Who contributed to Spring on August 21, 2026?

7 developers shipped this update, including Oliver Drotbohm, Gabriel Hall, Dave Syer, dimitarproynov, Ilayaperumal Gopinathan, dependabot, and Josh Cummings.

What were the notable Spring updates?

Deprecate AesBytesEncryptor, Add DelegatingGrpcAuthenticationExtractor, and Document extracting authentication from custom metadata.

Aug 21, 2026

$ the-wire · showcase

SPRING SECURITY SPLITS AES CRYPTO AS DEPRECATION LOOMS

By RepoJournal · Filed 07:06 UTC on August 21, 2026 · About Spring · Composed from the cited sources · methodology

7 people shipped this

Gabriel Hall @Adrastopoulos 2 cited

Oliver Drotbohm @odrotbohm 1 cited

Dave Syer @dsyer 1 cited

Ilayaperumal Gopinathan @ilayaperumalg 1 cited

dependabot @dependabot 1 cited

Josh Cummings @jzheaux 1 cited

dimitarproynov @dimitarproynov

Spring Security is tearing apart its default AES encryption, and you need to know what's changing before your next upgrade.

Spring Security's Josh Cummings deprecated AesBytesEncryptor [1], splitting it into two implementations to move away from the default null IV arrangement, an alert for teams relying on Spring's out-of-the-box encryption. Meanwhile, spring-grpc elevates its authentication extractor composition to a public API with DelegatingGrpcAuthenticationExtractor [2], mirroring DelegatingAuthenticationConverter, so you can now wrap, pass, and test extractor compositions outside the builder. That work also brings fresh docs on reading auth from custom metadata keys [3], and in the release process, Dave Syer removed gpg tooling [4] as no longer needed, while spring-ai bumps to 2.0.2-SNAPSHOT [5] for its next development cycle. Spring security samples gets a routine javaformat checkstyle bump to 0.0.48 [6], and spring-plugin readies the next dev iteration [7]. Across 5 repos this period: 58 commits, 4 PRs, 4 releases, with the AesBytesEncryptor deprecation the one that should make you pause.

Action items

→ Review your use of AesBytesEncryptor and plan migration before it's removed spring-projects/spring-security [immediate]
→ Adopt DelegatingGrpcAuthenticationExtractor if you compose auth extractors in gRPC spring-projects/spring-grpc [plan]
→ Update to spring-javaformat 0.0.48 for the security samples build spring-projects/spring-security-samples [plan]

References

[1] Deprecate AesBytesEncryptor ↗ spring-projects/spring-security
[2] Add DelegatingGrpcAuthenticationExtractor ↗ spring-projects/spring-grpc
[3] Document extracting authentication from custom metadata ↗ spring-projects/spring-grpc
[4] Remove gpg tooling as no longer needed ↗ spring-projects/spring-grpc
[5] Set next development version ↗ spring-projects/spring-ai
[6] Bump io.spring.javaformat:spring-javaformat-checkstyle from 0.0.47 to 0.0.48 ↗ spring-projects/spring-security-samples
[7] GH-153 - Prepare next development iteration. ↗ spring-projects/spring-plugin