RepoJournal
Spring @spring-projects
97 wires and counting

$ follow Spring

Keep up with Spring in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-09-01
stories 50
GitHub RSS Archive Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

Spring WS fixes interceptor fault handling, X.509 common name extraction

By RepoJournal · Filed · About Spring

Stéphane Nicoll Josh Cummings dlwldn30 Moritz Halbritter martin-grofcik Phillip Webb
6 people shipped this
Stéphane Nicoll @snicoll 4 cited Josh Cummings @jzheaux 2 cited dlwldn30 @dlwldn30 1 cited Moritz Halbritter @mhalbritter martin-grofcik @martin-grofcik Phillip Webb @philwebb

Spring WS shipped two fixes today: interceptor fault decisions are now made per-interceptor, and X.509 certificates whose subject DN ends with the common name now authenticate correctly.

Spring WS's MessageDispatcher used to read the fault status of a response once before unwinding the interceptor chain, so an interceptor that changed the response had no effect on later interceptors; it now determines fault status per interceptor, fixing stale handleResponse/handleFault routing [1]. The default subjectDNRegex of DaoX509AuthoritiesPopulator changed from "CN=(.*?)," to "CN=(.*?)(?:,|$)", so certificates whose subject DN ends with the common name no longer fail with BadCredentialsException [2]. The skipValidationIfNoHeaderPresent property is now documented, clarifying what enabling it means on the server side for requests without a wsse:Security header [3]. PayloadRootUtils moved to org.springframework.ws.support, with a deprecated delegating class left in the old server-specific package [4]. Spring AI fixed a file descriptor leak in TextReader.get(), which passed resource streams to StreamUtils.copyToString without closing them; it now uses try-with-resources [5]. Spring LDAP removed the Shibboleth Repository [6], and normalized CRLF line endings to LF in the odm module [7].

Action items

References

  1. [1] Determine whether the response is a fault for each interceptor ↗ spring-projects/spring-ws
  2. [2] Extract the common name when it ends the subject DN ↗ spring-projects/spring-ws
  3. [3] Document the effect of skipping WS-Security validation ↗ spring-projects/spring-ws
  4. [4] Move PayloadRootUtils to org.springframework.ws.support ↗ spring-projects/spring-ws
  5. [5] Close the resource stream in `TextReader` ↗ spring-projects/spring-ai
  6. [6] Remove Shibboleth Repository ↗ spring-projects/spring-ldap
  7. [7] Normalize line endings in odm module ↗ spring-projects/spring-ldap

$ ls spring-projects/reviews/ # the step-back reads

the week in review Spring WS, Security fixes; Boot reactive backoff the month in review Spring standardizes release trains while security patches and batch fixes surface
Topics: Java Full archive →

Quick answers

What shipped in Spring on September 1, 2026?
Spring WS shipped two fixes today: interceptor fault decisions are now made per-interceptor, and X.509 certificates whose subject DN ends with the common name now authenticate correctly. In total, 36 commits and 14 pull requests landed.
Who contributed to Spring on September 1, 2026?
6 developers shipped this update, including Moritz Halbritter, martin-grofcik, dlwldn30, Stéphane Nicoll, Phillip Webb, and Josh Cummings.
What were the notable Spring updates?
Determine whether the response is a fault for each interceptor, Extract the common name when it ends the subject DN, and Document the effect of skipping WS-Security validation.
♥

$ log @spring-projects --recent

Spring Kafka fixes multi-value header loss with JSON types 3 shipped Spring Framework fixes duplicate key code lookup 10 shipped Spring Boot reactive resource server backs off with custom security 56 shipped AMQP channel exhaustion and frame_max fixes, security race condition closed 53 shipped

$ log --all # elsewhere on the wire

Meta React Native adds Stable API guards to renderer attributed string FastAPI & Pydantic Pydantic fixes Mypy plugin crash, tightens datetime constraints

$ ls showcases/

Rails Django Laravel Node.js Go Vercel Vue.js Kubernetes HashiCorp Arch Linux Linux Anthropic

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.