Spring
SPRING FRAMEWORK 7.0.8 ROLLS ACROSS THE STACK WITH SECURITY FIXES
Spring Framework 7.0.8 landed overnight with high-severity CVE patches, and the entire ecosystem is pulling it in across WebFlow, Boot, WS, LDAP, and Security.
read --wire →
$ tail -f topics/java.log
Java news, every morning.
Daily updates from Spring, Spring Boot, and the JVM enterprise ecosystem.
7 updates across 1 project this week.
Your week in Java, every Monday.
One calm review of what shipped across Java - the commits, releases, and security advisories that matter. Every Monday, with security advisories same-day. Free, unsubscribe in one click.
We'll start you on the top Java projects - refine anytime. · Read a sample issue →
Recent wires
Spring
SPRING FRAMEWORK PATCHES 16 CVES, LDAP TIGHTENS PASSWORD VALIDATION
Spring Framework 7.0.8 shipped overnight with a massive security update addressing 16 CVEs, while Spring LDAP closed a critical authentication bypass that could accept empty passwords as valid logins.
read --wire →
Spring
SPRING-AI STRIPS BLOAT, SPRING-BOOT PATCHES FILE DESCRIPTOR LEAK
Spring AI is cutting unnecessary dependencies and deprecating its ChatClient customizer in a cleanup push that signals cleaner architecture ahead.
read --wire →
Spring
SPRING STACK TIGHTENS SECURITY AND DEPRECATION CYCLE
Spring Boot restores critical Spring Security integration with HtmlUnitDriver after a missed bean registration, while Spring AI begins retiring legacy Mistral models ahead of 2.0.0-RC1.
read --wire →
Spring
JACKSON AND LOGBACK UPDATES ROLL ACROSS SPRING ECOSYSTEM
Jackson 2.21.4 and Logback 1.5.33 landed across spring-amqp and spring-pulsar overnight, while spring-ai ships ChatClient refinements and restores observability for Anthropic models.
read --wire →
Spring
SPRING-KAFKA FIXES THREE CRITICAL BATCH LISTENER BUGS OVERNIGHT
Spring-Kafka shipped fixes for broken rollback handling, commit timing logic, and null pointer crashes that could silently fail message processing in production.
read --wire →
Spring
SPRING AI 2.0.0-M8 SHIPS WITH BREAKING PROPERTY CHANGES
Spring AI's milestone release forces a migration to dash-separated configuration properties, while Spring Framework patches class scanning conflicts and WebSocket handling bugs.
read --wire →
Spring
SPRING AI LOCKS DOWN SENSITIVE DATA IN LOGS
Spring AI removed toString() methods from Options classes to prevent API keys and credentials from leaking into application logs, a critical hardening across the entire framework.
read --wire →
Spring
SPRING SHELL FIXES CONVERTER BEANS, SPRING TOOLS PATCHES NPE
Spring Shell shipped three critical fixes overnight that restore custom Converter bean handling and fix command registration bugs that broke in recent releases.
read --wire →
Spring
SPRING-AI FIXES BOOT DEPENDENCY REGRESSION AMID INTEGRATION TEST REPAIRS
Spring AI plugged a critical dependency hole that broke multiple starters and integration tests across OpenAI, Anthropic, and MCP providers.
read --wire →
Spring
SPRING STACK TIGHTENS DEPENDENCY CHAIN OVERNIGHT
Protobuf, Hibernate, and Node.js all bumped across the portfolio, with Spring AI pinning its toolchain while integration layers patch upstream.
read --wire →
Spring
SPRING AI STREAMING FIX PATCHES SILENT DATA LOSS, SECURITY PROJECTS PIN NODE 24.15
Spring AI 2.0.0-M7 ships a critical reactive streaming fix that was dropping response chunks in production, while security teams across the stack locked Node to 24.15 after Node 24.16 broke docs builds.
read --wire →
Spring
SPRING AI TOOLS API OVERHAUL SHIPS WITH AUTO-REGISTRATION AND FLUENT DSL
Spring AI replaced its scattered tool-registration methods with a unified ToolSpec fluent API while automatically wiring ToolCallAdvisor when tools are configured.
read --wire →
Spring
SPRING INTEGRATION FIXES CORS DEFAULTS TO MATCH MVC, SPRING AI SHEDS CLOUD BINDINGS
Spring Integration shipped a critical CORS alignment fix that brings HTTP and WebFlux modules into sync with Spring MVC's stricter defaults, while Spring AI removes a deprecated cloud bindings dependency in a significant API cleanup.
read --wire →
Spring
SPRING MODULITH TIGHTENS MESSAGE ORDERING WITH BLOCKING OUTBOX
Spring Modulith shipped a critical fix for outbox message sequencing that blocks on externalization to guarantee ordering, solving a race condition that could silently corrupt event streams.
read --wire →
Spring
SPRING FRAMEWORK CUTS BUILD OVERHEAD WITH GRADLE 9.5.1 UPGRADE
Spring Framework is moving to Gradle 9.5.1 while Spring Security tightens its dependency chain with Hibernate ORM 7.3.5 and Maven resolver updates.
read --wire →
Spring
SPRING INTEGRATION AND KAFKA BUMP CORE DEPENDENCIES OVERNIGHT
Spring Integration pushed four dependency updates across Hibernate, Lettuce, Debezium, and SLF4J, all patch versions with no breaking changes.
read --wire →
Spring
SPRING-GRAPHQL FIXES API CONTRACT BROKEN BY IMMUTABLE OPTIONS
Spring GraphQL shipped a fix that makes GraphQlArgumentBinder.Options mutable, restoring the ability for downstream code to actually configure binders through the existing API.
read --wire →