Who contributed to Spring on August 22, 2026?

4 developers shipped this update, including dependabot, Martin Lippert, dlwldn30, and Josh Cummings.

What were the notable Spring updates?

GH-4569: Close delegates in DelegatingByTypeSerializer (#4570), GH-4569: Close delegates in DelegatingByTypeSerializer, and Bump com.fasterxml.jackson:jackson-bom from 2.22.1 to 2.22.2.

@spring-projects

Spring Framework, Spring Boot, and the JVM enterprise layer

github ↗

Pick a date

Topics: Java Full archive →

The Wire · Showcase

Spring Kafka leaks serializer resources in a silent bug

By RepoJournal · Filed 06:59 UTC on August 22, 2026 · About Spring

4 people shipped this

dependabot @dependabot 3 cited

Martin Lippert @martinlippert 2 cited

dlwldn30 @dlwldn30 2 cited

Josh Cummings @jzheaux 1 cited

Spring Kafka's DelegatingByTypeSerializer has been leaking delegates for years, and a fix just landed with a cherry-pick across 4.1.x and 4.0.x.

Spring Kafka shipped a fix for a resource leak in DelegatingByTypeSerializer [1] where close() was never overridden, so delegates' close() never ran. The bug is real: the delegates map is private, and the only way to close them is through this fix [2]. Meanwhile, spring-amqp is on a dependabot treadmill: Jackson BOM bumps to 2.22.2 and 3.2.2 [3][4] and a reactor-bom move to a SNAPSHOT [5] that you should not adopt yet. Over in spring-tools, Spring AI moved to 2.0.1 [6] alongside a generic dependency update [7], nothing that demands attention. Spring Session advanced its development version [8]. The headline: this Kafka bug is the one that bites in production, so check your serializers.

Action items

→ Inspect any DelegatingByTypeSerializer usage for delegate close gaps and consider cherry-picking the fix if you run 4.0.x or 4.1.x spring-projects/spring-kafka [immediate]
→ Skip the reactor-bom 2026.0.0-SNAPSHOT bump in spring-amqp; it is a milestone snapshot, not a release spring-projects/spring-amqp [monitor]
→ Review Jackson BOM updates to 2.22.2 and 3.2.2 when merged, but no action required yet spring-projects/spring-amqp [monitor]

References

[1] GH-4569: Close delegates in DelegatingByTypeSerializer (#4570) spring-projects/spring-kafka
[2] GH-4569: Close delegates in DelegatingByTypeSerializer ↗ spring-projects/spring-kafka
[3] Bump com.fasterxml.jackson:jackson-bom from 2.22.1 to 2.22.2 ↗ spring-projects/spring-amqp
[4] Bump tools.jackson:jackson-bom from 3.2.1 to 3.2.2 ↗ spring-projects/spring-amqp
[5] Bump io.projectreactor:reactor-bom from 2026.0.0-M1 to 2026.0.0-SNAPSHOT ↗ spring-projects/spring-amqp
[6] update spring ai to 2.0.1 spring-projects/spring-tools
[7] dependency updates spring-projects/spring-tools
[8] Next Development Version spring-projects/spring-session

Quick answers

What shipped in Spring on August 22, 2026?: Spring Kafka's DelegatingByTypeSerializer has been leaking delegates for years, and a fix just landed with a cherry-pick across 4.1.x and 4.0.x. In total, 4 commits and 4 pull requests landed.
Who contributed to Spring on August 22, 2026?: 4 developers shipped this update, including dependabot, Martin Lippert, dlwldn30, and Josh Cummings.
What were the notable Spring updates?: GH-4569: Close delegates in DelegatingByTypeSerializer (#4570), GH-4569: Close delegates in DelegatingByTypeSerializer, and Bump com.fasterxml.jackson:jackson-bom from 2.22.1 to 2.22.2.

SPRING SECURITY SPLITS AES CRYPTO AS DEPRECATION LOOMS

Spring Security is tearing apart its default AES encryption, and you need to know what's changing before your next upgrade.

java 66 shipped

@spring-projects Aug 20

Spring Security Stops Thread Leaks

Spring Security's SecurityContextHolderThreadLocalAccessor is sharing mutable state across threads, and a fix is already in motion.

java 15 shipped

@spring-projects Aug 19

SPRING TOOLS AND SECURITY GET JOLTED AS DOCS GO STALE

A precision refactor in Spring Tools and a sharp security fix force a triple-check on your build.

java 21 shipped

@spring-projects Aug 18

Logback 1.6.3 shuts down CVE-2026-19880 in Spring Security and Session

A critical logback security patch is forcing the entire Spring ecosystem to move in lockstep.

java 4 shipped

Elsewhere on the wire

AI Agents Aug 22

Cline hubs get drain and replay as Langchain plumb gates

Cline just shipped rollover-grade hub commands while Langchain exposes gateway internals, and OpenHands quietly broke its own monitoring contract.

ai-agents 42 shipped

Local LLMs Aug 22

SGLang ships v0.5.18 with 710 PRs and DeepSeek V4 FP4 auto-routing

The biggest release of the week just landed: SGLang v0.5.18 adds new models, fixes a silent disagg bug, and defaults DeepSeek V4 FP4 checkpoints to the right MoE runner.