RepoJournal
Spring

@spring-projects

Spring Framework, Spring Boot, and the JVM enterprise layer

Keep up with Spring in about 3 minutes a day: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

One email a day. Unsubscribe in one click.

Pick a date

  1. Mon 6 jul
  2. Tue 7 jul
  3. Wed 8 jul
  4. Thu 9 jul
  5. Fri 10 jul
  6. Sat 11 jul
  7. Sun 12 jul
  8. Mon 13 jul
  9. Tue 14 jul
  10. Wed 15 jul
  11. Thu 16 jul
  12. Sat 18 jul
  13. Sun 19 jul
  14. Tue 21 jul
  15. Wed 22 jul
  16. Thu 23 jul
  17. Fri 24 jul
  18. Sat 25 jul
  19. Sun 26 jul
  20. Mon 27 jul
  21. Tue 28 jul
  22. Wed 29 jul
  23. Thu 30 jul
  24. Fri 31 jul
  25. Sat 1 aug
  26. Sun 2 aug
  27. Mon 3 aug
  28. Tue 4 aug
  29. Wed 5 aug
  30. Today 6 aug
Topics: Java Full archive →

The Wire · Showcase

Spring stacks release train automation across 5 repos, JWT decoder timeouts jump 60x

By RepoJournal · Filed · About Spring

Stéphane Nicoll Mark Paluch Josh Cummings Sumit Kumar Das cppwfs Artem Bilan
6 people shipped this
Stéphane Nicoll @snicoll 4 cited Mark Paluch @mp911de 2 cited Josh Cummings @jzheaux 1 cited Sumit Kumar Das @skdas20 1 cited cppwfs @cppwfs 1 cited Artem Bilan @artembilan

Spring Data and Security are automating their release cycles while Spring Boot consolidates snapshots from four major dependencies, marking the start of coordinated platform rollout across the ecosystem.

Release train automation landed in Spring Data BOM and Neo4j [1] [2], centralizing what was manual coordination work and clearing the path for faster, predictable cadence across the data layer. Spring Boot is now building against Security 7.0.7, Data Bom 2026.1.0-M1, AMQP 4.2.0-M1, and Micrometer Tracing 1.8.0-M1 snapshots [3] [4] [5] [6], converging on versions that haven't shipped yet. The move matters because it signals the team expects those releases in the next cycle and gives consumers early signal on what's coming. Spring Security hardened NimbusJwtDecoder's default timeouts from 500 milliseconds to 30 seconds [7], a 60x jump that prevents cascade failures when JWKS endpoints lag, and clarified proxy header handling to distinguish RFC 7239's standard Forwarded header from non-standard X-Forwarded-* variants [8]. Spring Integration gutted its monolithic root build.gradle, splitting 42 modules into standalone build files to cut the root config from 1155 lines to roughly 300 [9], trading centralized coordination for co-located maintainability and faster iteration on module-specific dependencies.

One email a day. Unsubscribe in one click.

Action items

References

  1. [1] Add release train automation. spring-projects/spring-data-bom
  2. [2] Add release train automation. spring-projects/spring-data-neo4j
  3. [3] Start building against Spring Security 7.0.7 snapshots spring-projects/spring-boot
  4. [4] Start building against Spring Data Bom 2026.1.0-M1 snapshots spring-projects/spring-boot
  5. [5] Start building against Spring AMQP 4.2.0-M1 snapshots spring-projects/spring-boot
  6. [6] Start building against Micrometer Tracing 1.8.0-M1 snapshots spring-projects/spring-boot
  7. [7] Increase Default NimbusJwtDecoder Timeouts to 30 Seconds spring-projects/spring-security
  8. [8] Differentiate Forwarded and X-Forwarded headers in proxy docs spring-projects/spring-security
  9. [9] Modularize Gradle build into per-module build files ↗ spring-projects/spring-integration

Quick answers

What shipped in Spring on August 4, 2026?
Spring Data and Security are automating their release cycles while Spring Boot consolidates snapshots from four major dependencies, marking the start of coordinated platform rollout across the ecosystem. In total, 60 commits and 2 pull requests landed.
Who contributed to Spring on August 4, 2026?
6 developers shipped this update, including Mark Paluch, Stéphane Nicoll, Josh Cummings, Sumit Kumar Das, cppwfs, and Artem Bilan.
What were the notable Spring updates?
Add release train automation, Add release train automation, and Start building against Spring Security 7.0.7 snapshots.

More from @spring-projects

Spring @spring-projects

SPRING-AI FIXES AZURE AUTHENTICATION MESS, KAFKA CONSOLIDATES BUILD

Spring AI patched a critical Azure OpenAI credential bug that was forcing unnecessary example.com requests through corporate proxies, while Spring Kafka overhauled its dependency management to centralize version control.

jewoodev Dimitar Proynov Sébastien Deleuze subhash polisetti +3
java 23 shipped
Spring @spring-projects

SPRING INTEGRATION UPGRADES TO CAMEL 4.21.0 AS RELEASE TRAIN AUTOMATION LANDS ACROSS ECOSYSTEM

Apache Camel 4.21.0 arrives in Spring Integration with nullability fixes, while release train automation rolls out to consolidate version management across Spring Data, AMQP, and Integration.

Mark Paluch dependabot Glenn Renfro Artem Bilan +1
java 10 shipped
Spring @spring-projects

SPRING BOOT SCRUBS OBSOLETE INFLUXDB DOCS AHEAD OF 4.0 RELEASE

Spring Boot cleaned up stale InfluxDB auto-configuration references that have been dead code since 3.4.0, ensuring the 4.0 release docs match reality.

Stéphane Nicoll Alexander Makarov dependabot sothawo
java 10 shipped
Spring @spring-projects

SPRING BATCH MOVES TO 6.1.0, DEPENDENCY UPDATES ROLL OUT ACROSS ECOSYSTEM

Spring Batch entered development mode for its next major version as routine dependency patches landed across Integration and Kafka.

dependabot Mahmoud Ben Hassine
java 3 shipped

Daily updates, in your inbox

Follow Spring

Keep up with Spring in about 3 minutes a day: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

One email a day. Unsubscribe in one click. Read a past issue →

Elsewhere on the wire

AI Agents AI Agents

LANGCHAIN HARDENS ANTHROPIC TOOL CALLING AND GIT CREDENTIALS AS OPENHANDS SHIPS 1.10.0

LangChain fixed a critical credential leak in evaluation runs while Anthropic tool schemas get proper fallback handling, as three major agent frameworks push releases across the ecosystem.

langchain-oss-model-profiles[bot] Mason Daugherty John Kennedy ccurme +7
ai-agents 54 shipped
Local LLMs Local LLMs

OLLAMA FIXES KV CACHE CORRUPTION, LLAMA.CPP HARDENS FILE SEARCH, VLLM KILLS MOE LEGACY CODE

Ollama patched a critical cache corruption bug that corrupts lazy snapshots during multi-request prefills, while llama.cpp hardened Windows junction traversal and vLLM removed 14 hardcoded MoE shards across quantization methods.

jessegross Daniel Hiltgen Xuan-Son Nguyen Niklas Wenzel +10
llms 240 shipped
CachyOS @CachyOS

WIKI TRANSLATION ROLLBACK CHAOS, MIRROR STACK HOLDING STEADY

CachyOS wiki maintainers are caught in a revert loop over German translations while the status infrastructure logs 55 commits without incident.

Jinra Aarrayy buster-biopsys
infra 57 shipped
Elixir & Phoenix Elixir & Phoenix

ELIXIR BUMPS ZIZMOR SECURITY SCANNER TO 1.28.0

The Elixir repo updated its CI security action overnight, pulling in the latest zizmor static analysis tooling.

dependabot
elixir 1 shipped
Want every project, not just this one?