Who contributed to Spring on August 24, 2026?

4 developers shipped this update, including Alexander Makarov, Stéphane Nicoll, dlwldn30, and dependabot.

What were the notable Spring updates?

Remove reference to SpringBootWebSecurityConfiguration, Merge pull request #51411 from MacAlsandair, and Remove reference to removed SpringBootWebSecurityConfiguration.

@spring-projects

Spring Framework, Spring Boot, and the JVM enterprise layer

github ↗

Pick a date

Topics: Java Full archive →

The Wire · Showcase

SPRING BOOT DOCS POINT TO DEAD WEB SECURITY CLASS

By RepoJournal · Filed 06:59 UTC on August 24, 2026 · About Spring

4 people shipped this

dependabot @dependabot 5 cited

Alexander Makarov @MacAlsandair 2 cited

Stéphane Nicoll @snicoll 2 cited

dlwldn30 @dlwldn30 1 cited

A merged PR fixes docs that referenced a SpringBootWebSecurityConfiguration class that no longer exists, and it's the closest thing to a story across an otherwise quiet Spring ecosystem in the last day.

Spring Boot 4.0.x documentation cleanup landed overnight: a merged PR [1] removes a dangling reference to SpringBootWebSecurityConfiguration, which was dropped when servlet web security moved to ServletWebSecurityAutoConfiguration. The same fix, polished and closed as gh-51411 [2], mirrors an identical PR [3] targeting the same stale text, so if you maintain forks or downstream docs, sync before they drift further. Beyond the docs, the team tightened test tooling: GsonTester now closes its reader, harmonizing stream handling across JSON marshaller testers and closing gh-51417 [4]. A separate PR [5] re-submits a file-handle fix for SpringBootJoranConfigurator, with the maintainer noting it's an identical change rebased onto 4.0.x, so reviewers should focus on the code, not the commit hash. Over on Spring LDAP, dependabot churned through five dependency bumps, including the notable spring-core 7.0.9 [6], which comes with a warning about ForwardedHeaderFilter, so that's the one to read before merging. The other bumps, micrometer-bom 1.17.1 [8], gradle-wrapper 9.7.1 [9], reactor-core 3.8.7 [10], and apollo-runtime 5.1.0 [7], are routine patch-level moves. As the release notes for Apollo 5.1.0 put it, the version "adds a lot of performance improvements" [7], but nothing here demands your attention today. Period totals: 13 commits, 10 PRs across the two repos, all low-risk housekeeping.

Action items

→ Merge the Spring Boot 4.0.x docs fix if you haven't already, to avoid stale references in your docs spring-projects/spring-boot [plan]
→ Review spring-core 7.0.9 release notes before adopting in Spring LDAP spring-projects/spring-ldap [monitor]
→ Skip the dependabot bumps in Spring LDAP unless you need the specific bug fixes spring-projects/spring-ldap [monitor]

References

[1] Remove reference to SpringBootWebSecurityConfiguration spring-projects/spring-boot
[2] Merge pull request #51411 from MacAlsandair spring-projects/spring-boot
[3] Remove reference to removed SpringBootWebSecurityConfiguration ↗ spring-projects/spring-boot
[4] Close reader in GsonTester spring-projects/spring-boot
[5] File handle in SpringBootJoranConfigurator should be closed ↗ spring-projects/spring-boot
[6] Bump org.springframework:spring-core from 7.0.8 to 7.0.9 ↗ spring-projects/spring-ldap
[7] Bump com.apollographql.apollo:apollo-runtime from 5.0.1 to 5.1.0 ↗ spring-projects/spring-ldap
[8] Bump io.micrometer:micrometer-bom from 1.17.0 to 1.17.1 ↗ spring-projects/spring-ldap
[9] Bump gradle-wrapper from 9.7.0 to 9.7.1 ↗ spring-projects/spring-ldap
[10] Bump io.projectreactor:reactor-core from 3.8.6 to 3.8.7 ↗ spring-projects/spring-ldap

Quick answers

What shipped in Spring on August 24, 2026?: A merged PR fixes docs that referenced a SpringBootWebSecurityConfiguration class that no longer exists, and it's the closest thing to a story across an otherwise quiet Spring ecosystem in the last day. In total, 13 commits and 10 pull requests landed.
Who contributed to Spring on August 24, 2026?: 4 developers shipped this update, including Alexander Makarov, Stéphane Nicoll, dlwldn30, and dependabot.
What were the notable Spring updates?: Remove reference to SpringBootWebSecurityConfiguration, Merge pull request #51411 from MacAlsandair, and Remove reference to removed SpringBootWebSecurityConfiguration.

SPeL Configuration Gets a Builder, Deprecates 9 Constructors

Spring Framework is modernizing SpEL configuration and it's about time you stopped wrestling with those unlabeled boolean and int constructors.

java 13 shipped

@spring-projects Aug 22

Spring Kafka leaks serializer resources in a silent bug

Spring Kafka's DelegatingByTypeSerializer has been leaking delegates for years, and a fix just landed with a cherry-pick across 4.1.x and 4.0.x.

java 8 shipped

@spring-projects Aug 21

SPRING SECURITY SPLITS AES CRYPTO AS DEPRECATION LOOMS

Spring Security is tearing apart its default AES encryption, and you need to know what's changing before your next upgrade.

java 66 shipped

@spring-projects Aug 20

Spring Security Stops Thread Leaks

Spring Security's SecurityContextHolderThreadLocalAccessor is sharing mutable state across threads, and a fix is already in motion.

java 15 shipped

Elsewhere on the wire

AI Agents Aug 24

CLINE SHIPS V4.1.15 AS TELEMETRY BUGS SURFACE ACROSS THE AGENT STACK

Cline's long-awaited auto-approve fix landed overnight, but it's the telemetry drop in 4.1.11 that should have you checking your session metrics.

ai-agents 44 shipped

Local LLMs Aug 24

VLLM'S P2P WEIGHT SYNC CUTS RL MOE TRANSFER COSTS

Forget all-gathering experts during RL rollout: vLLM's new sharded_rdt backend lets each worker pull only the slice it needs, turning a total_bytes transfer into a total_bytes divided by num_workers one.