Who contributed to Spring on August 12, 2026?

8 developers shipped this update, including Christoph Strobl, Stéphane Nicoll, Tran Ngoc Nhan, Oliver Drotbohm, Mark Paluch, Kim Tae Eun, Josh Cummings, and therepanic.

What were the notable Spring updates?

Remove BeanResolver Null Checks, Apply consumer-specific security protocol, and Start building against Spring Security 7.2.0-M1 snapshots.

@spring-projects

Spring Framework, Spring Boot, and the JVM enterprise layer

github ↗

Pick a date

Topics: Java Full archive →

The Wire · Showcase

SPRING SECURITY TIGHTENS AUTH CHECKS WHILE BOOT HARDENS PROTOCOL STANCE

By RepoJournal · Filed 07:00 UTC on August 12, 2026 · About Spring

8 people shipped this

Oliver Drotbohm @odrotbohm 5 cited

Stéphane Nicoll @snicoll 2 cited

Christoph Strobl @christophstrobl 1 cited

Tran Ngoc Nhan @ngocnhan-tran1996 1 cited

Mark Paluch @mp911de 1 cited

Kim Tae Eun @snowykte0426 1 cited

Josh Cummings @jzheaux 1 cited

therepanic @therepanic 1 cited

Spring Security is cleaning house with breaking changes around null checks and account validation, while Spring Boot locks down consumer security protocols and aligns on Security 7.2 milestones.

The big move: Spring Security removes BeanResolver null checks [1] now that Spring Framework 6.1 fixed the underlying limitation, eliminating workarounds across multiple auth sites. In parallel, Security strips unnecessary casts from authorization decisions [12] and hardens OneTimeTokenAuthenticationProvider with explicit account status validation [11] to match the rigor of AbstractUserDetailsAuthenticationProvider. Over on Spring Boot, a consumer-specific security protocol change lands [2] and the framework now builds against Spring Security 7.2.0-M1 snapshots [3], signaling the next major alignment. Spring Modulith is prepping for release train infrastructure [13] while pulling in Spring Boot 4.2 snapshots [4] and Framework 7.1 snapshots [5]. Meanwhile, Spring Data Modulith adds JobRunr 8.8.1 [6], jGit 7.7.1 [7], and Spring Data Relational enables SQL Server tests on Apple Silicon [8]. MongoDB driver moves to 5.9.2 [9]. Security 6.5.x exits Dependabot [10], a clear signal to plan migration paths.

Action items

→ Audit OneTimeTokenAuthenticationProvider usage if you use one-time tokens—account status validation is now mandatory [ref:15] spring-projects/spring-security [plan]
→ Begin Spring Security 7.2.0-M1 testing alongside Spring Boot 4.2 snapshots if on Boot main [ref:3] spring-projects/spring-boot [monitor]
→ Update Spring Data MongoDB to 5.9.2 at next release cycle [ref:1] spring-projects/spring-data-mongodb [plan]
→ Plan Spring Security 6.5.x migration—it leaves Dependabot coverage [ref:14] spring-projects/spring-security [immediate]

References

[1] Remove BeanResolver Null Checks spring-projects/spring-security
[2] Apply consumer-specific security protocol spring-projects/spring-boot
[3] Start building against Spring Security 7.2.0-M1 snapshots spring-projects/spring-boot
[4] GH-1798 - Upgrade to Spring Boot 4.2 snapshots. spring-projects/spring-modulith
[5] GH-1799 - Upgrade to Spring Framework 7.1 snapshots. spring-projects/spring-modulith
[6] GH-1793 - Upgrade to JobRunr 8.8.1. spring-projects/spring-modulith
[7] GH-1794 - Upgrade to jGit 7.7.1.202607240634-r. spring-projects/spring-modulith
[8] Enable SQL server integration tests on Apple Silicon (`aarch64`). spring-projects/spring-data-relational
[9] Upgrade to MongoDB 5.9.2 spring-projects/spring-data-mongodb
[10] Remove 6.5.x from Dependabot spring-projects/spring-security
[11] Validate account status in OneTimeTokenAuthenticationProvider ↗ spring-projects/spring-security
[12] Remove Unnecessary `AuthorizationDecision` Cast spring-projects/spring-security
[13] GH-1795 - Set up release train infrastructure. spring-projects/spring-modulith

Quick answers

What shipped in Spring on August 12, 2026?: Spring Security is cleaning house with breaking changes around null checks and account validation, while Spring Boot locks down consumer security protocols and aligns on Security 7.2 milestones. In total, 67 commits and 21 pull requests landed.
Who contributed to Spring on August 12, 2026?: 8 developers shipped this update, including Christoph Strobl, Stéphane Nicoll, Tran Ngoc Nhan, Oliver Drotbohm, Mark Paluch, Kim Tae Eun, Josh Cummings, and therepanic.
What were the notable Spring updates?: Remove BeanResolver Null Checks, Apply consumer-specific security protocol, and Start building against Spring Security 7.2.0-M1 snapshots.

SPRING KAFKA FIXES BATCH LISTENER STATE CORRUPTION ACROSS PARTITIONS

Spring Kafka shipped a critical fix for batch listener backoff state that was being wiped across all partitions in multi-partition containers, causing failed messages to lose their retry count mid-cycle.

java 19 shipped

@spring-projects Aug 11

SPRING SECURITY MOVES TO RELEASE TRAIN, SPRING INTEGRATION CRUSHES FLAKY TESTS

Spring Security removed its custom release workflows in favor of release train support, a structural shift that simplifies the entire project's delivery cadence [ref:13].

java 61 shipped

@spring-projects Aug 10

SPRING DATA STANDARDIZES RELEASE AUTOMATION ACROSS THREE MAJOR PROJECTS

Spring Data is rolling out unified release train automation to Couchbase, Elasticsearch, and Redis, centralizing how three of its heaviest-traffic projects ship.

java 3 shipped

@spring-projects Aug 9

SPRING-NET ESCAPES LOGGING BREAKAGE, SPRING-BOOT SWEEPS DEPENDENCY UPGRADES

Spring.NET fixes a critical configuration regression from its logging migration while Spring Boot ships five coordinated dependency upgrades across the messaging and caching stack.

java 25 shipped

Elsewhere on the wire

AI Agents Aug 13

ANTHROPIC INTEGRATION FIXES TOOL BLOCKS, OPENHANDS UNBLOCKS CI, CLINE PATCHES COMPOSER WEDGE

LangChain's Anthropic integration corrected tool result handling and model profiles [ref:1], while OpenHands fixed a critical test infrastructure failure blocking all PRs and shipped 1.13.0 with conversation archives [ref:6][ref:9].