RepoJournal
Spring @spring-projects
97 wires and counting

$ follow Spring

Keep up with Spring in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-09-04
stories 53
GitHub RSS Archive Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

AMQP channel exhaustion and frame_max fixes, security race condition closed

By RepoJournal · Filed · About Spring

renechoi ngocnhan-tran1996 Dmitrii Bocharov arimu1 Phillip Webb Josh Cummings Artem Bilan
9 people shipped this
renechoi @renechoi 2 cited ngocnhan-tran1996 @ngocnhan-tran1996 1 cited Dmitrii Bocharov @bdshadow 1 cited arimu1 @arimu1 1 cited Phillip Webb @philwebb Josh Cummings @jzheaux Artem Bilan @artembilan BoykoAlex @BoykoAlex Martin Lippert @martinlippert

Spring AMQP shipped fixes for two channel-leak and header-loss bugs, Spring Security closed a HeaderWriterFilter race condition, and Spring Kafka honors shared-container client IDs.

Spring AMQP [1] now closes the captured publisher channel when waitForConfirms() fails with exceptions other than ShutdownSignalException or TimeoutException. Previously those channels were never closed, leaking ChannelN instances when checkoutTimeout is 0 and blocking publishing after reconnect. Update before any deploy using waitForConfirms with a zero checkoutTimeout.

Spring AMQP [2] also fixes RepublishMessageRecoverer when frame_max is unknown. includeStackTrace(true) stored -1 to mean "resolve the limit from frame_max", but when frame_max couldn't be determined, processStackTrace() left that -1 in place and recover() then dropped the x-exception-stacktrace header the caller had opted into. The header is now emitted as requested even when frame_max is unknown. In AMQP 1.0, doPause() used to write flow directly from whatever thread invoked pause(), racing a single mutable ProtonSession instance shared by all links; it now writes on the session thread.

Spring Security [3] fixed a race condition in HeaderWriterFilter, closing gh-9175. Also, BearerTokenAuthentication now compares OAuth2AccessToken.TokenType with equals() instead of ==, because "TokenType instances are not guaranteed to be singletons and reference comparison can incorrectly reject an otherwise-equal bearer token." [4]

Spring Kafka [5] now honors the container properties client id in share containers. determineClientId previously ignored the value ShareKafkaListenerContainerFactory copies from clientIdPrefix into container properties, plus any factory-level client id, so the consumer fell back to the bean name.

Action items

References

  1. [1] GH-3448: Close channels if confirm wait fails ↗ spring-projects/spring-amqp
  2. [2] GH-3616: Fix `RepublishMessageRecoverer` when `frame_max` is unknown ↗ spring-projects/spring-amqp
  3. [3] Fix HeaderWriterFilter Race Condition ↗ spring-projects/spring-security
  4. [4] Fix TokenType Comparison Logic ↗ spring-projects/spring-security
  5. [5] GH-4601: Honor the container properties client id in share containers (#4602) ↗ spring-projects/spring-kafka

$ ls spring-projects/reviews/ # the step-back reads

the week in review Spring WS, Security fixes; Boot reactive backoff the month in review Spring standardizes release trains while security patches and batch fixes surface
Topics: Java Full archive →

Quick answers

What shipped in Spring on September 4, 2026?
Spring AMQP shipped fixes for two channel-leak and header-loss bugs, Spring Security closed a HeaderWriterFilter race condition, and Spring Kafka honors shared-container client IDs. In total, 37 commits and 16 pull requests landed.
Who contributed to Spring on September 4, 2026?
9 developers shipped this update, including Phillip Webb, renechoi, ngocnhan-tran1996, Dmitrii Bocharov, Josh Cummings, arimu1, Artem Bilan, and BoykoAlex, and 1 more.
What were the notable Spring updates?
GH-3448: Close channels if confirm wait fails, GH-3616: Fix `RepublishMessageRecoverer` when `frame_max` is unknown, and Fix HeaderWriterFilter Race Condition.
♥

$ log @spring-projects --recent

Spring Kafka fixes multi-value header loss with JSON types 3 shipped Spring Framework fixes duplicate key code lookup 10 shipped Spring Boot reactive resource server backs off with custom security 56 shipped Mongo sequence increments exit transactions, Moments gains finer granularity 10 shipped

$ log --all # elsewhere on the wire

Meta React Native adds Stable API guards to renderer attributed string FastAPI & Pydantic Pydantic fixes Mypy plugin crash, tightens datetime constraints

$ ls showcases/

Rails Django Laravel Node.js Go Vercel Vue.js Kubernetes HashiCorp Arch Linux Linux Anthropic

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.