Multiple CVE reports published for Spring Data

Engineering | Mark Paluch | April 11, 2018 | ...

Last week, we released Spring Data Ingalls SR11 and Kay SR, which include fixes for the following vulnerabilities:

Spring Boot 1.5.11 (superseded by 1.5.12 due to CVE-2018-1275) and 2.0.1 already pull in the above Spring Data versions, including the fixes that were released last week, and are now also available for use.

Please review the information in the CVE reports and upgrade immediately.

This Week in Spring - April 10th, 2018

Engineering | Josh Long | April 11, 2018 | ...

Hi Spring fans! This week I'm in Atlanta, Indianapolis and Cincinnati! I'll be speaking at the Atlanta, GA Spring Meetup on Tuesday the 10th where I'll be looking about all things new, bootiful and cloud-native including reactive programming, Spring Web Flux, Spring Cloud Finchley, Spring Cloud Function and Project Riff. Then it's off to Indianapolis where I'll be doing the same talk on Thursday the 12th.

What a crazy week it's been! There's so much to get to this week. I want to call out, first, that there are some CVEs out there and if you haven't already, you should be updating urgently…

Event Storming and Spring with a Splash of DDD

Engineering | Jakub Pilimon | April 11, 2018 | ...

It is my pleasure to announce that I have just joined the developer advocacy team at Pivotal, focusing on Spring. I feel privileged to have the opportunity to learn and collaborate with great and passionate engineers from all over the world. Hence, I must say I am really excited for the upcoming journey.

If you would like to follow me, I tweet under @JakubPilimon and blog here.

Before joining Pivotal, I have had the pleasure of consulting with and learning from software development teams across a variety of domains. Whether the domain is e-commerce, pharma, fintech, or insurance—common to all domains in software are the expectations of users. In this post I'm going to introduce some of my…

Announcing General Availability of Spring Cloud Stream - Elmhurst.RELEASE (2.0.0.RELEASE)

Engineering | Oleg Zhurakousky | April 10, 2018 | ...

After a long and exciting journey, we are pleased to announce the General Availability release of the Spring Cloud Stream Elmhurst release train - Elmhurst.RELEASE/2.0.0.RELEASE.

<dependencyManagement>
    <dependencies>
        <dependency>
            <groupId>org.springframework.cloud</groupId>
            <artifactId>spring-cloud-stream-dependencies</artifactId>
            <version>Elmhurst.RELEASE</version>
            <type>pom</type>
            <scope>import</scope>
        </dependency>
    </dependencies>
</dependencyManagement>

Spring Cloud Stream Elmhurst (2.0.0.RELEASE) is available for use in Maven Central and the Spring Repo. The release notes include relevant information about version…

Multiple CVE reports published for the Spring Framework

Engineering | Rossen Stoyanchev | April 05, 2018 | ...

UPDATE 2018-04-09: see follow-up announcement for 4.3.x branch.

Spring Framework 5.0.5 and 4.3.15 (superseded by 4.3.16 with CVE-2018-1275), released earlier this week, include fixes for the following vulnerabilities:

Spring Boot 2.0.1 and 1.5.11 (superseded by 1.5.12 with CVE-2018-1275), that match the above Spring Framework versions, were released today, and are now also available for use.

Please, review the information in the CVE reports and upgrade immediately.

This Week in Spring - April 3, 2018

Engineering | Josh Long | April 03, 2018 | ...

Hi Spring fans! What a week! This week I'm in beautiful Dallas, TX, for the Spring One Tour Dallas event which is, like so many of the other cities already, utterly and completely sold out! What a crowd!

And, so, without further ado, let's get to it!

Property Binding in Spring Boot 2.0

Engineering | Phil Webb | March 28, 2018 | ...

Since the first release of Spring Boot, it has been possible to bind properties to classes by using the @ConfigurationProperties annotation. It has also been possible to specify property names in different forms. For example, person.first-name, person.firstName and PERSON_FIRSTNAME can all be used interchangeably. We call this feature “relaxed binding”.

Unfortunately, in Spring Boot 1.x, “relaxed binding” turned out to be a little bit too relaxed. It was quite hard to define exactly what the binding rules were and when specific formats could be used. We also started to get reports of issues that were very hard to fix with our 1.x implementation. For example, in Spring Boot 1.x it is not possible to bind items to a java.util.Set

This Week in Spring - March 27th, 2018

Engineering | Josh Long | March 27, 2018 | ...

Hi Spring fans! Welcome to another installment of This Week in Spring! This week I'm hanging out in sunny San Francisco talking to local customers and working on more installments of the next season of Spring Tips.

As usual, we've got a lot to cover so let's get to it!

Get the Spring newsletter

Stay connected with the Spring newsletter

Subscribe

Get ahead

VMware offers training and certification to turbo-charge your progress.

Learn more

Get support

Tanzu Spring offers support and binaries for OpenJDK™, Spring, and Apache Tomcat® in one simple subscription.

Learn more

Upcoming events

Check out all the upcoming events in the Spring community.

View all