What shipped in Spring on August 26, 2026?

If you reload an SSL bundle on Tomcat, you are silently dropping custom host configuration. In total, 56 commits and 10 pull requests landed.

Who contributed to Spring on August 26, 2026?

10 developers shipped this update, including Mark Paluch, Jens Schauder, Alexander Makarov, Moritz Halbritter, scottfrederick, philsttr, Josh Cummings, and kalayciburak, and 2 more.

What were the notable Spring updates?

SSL host config customizations are lost when reloading SSL bundles, Allow configuring Micrometer Tracing MDC keys, and Remove the warn logging about params not annotated with `@ProjectedPayload`.

@spring-projects

Spring Framework, Spring Boot, and the JVM enterprise layer

github ↗

Pick a date

Topics: Java Full archive →

The Wire · Showcase

Spring Boot SSL Reload Bug Exposed

By RepoJournal · Filed 07:00 UTC on August 26, 2026 · About Spring

10 people shipped this

Mark Paluch @mp911de 2 cited

Artem Bilan @artembilan 2 cited

scottfrederick @scottfrederick 1 cited

philsttr @philsttr 1 cited

kalayciburak @kalayciburak 1 cited

Jens Schauder @schauder

Alexander Makarov @MacAlsandair

Moritz Halbritter @mhalbritter

Josh Cummings @jzheaux

ZaheerAhmadDev @ZaheerAhmadDev

If you reload an SSL bundle on Tomcat, you are silently dropping custom host configuration.

Spring Boot's SSL host config customizations are lost when reloading SSL bundles [1], a bug that can break SNI setups in production. Meanwhile, Micrometer Tracing gets configurable MDC keys, so you can use `trace_id`/`span_id` instead of `traceId`/`spanId` [2]. Spring Data Commons removes the warn logging about `@ProjectedPayload` params, signaling the migration is complete [3], and fixes nested `KPropertyPath` rendering with a new internal `NestedKPropertyPath` interface [4]. Spring Integration cuts UDP multicast test retries from 20 to 3, and then disables them entirely on Windows CI runners, because "neither of the previous two mitigations can tell a bad host from a good one" [5][6]. RestTemplate removal warnings are suppressed across Spring Integration until the client is removed [7].

Action items

→ Patch Spring Boot if you reload SSL bundles on Tomcat with custom SNI host configs spring-projects/spring-boot [immediate]
→ Review your MDC key expectations; the new Micrometer Tracing config may be relevant spring-projects/spring-boot [plan]
→ Update Spring Integration if you rely on UDP multicast tests in CI spring-projects/spring-integration [monitor]

References

[1] SSL host config customizations are lost when reloading SSL bundles ↗ spring-projects/spring-boot
[2] Allow configuring Micrometer Tracing MDC keys ↗ spring-projects/spring-boot
[3] Remove the warn logging about params not annotated with `@ProjectedPayload`. spring-projects/spring-data-commons
[4] Fix nested `KPropertyPath` rendering. spring-projects/spring-data-commons
[5] Reduce the `@RetryingTest` budget for the UDP multicast tests spring-projects/spring-integration
[6] Disable UDP multicast tests on Windows CI runners spring-projects/spring-integration
[7] GH-11268: Suppress RestTemplate removal warnings ↗ spring-projects/spring-integration

Quick answers

What shipped in Spring on August 26, 2026?: If you reload an SSL bundle on Tomcat, you are silently dropping custom host configuration. In total, 56 commits and 10 pull requests landed.
Who contributed to Spring on August 26, 2026?: 10 developers shipped this update, including Mark Paluch, Jens Schauder, Alexander Makarov, Moritz Halbritter, scottfrederick, philsttr, Josh Cummings, and kalayciburak, and 2 more.
What were the notable Spring updates?: SSL host config customizations are lost when reloading SSL bundles, Allow configuring Micrometer Tracing MDC keys, and Remove the warn logging about params not annotated with `@ProjectedPayload`.

Spring Boot fixes OTLP fallback and DataSource unwrap bugs

Spring Boot shipped two behavioral fixes overnight that will change how your OTLP config and DataSource unwrapping resolve at runtime.

java 56 shipped

@spring-projects Aug 24

SPRING BOOT DOCS POINT TO DEAD WEB SECURITY CLASS

A merged PR fixes docs that referenced a SpringBootWebSecurityConfiguration class that no longer exists, and it's the closest thing to a story across an otherwise quiet Spring ecosystem in the last day.

java 23 shipped

@spring-projects Aug 23

SPeL Configuration Gets a Builder, Deprecates 9 Constructors

Spring Framework is modernizing SpEL configuration and it's about time you stopped wrestling with those unlabeled boolean and int constructors.

java 13 shipped

@spring-projects Aug 22

Spring Kafka leaks serializer resources in a silent bug

Spring Kafka's DelegatingByTypeSerializer has been leaking delegates for years, and a fix just landed with a cherry-pick across 4.1.x and 4.0.x.

java 8 shipped

Elsewhere on the wire

AI Agents Aug 26

CLINE OVERHAULS DESKTOP UX

Cline's desktop app got a massive consolidation pass that merges its customization pages into one hub and reworks the sidebar.

ai-agents 31 shipped

Local LLMs Aug 26

OLLAMA'S MLX RUNNER NOW SPEAKS STRUCTURED OUTPUT

Ollama closed a silent correctness gap on Apple Silicon, and the LLM inference stack shipped a wave of fixes that touch everything from tool calls to native ARM support.

+14

llms 239 shipped

@CachyOS Aug 26

HANDHELD GAMING OVERHAUL: STEAMOS SESSION CONTROL LANDS

CachyOS is rewiring its handheld gaming stack so Steam's session management is treated as a first-class citizen, with a new steamosctl-powered switch to game mode.