring-boot-h2-console spring-projects/spring-boot
[6] Allow NestedConfigurationProperty to be set on a record accessor spring-projects/spring-boot

Quick answers

What shipped in Spring on July 23, 2026?: Spring AI is tightening its security posture on two fronts: MCP server transports now strip exception messages from error responses, while RedisVectorStore cuts network waste by 37 KB per embedding lookup. In total, 10 commits and 2 pull requests landed.
Who contributed to Spring on July 23, 2026?: 5 developers shipped this update, including dimitarproynov, Taewoong Kim, artembilan, Brian Clozel, and Stéphane Nicoll.
What were the notable Spring updates?: Omit exception messages from error response bodies in the MCP server transports, Omit unused embeddings from RedisVectorStore search responses, and GH-3529: Fix concurrency in RabbitAmqpListenerContainer.ConsumerBatch.

SPRING BOOT TIGHTENS NULLABILITY CHECKS, FRAMEWORK CLEANS HOUSE

Spring Boot merged improvements to Nullaway 0.13.8 that correctly handle Map#remove nullability, while Spring Framework shipped targeted fixes for logging clarity and documentation.

java 17 shipped 1-min read

@spring-projects 2 days ago

SPRING INTEGRATION PATCHES CRITICAL CONCURRENCY BUG IN FILE FILTER

Spring Integration shipped fixes for race conditions that could corrupt internal data structures under concurrent load, with auto-cherry-picks queued for the 7.0.x branch.

java 61 shipped 1-min read

@spring-projects 4 days ago

SPRING INTEGRATION DEPENDENCY SWEEP: KOTLIN, JUNIT, MONGODB, AND GREENMAIL ALL PATCHED

Spring Integration is closing out routine maintenance across its test and database tooling, with Kotlin bumped two minor versions and MongoDB reactive streams bug fixed.

java 4 shipped 1-min read

@spring-projects 5 days ago

SPRING FRAMEWORK TIGHTENS RESOURCE SECURITY, NEO4J FIXES CONVERSION LOGIC

Spring Framework reinstated critical resource location validation checks that prevent unauthorized static resource resolution in sensitive directories.

java 4 shipped 1-min read

Elsewhere on the wire

AI Agents about 7 hours ago

LANGCHAIN REFRESHES MODEL PROFILES, OPENROUTER 0.2.7 SHIPS

OpenRouter integration lands with updated model profiles including Google's Gemini 3.5 Flash Lite, while core token counting gets a performance fix for multi-tool agents.

ai-agents 29 shipped 1-min read

Local LLMs about 7 hours ago

OLLAMA AGENTS NOW IMPORT SKILLS FROM CODEX AND CLAUDE

Ollama shipped a skills import system that lets coding agents pull validated skill directories from external sources, while simultaneous fixes to GLM tool-call parsing and Laguna model alignment prevent agents from silently failing.

+10

llms 212 shipped 2-min read

@CachyOS about 8 hours ago

BRAVE BROWSER SOURCES SHIFT TO APT, GAME RULES SURGE, GERMAN WIKI TRANSLATIONS ACCELERATE

CachyOS is consolidating Brave packaging around apt sources while ananicy-rules absorbs a massive gaming ruleset expansion and the wiki team pushes German localization across multiple docs.

infra 81 shipped 1-min read

Elixir & Phoenix about 8 hours ago

ELIXIR FIXES CALENDAR AND COMPILER EDGE CASES ACROSS FIVE PATCHES

Alexander Gubarev landed five targeted fixes to Calendar.ISO and ParallelCompiler that close gaps in time parsing, validation guards, and documentation.

elixir 15 shipped 1-min read

Want every project, not just this one?

Follow @spring-projects