RepoJournal
Spring @spring-projects
107 wires and counting
$ status: archived — this briefing has stopped; the archive stays readable. browse live briefings →

$ status

wire 2026-08-20
stories 15
GitHub RSS Archive Reviews

© 2026 RepoJournal Home Showcase How it works Privacy

$ the-wire · showcase

Spring Security Stops Thread Leaks

By RepoJournal · Filed · About Spring · Composed from the cited sources · methodology

Martin Lippert dependabot ttddyy Josh Cummings BoykoAlex
5 people shipped this
Martin Lippert @martinlippert 3 cited dependabot @dependabot 2 cited ttddyy @ttddyy 2 cited Josh Cummings @jzheaux 2 cited BoykoAlex @BoykoAlex 2 cited

Spring Security's SecurityContextHolderThreadLocalAccessor is sharing mutable state across threads, and a fix is already in motion.

Spring Security is fixing a cross-thread authentication leak [1]. The `SecurityContextHolderThreadLocalAccessor` propagates the same `SecurityContext` to other threads when Micrometer Context Propagation is used [1], which Tadaya Tsuyukubo warns "can cause authentication to leak between threads" [2]. The patch creates a fresh `SecurityContext` per target thread while reusing only the `Authentication` value [2]. Meanwhile, spring-tools landed a trio of SpEL navigation improvements [3] [4] [5], including go-to-definition across the type hierarchy and full annotation coverage. Dependabot churned out routine bumps for MockWebServer [6] and Jackson [7], and Josh Cummings merged 7.0.x into 7.1.x [8] [9]. The HQL and JPQL parser fix in spring-tools is a targeted bugfix [10] [11]. With 11 commits and 4 PRs across the repos, the thread-sharing fix is the one to watch.

Action items

References

  1. [1] SecurityContextHolderThreadLocalAccessor should not share SecurityContext instance across threads ↗ spring-projects/spring-security
  2. [2] Prevent sharing SecurityContext across threads spring-projects/spring-security ↗
  3. [3] GH-1370: go to definition in SpEL expressions finds methods in the type hierarchy ↗ spring-projects/spring-tools
  4. [4] GH-1371: cover all Spring annotations that carry SpEL expressions ↗ spring-projects/spring-tools
  5. [5] GH-1371: go to definition in SpEL expressions works for all annotations supporting SpEL ↗ spring-projects/spring-tools
  6. [6] Bump com.squareup.okhttp3:mockwebserver from 5.4.0 to 5.5.0 ↗ spring-projects/spring-ldap
  7. [7] Bump com.fasterxml.jackson:jackson-bom from 2.22.1 to 2.22.2 ↗ spring-projects/spring-security
  8. [8] Merge branch '7.1.x' ↗ spring-projects/spring-security
  9. [9] Merge branch '7.0.x' into 7.1.x ↗ spring-projects/spring-security
  10. [10] Make proper parsing call for HQL and JPQL parser ↗ spring-projects/spring-tools
  11. [11] Make proper parsing call for HQL and JPQL parser (#1969) ↗ spring-projects/spring-tools

$ ls spring-projects/reviews/ # the step-back reads

the week in review Spring Kafka fixes multi-value JSON header loss the month in review Spring standardizes release trains while security patches and batch fixes surface
Full archive → Weekly reviews →

Quick answers

What shipped in Spring on August 20, 2026?
Spring Security's SecurityContextHolderThreadLocalAccessor is sharing mutable state across threads, and a fix is already in motion. In total, 11 commits and 4 pull requests landed.
Who contributed to Spring on August 20, 2026?
5 developers shipped this update, including dependabot, ttddyy, Josh Cummings, BoykoAlex, and Martin Lippert.
What were the notable Spring updates?
SecurityContextHolderThreadLocalAccessor should not share SecurityContext instance across threads, Prevent sharing SecurityContext across threads, and GH-1370: go to definition in SpEL expressions finds methods in the type hierarchy.
♥

$ log @spring-projects --recent

Kubernetes probe groups keep their defaults; multi-segment health paths land 90 shipped Kafka config building centralized, async listener results awaited on stop 52 shipped Spring Data moves to JSqlParser 5.4 and Hibernate 7.4.8.Final 11 shipped Spring Batch deprecates setters for required dependencies 5 shipped

$ log --all # elsewhere on the wire

Agent Security Quiet day in agent security as guard coverage reaches four clients Alignment & Post-training verl defaults Ascend RL mode, open-instruct unblocks SFT packing

$ ls showcases/

Safety Evals AI Red Teaming Agent Security Interpretability Alignment & Post-training

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.