Who contributed to Spring on August 18, 2026?

1 developer shipped this update, including dependabot.

What were the notable Spring updates?

Bump ch.qos.logback:logback-classic from 1.6.2 to 1.6.3, Bump ch.qos.logback:logback-core from 1.6.1 to 1.6.3, and Bump tools.jackson:jackson-bom from 3.2.1 to 3.2.2.

@spring-projects

Spring Framework, Spring Boot, and the JVM enterprise layer

github ↗

Pick a date

Topics: Java Full archive →

The Wire · Showcase

Logback 1.6.3 shuts down CVE-2026-19880 in Spring Security and Session

By RepoJournal · Filed 06:59 UTC on August 18, 2026 · About Spring

1 person shipped this

dependabot @dependabot 4 cited

A critical logback security patch is forcing the entire Spring ecosystem to move in lockstep.

Dependabot is pulling logback 1.6.3 into both spring-security [1] and spring-session [2] to close CVE-2026-19880, which targets MDCBasedDiscriminator. The release notes state the fix is "In response CVE-2026-19880", and it's a drop-everything upgrade if you use SiftingAppender in production. Meanwhile, spring-security also bumps jackson-bom to 3.2.2 [3], keeping JSON handling current with FasterXML's latest patch release. Over in spring-ldap, antora advances to 3.2.0-rc.3 [4], adding an antoraVersion property to the playbook builder, which mainly matters for docs tooling. With only 4 PRs across 3 repos, this is a quiet day, but the logback CVE makes the upgrade imperative.

Action items

→ Upgrade logback-classic to 1.6.3 in spring-security before next deploy spring-projects/spring-security [immediate]
→ Upgrade logback-core to 1.6.3 in spring-session to patch CVE-2026-19880 spring-projects/spring-session [immediate]
→ Review jackson-bom 3.2.2 update for compatibility in spring-security spring-projects/spring-security [plan]
→ Monitor antora 3.2.0-rc.3 for docs build issues spring-projects/spring-ldap [monitor]

References

[1] Bump ch.qos.logback:logback-classic from 1.6.2 to 1.6.3 ↗ spring-projects/spring-security
[2] Bump ch.qos.logback:logback-core from 1.6.1 to 1.6.3 ↗ spring-projects/spring-session
[3] Bump tools.jackson:jackson-bom from 3.2.1 to 3.2.2 ↗ spring-projects/spring-security
[4] Bump antora from 3.2.0-rc.2 to 3.2.0-rc.3 ↗ spring-projects/spring-ldap

Quick answers

What shipped in Spring on August 18, 2026?: A critical logback security patch is forcing the entire Spring ecosystem to move in lockstep. In total, 4 pull requests landed.
Who contributed to Spring on August 18, 2026?: 1 developer shipped this update, including dependabot.
What were the notable Spring updates?: Bump ch.qos.logback:logback-classic from 1.6.2 to 1.6.3, Bump ch.qos.logback:logback-core from 1.6.1 to 1.6.3, and Bump tools.jackson:jackson-bom from 3.2.1 to 3.2.2.

LOGBACK 1.6.2 LANDS IN SPRING SECURITY

Spring Security bumped its logging dependency to the latest Logback patch, picking up bug fixes and stability improvements.

java 1 shipped

@spring-projects Aug 16

SPRING TOOLS MAINTENANCE SWEEP LANDS SYMBOL NAVIGATION FIX

Martin Lippert shipped two commits to Spring Tools overnight, including a fix for the goto symbol popup that now remembers your dialog preferences.

java 2 shipped

@spring-projects Aug 14

SPRING FRAMEWORK 7.1 FORCES RECKONING ACROSS SECURITY, AMQP, AND BOOT

Spring Security and Spring AMQP are shipping deprecation fixes ahead of Framework 7.1's removal of RestTemplate and HandlerMappingIntrospector, while Boot adapts to upstream dependency shifts.

java 28 shipped

@spring-projects Aug 13

SPRING KAFKA FIXES BATCH LISTENER STATE CORRUPTION ACROSS PARTITIONS

Spring Kafka shipped a critical fix for batch listener backoff state that was being wiped across all partitions in multi-partition containers, causing failed messages to lose their retry count mid-cycle.