RepoJournal
Spring @spring-projects
97 wires and counting

$ follow Spring

Keep up with Spring in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-09-05
stories 56
GitHub RSS Archive Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

Spring Boot reactive resource server backs off with custom security

By RepoJournal · Filed · About Spring

seonghun lee Josh Cummings Andy Wilkinson JaeHyunAn Soby Chacko Phillip Webb BoykoAlex
8 people shipped this
seonghun lee @harrisleesh 1 cited Josh Cummings @jzheaux 1 cited Andy Wilkinson @wilkinsona 1 cited JaeHyunAn @yyuneu 1 cited Soby Chacko @sobychacko Phillip Webb @philwebb BoykoAlex @BoykoAlex Martin Lippert @martinlippert

Spring Boot's reactive OAuth2 resource server auto-configuration now backs off when a custom SecurityWebFilterChain is defined, matching servlet behavior.

Spring Boot's reactive OAuth2 resource server auto-configuration previously did not back off when a custom SecurityWebFilterChain was present, unlike the servlet equivalent [1]. This commit aligns the reactive auto-configuration with the servlet behavior, introducing the @ConditionalOnDefault annotation to handle the back-off.

Spring Kafka fixed an assignability ordering issue in its delegate map [2]. The TreeMap iteration order was undefined due to a non-transitive comparator; the lookup could return a more general delegate even when an exact one was registered. The fix ensures the most specific delegate is selected.

Spring Boot also fixed a bug in AppendableByteArray where a high surrogate left unconsumed by the encoder was dropped between append calls, causing surrogate pairs written a character at a time by JsonValueWriter to be corrupted [3]. Spring Session prepared for its 4.2 development version [4].

$ ls spring-projects/reviews/ # the step-back reads

the week in review Spring WS, Security fixes; Boot reactive backoff the month in review Spring standardizes release trains while security patches and batch fixes surface
Topics: Java Full archive →

Quick answers

What shipped in Spring on September 5, 2026?
Spring Boot's reactive OAuth2 resource server auto-configuration now backs off when a custom SecurityWebFilterChain is defined, matching servlet behavior. In total, 48 commits and 8 pull requests landed.
Who contributed to Spring on September 5, 2026?
8 developers shipped this update, including seonghun lee, Soby Chacko, Josh Cummings, Andy Wilkinson, JaeHyunAn, Phillip Webb, BoykoAlex, and Martin Lippert.
What were the notable Spring updates?
Make reactive resource server back off with custom security, GH-4624: Fix most-specific delegate selection, and Fix corruption of supplementary characters in AppendableByteArray.
♥

$ log @spring-projects --recent

Spring Kafka fixes multi-value header loss with JSON types 3 shipped Spring Framework fixes duplicate key code lookup 10 shipped AMQP channel exhaustion and frame_max fixes, security race condition closed 53 shipped Mongo sequence increments exit transactions, Moments gains finer granularity 10 shipped

$ log --all # elsewhere on the wire

Meta React Native adds Stable API guards to renderer attributed string FastAPI & Pydantic Pydantic fixes Mypy plugin crash, tightens datetime constraints

$ ls showcases/

Rails Django Laravel Node.js Go Vercel Vue.js Kubernetes HashiCorp Arch Linux Linux Anthropic

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.