RepoJournal
Spring @spring-projects
107 wires and counting
$ status: archived — this briefing has stopped; the archive stays readable. browse live briefings →

$ status

wire 2026-09-10
stories 41
GitHub RSS Archive Reviews Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

Spring Security hardens the post-login redirect, Spring Session moves to Antora

By RepoJournal · Filed · About Spring · Composed from the cited sources · methodology

jkaving Josh Cummings rwinch renechoi Tran Ngoc Nhan simonhir Chienlin
10 people shipped this
jkaving @jkaving 2 cited Josh Cummings @jzheaux 2 cited rwinch @rwinch 2 cited renechoi @renechoi 2 cited Tran Ngoc Nhan @ngocnhan-tran1996 1 cited simonhir @simonhir 1 cited Chienlin @Chienlin1014 1 cited github-actions[bot] @github-actions[bot] 1 cited dependabot @dependabot Martin Lippert @martinlippert

Spring Security's default RequestCache now refuses to redirect users to background browser fetches like apple-touch-icon probes, closing a small but real open-redirect surface after authentication [ref:9].

The default RequestCache previously ignored only `/favicon.*`; it now ignores the well-known paths browsers and their devtools fetch on their own, so an Apple touch icon probe can never become the URL a user lands on after logging in [1]. Safari and other WebKit browsers request `apple-touch-icon.png`, `apple-touch-icon-precomposed.png`, and sized variants like `apple-touch-icon-152x152.png` at the domain root as soon as a page loads, with no matching `<link>` tag required [2]. If your app relies on the default RequestCache and any custom ignore patterns, check they still compose with the widened defaults.

Spring Session spent the window on documentation and Boot 4 housekeeping. Spring's move to Antora means the single-page docs are gone and the version drop-down makes version-specific links unnecessary, so `spring-session-docs.gradle` no longer parses versions and internal links have been updated accordingly [3][4]. On the runtime side, deprecated `RuntimeHints#serialization` usage was replaced with `RuntimeHints#reflection` [5], and a separate change adds common serialization hints [6].

For anyone running Spring Session on SQL Server, the DDL for `PRINCIPAL_NAME` and `ATTRIBUTE_NAME` now uses `NVARCHAR` instead of `VARCHAR` [7]. The MS JDBC driver sends Unicode parameters, so `VARCHAR` columns forced an implicit conversion on lookups and joins, which the change describes as causing "Index Scan regression and significant performance degradation under load for session ope" [7]. Existing deployments need a schema migration, not just a dependency bump.

In Spring Kafka, the default delegate in `DelegatingByTopicSerialization` was never configured when passed to the two-arg constructor: the fallback lives in its own `defaultDelegate` field, `buildDefault()` passes a `null` pattern, and `configure()` only rebuilds the default when the config map carries the default key [8][9]. The fix is queued for auto-cherry-pick to `4.1.x` and `4.0.x` [9]. Elsewhere: Spring Tools 5.4.0.RELEASE adds validations and quick fixes for `@ApplicationModuleListener`, `@SpringJUnitConfig`, `@RestController`, and specific `@Scope` annotations, plus Claude Code/MCP support for rendering a project's logical structure [10]; Spring Security's JavaScript build moved to Node 24 [11]; and spring-data-relational dropped a redundant constructor from the `PathNode` record [12].

Action items

References

  1. [1] Modernize the default RequestCache background-request ignore list ↗ spring-projects/spring-security
  2. [2] Ignore Apple touch icon requests in default RequestCache ↗ spring-projects/spring-security
  3. [3] Documentation and Spring Boot 4 updates and fixes ↗ spring-projects/spring-session
  4. [4] Update documentation links ↗ spring-projects/spring-session
  5. [5] Update Deprecated RuntimeHints Usage ↗ spring-projects/spring-session
  6. [6] Add Common Serialization Hints ↗ spring-projects/spring-session
  7. [7] Favor NVARCHAR to Prevent Implicit Conversion ↗ spring-projects/spring-session
  8. [8] Configure the default delegate in DelegatingByTopicSerialization ↗ spring-projects/spring-kafka
  9. [9] Configure the default delegate in DelegatingByTopicSerialization (#4650) ↗ spring-projects/spring-kafka
  10. [10] 5.4.0.RELEASE ↗ spring-projects/spring-tools
  11. [11] Update to Node 24 ↗ spring-projects/spring-security
  12. [12] Remove redundant constructor in PathNode ↗ spring-projects/spring-data-relational

$ ls spring-projects/reviews/ # the step-back reads

the week in review Spring Kafka fixes multi-value JSON header loss the month in review Spring standardizes release trains while security patches and batch fixes surface
Topics: Java Full archive → Weekly reviews →

Quick answers

What shipped in Spring on September 10, 2026?
Spring Security's default RequestCache now refuses to redirect users to background browser fetches like apple-touch-icon probes, closing a small but real open-redirect surface after authentication [ref:9]. In total, 29 commits, 11 pull requests, and 1 releases landed.
Who contributed to Spring on September 10, 2026?
10 developers shipped this update, including Tran Ngoc Nhan, jkaving, Josh Cummings, simonhir, Chienlin, dependabot, rwinch, and github-actions[bot], and 2 more.
What were the notable Spring updates?
Modernize the default RequestCache background-request ignore list, Ignore Apple touch icon requests in default RequestCache, and Documentation and Spring Boot 4 updates and fixes.
♥

$ log @spring-projects --recent

Kubernetes probe groups keep their defaults; multi-segment health paths land 90 shipped Kafka config building centralized, async listener results awaited on stop 52 shipped Spring Data moves to JSqlParser 5.4 and Hibernate 7.4.8.Final 11 shipped Spring Batch deprecates setters for required dependencies 5 shipped

$ log --all # elsewhere on the wire

@openclaw Cold-start Gateway diagnostics stop crying wolf, doctor repairs plugin drift Agentic Coding Cline desktop bundles shrink, goose unblocks its own clicks

$ ls showcases/

Rails Django Laravel Node.js Go Vercel Vue.js Kubernetes HashiCorp Arch Linux Linux Anthropic

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.