Who contributed to Spring on August 21, 2026?

7 developers shipped this update, including Oliver Drotbohm, Gabriel Hall, Dave Syer, dimitarproynov, Ilayaperumal Gopinathan, dependabot, and Josh Cummings.

What were the notable Spring updates?

Deprecate AesBytesEncryptor, Add DelegatingGrpcAuthenticationExtractor, and Document extracting authentication from custom metadata.

@spring-projects

Spring Framework, Spring Boot, and the JVM enterprise layer

github ↗

Pick a date

Topics: Java Full archive →

The Wire · Showcase

SPRING SECURITY SPLITS AES CRYPTO AS DEPRECATION LOOMS

By RepoJournal · Filed 07:06 UTC on August 21, 2026 · About Spring

7 people shipped this

Gabriel Hall @Adrastopoulos 2 cited

Oliver Drotbohm @odrotbohm 1 cited

Dave Syer @dsyer 1 cited

Ilayaperumal Gopinathan @ilayaperumalg 1 cited

dependabot @dependabot 1 cited

Josh Cummings @jzheaux 1 cited

dimitarproynov @dimitarproynov

Spring Security is tearing apart its default AES encryption, and you need to know what's changing before your next upgrade.

Spring Security's Josh Cummings deprecated AesBytesEncryptor [1], splitting it into two implementations to move away from the default null IV arrangement, an alert for teams relying on Spring's out-of-the-box encryption. Meanwhile, spring-grpc elevates its authentication extractor composition to a public API with DelegatingGrpcAuthenticationExtractor [2], mirroring DelegatingAuthenticationConverter, so you can now wrap, pass, and test extractor compositions outside the builder. That work also brings fresh docs on reading auth from custom metadata keys [3], and in the release process, Dave Syer removed gpg tooling [4] as no longer needed, while spring-ai bumps to 2.0.2-SNAPSHOT [5] for its next development cycle. Spring security samples gets a routine javaformat checkstyle bump to 0.0.48 [6], and spring-plugin readies the next dev iteration [7]. Across 5 repos this period: 58 commits, 4 PRs, 4 releases, with the AesBytesEncryptor deprecation the one that should make you pause.

Action items

→ Review your use of AesBytesEncryptor and plan migration before it's removed spring-projects/spring-security [immediate]
→ Adopt DelegatingGrpcAuthenticationExtractor if you compose auth extractors in gRPC spring-projects/spring-grpc [plan]
→ Update to spring-javaformat 0.0.48 for the security samples build spring-projects/spring-security-samples [plan]

References

[1] Deprecate AesBytesEncryptor spring-projects/spring-security
[2] Add DelegatingGrpcAuthenticationExtractor ↗ spring-projects/spring-grpc
[3] Document extracting authentication from custom metadata ↗ spring-projects/spring-grpc
[4] Remove gpg tooling as no longer needed spring-projects/spring-grpc
[5] Set next development version spring-projects/spring-ai
[6] Bump io.spring.javaformat:spring-javaformat-checkstyle from 0.0.47 to 0.0.48 ↗ spring-projects/spring-security-samples
[7] GH-153 - Prepare next development iteration. spring-projects/spring-plugin

Quick answers

What shipped in Spring on August 21, 2026?: Spring Security is tearing apart its default AES encryption, and you need to know what's changing before your next upgrade. In total, 58 commits, 4 pull requests, and 4 releases landed.
Who contributed to Spring on August 21, 2026?: 7 developers shipped this update, including Oliver Drotbohm, Gabriel Hall, Dave Syer, dimitarproynov, Ilayaperumal Gopinathan, dependabot, and Josh Cummings.
What were the notable Spring updates?: Deprecate AesBytesEncryptor, Add DelegatingGrpcAuthenticationExtractor, and Document extracting authentication from custom metadata.

Spring Kafka leaks serializer resources in a silent bug

Spring Kafka's DelegatingByTypeSerializer has been leaking delegates for years, and a fix just landed with a cherry-pick across 4.1.x and 4.0.x.

java 8 shipped

@spring-projects Aug 20

Spring Security Stops Thread Leaks

Spring Security's SecurityContextHolderThreadLocalAccessor is sharing mutable state across threads, and a fix is already in motion.

java 15 shipped

@spring-projects Aug 19

SPRING TOOLS AND SECURITY GET JOLTED AS DOCS GO STALE

A precision refactor in Spring Tools and a sharp security fix force a triple-check on your build.

java 21 shipped

@spring-projects Aug 18

Logback 1.6.3 shuts down CVE-2026-19880 in Spring Security and Session

A critical logback security patch is forcing the entire Spring ecosystem to move in lockstep.

java 4 shipped

Elsewhere on the wire

AI Agents Aug 22

Cline hubs get drain and replay as Langchain plumb gates

Cline just shipped rollover-grade hub commands while Langchain exposes gateway internals, and OpenHands quietly broke its own monitoring contract.

ai-agents 42 shipped

Local LLMs Aug 22

SGLang ships v0.5.18 with 710 PRs and DeepSeek V4 FP4 auto-routing

The biggest release of the week just landed: SGLang v0.5.18 adds new models, fixes a silent disagg bug, and defaults DeepSeek V4 FP4 checkpoints to the right MoE runner.