Releasing Spring For Modern Challenges

TL;DR: The Spring release train has been updated from a two week long train to a single day, the Thursday after the third Monday of the month. The next regular patch train will be on October 22nd. A milestone only train will occur on September 24th.

Back in June, we wrote to you all about how AI has changed the rate in which new vulnerabilities are being found and exploited in the wild. That has not slowed down. We have averaged nearly 80 new community provided security reports a month since March, in addition to our own internal scanning with frontier models. The rate we are seeing new reports coming in shows no signs of slowing soon. This has led to major shifts in how we handle incoming security reports and outgoing patches.

“We have averaged nearly 80 new community provided security reports a month since March … [and the] rate we are seeing new reports coming in shows no signs of slowing soon.”

Since then, we have been very busy and you've taken notice. In the new world we are navigating, we have had to make significant investments in how we release the Spring portfolio. From condensing the release train from two weeks to a single day, vastly upgrading how we communicate security advisories on the website, and fixing over 160 new CVEs. It has been many years since the team has made this level of internal investment and we feel that these updates are just as important today as new features in the framework. This post will walk through the changes we have made and help you to understand when and how things will work going forward.

Release Cadence

Historically, we spread releases over a two-week period with each level of the Spring portfolio dependency tree shipping on a different day. While that approach has served us well over the years, in a world where CVEs are exploited in hours instead of days, it now seems archaic. In the past two release trains as an example, the old model would have had new CVE fixes released every day of each train.

Because of this, we have completely re-engineered how we release the entire Spring portfolio, now releasing all of it in one large train. This allows us to get you all of the releases and CVE fixes across the Spring portfolio in one drop, creating a "Patch Thursday" if you will for Spring. With the restructuring of the release train, we didn’t want to change the dates you are accustomed to any more than required. Because of that, we have decided to keep the date the release is made available in Maven Central as the Thursday after the third Monday of the month, the same day of the month we have released Spring Boot for years now.

In an effort to prepare for how our new release trains will work, this month we will be only doing Milestone releases that are part of the work towards our November feature releases. We will begin doing patch releases in our new normal format on October 22nd.

Website Updates

When you go from having to publish one or two security advisories to 91 in a single month, how you do so needs to change. We recognized that and made significant improvements to https://spring.io/security. Instead of a rolling blog format that did not scale to the quantity of advisories we are putting out lately, we have redesigned it to be able to quickly navigate CVEs by id, severity, and project. This will allow anyone to obtain the information they need about the projects that matter to them quickly and easily.

Going Forward From Here

The world is rapidly changing when it comes to how software is delivered and by whom. For over two decades, the same people have been behind the development and security of the Spring portfolio. We are proud to be the ones who have delivered the value and steadfast security that you have grown to rely upon and trust. We will continue to evolve to accommodate the changing security landscape while driving the features and security you need.

As always, we want to hear your comments and thoughts! Please leave your thoughts as well as how we can improve in the comment section below.