There was a flurry of activity in the Spring ecosystem during the week of June 8th, 2026, highlighting point releases of: Spring Boot, Spring Security, Spring Session, Spring Integration, Spring Modulith, Spring AMQP and Spring Vault; and GA releases of Spring AI 2.0 and Spring Data 2026.0.0.<\/p>\n
Spring Boot<\/p>\n
The release<\/a> of Spring Boot<\/a> 4.1.0 delivers bug fixes, documentation improvements, dependency upgrades and new features such as: support for Spring gRPC<\/a>; the addition of a public constructor to the InvalidConfigurationPropertyValueException<\/a> class that accepts a string to describe the cause of the exception; and a reduction in memory consumption upon repeated calls the toByteArray() method defined in the WritableJson<\/a> interface. More details on this release may be found in the release notes<\/a> and this InfoQ news story<\/a>.<\/p>\n Spring Data<\/p>\n The release<\/a> of Spring Data<\/a> 2026.0.0 ships with new features such as: compatibility with Kotlin<\/a> 2.3.20 and Vavr<\/a> 0.11.0; new annotated Redis publish\/subscribe<\/a> message listeners; and type-safe property paths. Further details on this release may be found in the wiki<\/a> page.<\/p>\n Spring Security<\/p>\n The release<\/a> of Spring Security<\/a> 7.1.0 provides bug fixes, dependency upgrades and new features such as: a new InetAddressMatcher<\/a> functional interface that may be used as an assignment target for a lambda expression or method reference; and a new anyOf() method, added to the AllRequiredFactorsAuthorizationManager<\/a> class, that returns an instance of the AuthorizationManager<\/a> interface to grant access to a user who satisfies one of several different combinations of authentication factors. More details on this release may be found in the release notes<\/a> and this what’s new<\/a> page.<\/p>\n Spring Session<\/p>\n The release<\/a> of Spring Session<\/a> 4.1.0 delivers bug fixes and notable dependency upgrades such as: Spring Boot 4.1.0; Spring Security 7.1.0; Spring Framework 7.0.8; Spring Data 2025.1.6; Project Reactor 2025.0.6; Jackson 3.1.4; and Testcontainers 2.0.5. Further details on this release may be found in the release notes<\/a>.<\/p>\n Spring Integration<\/p>\n The release<\/a> of Spring Integration<\/a> 7.1.0 ships with bug fixes, documentation improvements, dependency upgrades and new features such as: disable the allowCredentials element in the Spring Framework @CrossOrigin<\/a> annotation in favor of the originPatterns element to align with Spring MVC<\/a>; and improvements in the constructors for the ExpressionEvaluatingMessageProcessor<\/a> class that removes the exception handling in favor of the the Spring Framework Assert<\/a> class. More details on this release may be found in the release notes<\/a> and this what’s new<\/a> page.<\/p>\n Spring HATEOAS<\/p>\n The release<\/a> of Spring HATEOAS<\/a> 3.1.0 provides bug fixes, dependency upgrades and new features such as: improved caching in the StringLinkRelation<\/a> class such that the cache does not grow beyond 256 entries; and changes to the canWrite() method, defined in the TypeConstrainedJacksonJsonHttpMessageConverter<\/a> class, that aligns with the same method name defined in the Spring Framework AbstractSmartHttpMessageConverter<\/a> class.<\/p>\n This releases also addresses two CVEs:<\/p>\n
Further details on this release may be found in the release notes<\/a>.<\/p>\n Spring Modulith<\/p>\n The release<\/a> of Spring Modulith<\/a> 2.1.0 delivers bug fixes, dependency upgrades and new features such as: a new set of classes, like NamastackOutboxEventRecorder<\/a>, to support event outbox engine with Namastack<\/a>; a new JobRunrEventExternalizer<\/a> class to support event externalization with JobRunr<\/a>; and a new @ModuleSlicing<\/a> annotation that allows for application module slicing in combination with the Spring Boot slice test annotations. More details on this release may be found in the release notes<\/a>.<\/p>\n Spring AI<\/p>\n The release<\/a> of Spring AI<\/a> 2.0.0 ships with bug fixes, documentation improvements, dependency upgrades and new features such as: updates in the Google GenAI models, defined in the GoogleGenAiChatModel.ChatModel<\/a> enum class, that include deprecations of the GEMINI_2_0_FLASH, GEMINI_2_0_FLASH_LIGHT and GEMINI_3_PRO_PREVIEW enumerations in favor of a new GEMINI_3_1_PRO_PREVIEW enumeration; and improved null safety in the org.springframework.ai.image.observation<\/a> package by replacing the deprecated methods defined in the Jackson Databind JsonNode<\/a> abstract class. Further details on this release may be found in the release notes<\/a>.<\/p>\n Spring AMQP<\/p>\n The release<\/a> of Spring AMQP<\/a> 4.1.0 provides bug fixes, dependency upgrades and new features such as: compatibility with RabbitMQ<\/a> 4.3.0; a removal of the wildcard character from all Jackson message converters to “trust no one” by default; and a new spring-amqp-client module that supports interaction with the generic AMQP 1.0<\/a> protocol. More details on this release may be found in the release notes<\/a> and this what’s new<\/a> page.<\/p>\n Spring for Apache Kafka<\/p>\n The release<\/a> of Spring for Apache Kafka<\/a> 4.1.0 delivers bug fixes, documentation improvements, dependency upgrades and a new feature that adapts the setBackOffFunction(), defined in the FailedRecordProcessor<\/a> class, to process messages in batches.<\/p>\n This release also addresses three CVEs:<\/p>\n
Further details on this release may be found in the release notes<\/a>.<\/p>\n Spring LDAP<\/p>\n The release<\/a> of Spring LDAP<\/a> 4.1.0 ships with many dependency upgrades and a new feature that deprecates methods, toEntry(), toObject(), toList() and toStream(), in favor of new methods, map(), single(), optional(), list() and stream(), added to the LdapClient<\/a> interface.<\/p>\n This release also addresses CVE-2026-41720<\/a>, a vulnerability that allows an attacker, with a valid username, to gain authorization by providing an empty or null password due to an implementation of the DirContextAuthenticationStrategy<\/a> interface that does not reject such passwords.<\/p>\n More details on this release may be found in the release notes<\/a> and this what’s new<\/a> page.<\/p>\n Spring Vault<\/p>\n The release<\/a> of Spring Vault<\/a> 4.1.0 provides bug fixes, documentation improvements, dependency upgrades and new features such as: new interfaces, VaultClient<\/a> and ReactiveVaultClient<\/a>, designed to provide an “intermediate abstraction layer enforcing relative path handling at its core, preventing unintended absolute path usage” when configured with an instance of the VaultEndpoint<\/a> class; and a new ManagedSecret<\/a> class to simplify consumption of managed secrets. Further details on this release may be found in the release notes<\/a> and this wiki<\/a> page.<\/p>\n Spring gRPC<\/p>\n The release<\/a> of Spring gRPC<\/a> 1.1.0 delivers bug fixes and notable changes such as: the ability to configure in-process channels by name within an application properties file; and the addition of annotation-based exception handling for gRPC services. More details on this release may be found in the release notes<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"There was a flurry of activity in the Spring ecosystem during the week of June 8th, 2026, highlighting…\n","protected":false},"author":2,"featured_media":740142,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[31],"tags":[215038,44626,11777,76,354,355,49,48,356,4113,75,265707,35858,236260,39650,215037,215036,55428,265706,55431],"class_list":["post-740141","post","type-post","status-publish","format-standard","has-post-thumbnail","category-arts-and-design","tag-amqp","tag-apache-kafka","tag-architecture-design","tag-arts","tag-arts-and-design","tag-artsanddesign","tag-ca","tag-canada","tag-design","tag-development","tag-entertainment","tag-grpc","tag-java","tag-ldap","tag-spring-ai","tag-spring-boot","tag-spring-data","tag-spring-integration","tag-spring-news-roundup-jun08-2026","tag-spring-security"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/posts\/740141","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/comments?post=740141"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/posts\/740141\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/media\/740142"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/media?parent=740141"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/categories?post=740141"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/tags?post=740141"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n\tCVE-2026-41006<\/a>, a vulnerability that exposes a security-sensitive property due to a bypass of the Jackson access-control annotations.
\n\tCVE-2026-41007<\/a>, a vulnerability that allows an attacker to supply their own malicious hypermedia due to an unbounded static cache of the aforementioned StringLinkRelation class.
<\/p>\n
\n\tCVE-2026-41726<\/a>, a vulnerability that allows an attacker to send malicious selector headers due to an unbounded consumer heap causing GC thrashing and an OutOfMemoryError exception.
\n\tCVE-2026-41727<\/a>, a vulnerability that allows an attacker to send a record with a malicious retry_topic-attempts header to “supply an out-of-range attempt count and cause the retry topic router to misidentify where the message was in the retry sequence.” This could lead to an arbitrarily long pause that stalls a listener far beyond any intended retry window.
\n\tCVE-2026-41731<\/a>, a vulnerability that allows an attacker to supply malicious header values to instances of the JsonKafkaHeaderMapper<\/a> and deprecated DefaultKafkaHeaderMapper<\/a> classes against trusted packages, with an implicit trust of all of its subpackages, using a prefix check that caused the consumer to deserialize arbitrary JDK types.
<\/p>\n