RepoJournal
Spring @spring-projects
107 wires and counting
$ status: archived — this briefing has stopped; the archive stays readable. browse live briefings →

$ status

wire 2026-08-22
stories 8
GitHub RSS Archive Reviews

© 2026 RepoJournal Home Showcase How it works Privacy

$ the-wire · showcase

Spring Kafka leaks serializer resources in a silent bug

By RepoJournal · Filed · About Spring · Composed from the cited sources · methodology

dependabot Martin Lippert dlwldn30 Josh Cummings
4 people shipped this
dependabot @dependabot 3 cited Martin Lippert @martinlippert 2 cited dlwldn30 @dlwldn30 2 cited Josh Cummings @jzheaux 1 cited

Spring Kafka's DelegatingByTypeSerializer has been leaking delegates for years, and a fix just landed with a cherry-pick across 4.1.x and 4.0.x.

Spring Kafka shipped a fix for a resource leak in DelegatingByTypeSerializer [1] where close() was never overridden, so delegates' close() never ran. The bug is real: the delegates map is private, and the only way to close them is through this fix [2]. Meanwhile, spring-amqp is on a dependabot treadmill: Jackson BOM bumps to 2.22.2 and 3.2.2 [3][4] and a reactor-bom move to a SNAPSHOT [5] that you should not adopt yet. Over in spring-tools, Spring AI moved to 2.0.1 [6] alongside a generic dependency update [7], nothing that demands attention. Spring Session advanced its development version [8]. The headline: this Kafka bug is the one that bites in production, so check your serializers.

Action items

References

  1. [1] GH-4569: Close delegates in DelegatingByTypeSerializer (#4570) ↗ spring-projects/spring-kafka
  2. [2] GH-4569: Close delegates in DelegatingByTypeSerializer ↗ spring-projects/spring-kafka
  3. [3] Bump com.fasterxml.jackson:jackson-bom from 2.22.1 to 2.22.2 ↗ spring-projects/spring-amqp
  4. [4] Bump tools.jackson:jackson-bom from 3.2.1 to 3.2.2 ↗ spring-projects/spring-amqp
  5. [5] Bump io.projectreactor:reactor-bom from 2026.0.0-M1 to 2026.0.0-SNAPSHOT ↗ spring-projects/spring-amqp
  6. [6] update spring ai to 2.0.1 ↗ spring-projects/spring-tools
  7. [7] dependency updates ↗ spring-projects/spring-tools
  8. [8] Next Development Version ↗ spring-projects/spring-session

$ ls spring-projects/reviews/ # the step-back reads

the week in review Spring Kafka fixes multi-value JSON header loss the month in review Spring standardizes release trains while security patches and batch fixes surface
Full archive → Weekly reviews →

Quick answers

What shipped in Spring on August 22, 2026?
Spring Kafka's DelegatingByTypeSerializer has been leaking delegates for years, and a fix just landed with a cherry-pick across 4.1.x and 4.0.x. In total, 4 commits and 4 pull requests landed.
Who contributed to Spring on August 22, 2026?
4 developers shipped this update, including dependabot, Martin Lippert, dlwldn30, and Josh Cummings.
What were the notable Spring updates?
GH-4569: Close delegates in DelegatingByTypeSerializer (#4570), GH-4569: Close delegates in DelegatingByTypeSerializer, and Bump com.fasterxml.jackson:jackson-bom from 2.22.1 to 2.22.2.
♥

$ log @spring-projects --recent

Kubernetes probe groups keep their defaults; multi-segment health paths land 90 shipped Kafka config building centralized, async listener results awaited on stop 52 shipped Spring Data moves to JSqlParser 5.4 and Hibernate 7.4.8.Final 11 shipped Spring Batch deprecates setters for required dependencies 5 shipped

$ log --all # elsewhere on the wire

Agent Security Quiet day in agent security as guard coverage reaches four clients Alignment & Post-training verl defaults Ascend RL mode, open-instruct unblocks SFT packing

$ ls showcases/

Safety Evals AI Red Teaming Agent Security Interpretability Alignment & Post-training

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.