Who contributed to Spring on August 20, 2026?

5 developers shipped this update, including dependabot, ttddyy, Josh Cummings, BoykoAlex, and Martin Lippert.

What were the notable Spring updates?

SecurityContextHolderThreadLocalAccessor should not share SecurityContext instance across threads, Prevent sharing SecurityContext across threads, and GH-1370: go to definition in SpEL expressions finds methods in the type hierarchy.

@spring-projects

Spring Framework, Spring Boot, and the JVM enterprise layer

github ↗

Pick a date

Topics: Java Full archive →

The Wire · Showcase

Spring Security Stops Thread Leaks

By RepoJournal · Filed 07:00 UTC on August 20, 2026 · About Spring

5 people shipped this

Martin Lippert @martinlippert 3 cited

dependabot @dependabot 2 cited

ttddyy @ttddyy 2 cited

Josh Cummings @jzheaux 2 cited

BoykoAlex @BoykoAlex 2 cited

Spring Security's SecurityContextHolderThreadLocalAccessor is sharing mutable state across threads, and a fix is already in motion.

Spring Security is fixing a cross-thread authentication leak [1]. The `SecurityContextHolderThreadLocalAccessor` propagates the same `SecurityContext` to other threads when Micrometer Context Propagation is used [1], which Tadaya Tsuyukubo warns "can cause authentication to leak between threads" [2]. The patch creates a fresh `SecurityContext` per target thread while reusing only the `Authentication` value [2]. Meanwhile, spring-tools landed a trio of SpEL navigation improvements [3] [4] [5], including go-to-definition across the type hierarchy and full annotation coverage. Dependabot churned out routine bumps for MockWebServer [6] and Jackson [7], and Josh Cummings merged 7.0.x into 7.1.x [8] [9]. The HQL and JPQL parser fix in spring-tools is a targeted bugfix [10] [11]. With 11 commits and 4 PRs across the repos, the thread-sharing fix is the one to watch.

Action items

→ Review SecurityContextHolderThreadLocalAccessor usage and test thread isolation in your Spring Security 7.x applications spring-projects/spring-security [immediate]
→ Watch for the merged fix in the next Spring Security release spring-projects/spring-security [plan]
→ Update to the latest spring-tools snapshot to get SpEL navigation fixes spring-projects/spring-tools [monitor]

References

[1] SecurityContextHolderThreadLocalAccessor should not share SecurityContext instance across threads ↗ spring-projects/spring-security
[2] Prevent sharing SecurityContext across threads spring-projects/spring-security
[3] GH-1370: go to definition in SpEL expressions finds methods in the type hierarchy spring-projects/spring-tools
[4] GH-1371: cover all Spring annotations that carry SpEL expressions spring-projects/spring-tools
[5] GH-1371: go to definition in SpEL expressions works for all annotations supporting SpEL spring-projects/spring-tools
[6] Bump com.squareup.okhttp3:mockwebserver from 5.4.0 to 5.5.0 ↗ spring-projects/spring-ldap
[7] Bump com.fasterxml.jackson:jackson-bom from 2.22.1 to 2.22.2 ↗ spring-projects/spring-security
[8] Merge branch '7.1.x' spring-projects/spring-security
[9] Merge branch '7.0.x' into 7.1.x spring-projects/spring-security
[10] Make proper parsing call for HQL and JPQL parser ↗ spring-projects/spring-tools
[11] Make proper parsing call for HQL and JPQL parser (#1969) spring-projects/spring-tools

Quick answers

What shipped in Spring on August 20, 2026?: Spring Security's SecurityContextHolderThreadLocalAccessor is sharing mutable state across threads, and a fix is already in motion. In total, 11 commits and 4 pull requests landed.
Who contributed to Spring on August 20, 2026?: 5 developers shipped this update, including dependabot, ttddyy, Josh Cummings, BoykoAlex, and Martin Lippert.
What were the notable Spring updates?: SecurityContextHolderThreadLocalAccessor should not share SecurityContext instance across threads, Prevent sharing SecurityContext across threads, and GH-1370: go to definition in SpEL expressions finds methods in the type hierarchy.

SPRING SECURITY SPLITS AES CRYPTO AS DEPRECATION LOOMS

Spring Security is tearing apart its default AES encryption, and you need to know what's changing before your next upgrade.

java 66 shipped

@spring-projects Aug 19

SPRING TOOLS AND SECURITY GET JOLTED AS DOCS GO STALE

A precision refactor in Spring Tools and a sharp security fix force a triple-check on your build.

java 21 shipped

@spring-projects Aug 18

Logback 1.6.3 shuts down CVE-2026-19880 in Spring Security and Session

A critical logback security patch is forcing the entire Spring ecosystem to move in lockstep.

java 4 shipped

@spring-projects Aug 17

LOGBACK 1.6.2 LANDS IN SPRING SECURITY

Spring Security bumped its logging dependency to the latest Logback patch, picking up bug fixes and stability improvements.

java 1 shipped

Elsewhere on the wire

AI Agents Aug 21

CLINE V4.1.11 SHIPS IMAGE GENERATION AND AGENT-UI FIXES

Cline's latest release lets models generate images mid-task, while LlamaIndex quietly breaks frontend tool handlers.

ai-agents 78 shipped

Local LLMs Aug 21

DeepSeek V4 fuses shared experts, as vLLM ships a security guard

The biggest local-LLM repos are moving fast: DeepSeek V4's MoE kernel gets a massive fusion, while vLLM patches a security hole.

+12

llms 274 shipped

@CachyOS Aug 21

CachyOS Scheduler Hotfixes and Kernel Upgrades Lead the Day

A hotfix for the scx_cake scheduler and the latest Linux 7.2 kernel are rolling out across CachyOS repos.

infra 66 shipped

Elixir & Phoenix Aug 21

Phoenix 1.8.12 patches channel message drop

Phoenix shipped a patch release that fixes a channel bug silently dropping messages without a join_ref, and LiveView is quietly rewriting the rules of navigation.