Hi, Spring fans! What a crazy wonderful week it's been and what a wonderful week it'll be! It's the holidays. I've set my out-of-office status and am already winding down for the year. You can expect new episodes of This Week in Spring and a Bootiful Podcast (@BootifulPodcast), of course, but I won't be doing any new Spring Tips (@SpringTipsLive) videos until next year. That said, I can't wait for you to see what I'm cooking up for the new installmetn of Spring Tips! It's going to be a ton of fun!

Now then, we've got a crazy amount of stuff to get to this week. Let's dive right into it. It'll be Christmas before we talk again, so Merry Christmas, if you celebrate that. Otherwise, I just hope you're having a wonderful week. I look forward to next week's installment where of course we'll do our yearly This Year in Spring…

This article explores the different options that Spring Boot developers have for using Javascript and CSS on the client (browser) side of their application. Part of the plan is to explore some Javascript libraries that play well in the traditional server-side-rendered world of Spring web applications. Those libraries tend to have a light touch for the application developer, in the sense that they allow you to completely avoid Javascript, but still have nice a progressive "modern" UI. We also look at some more "pure" Javascript tools and frameworks. It’s kind of a spectrum, so as a TL;DR here…

Part 1

Plain Javascript with SSE Stream

Vue isn’t really adding a lot of value in this simple HTML replacement use case, and it would add no value at all to the SSE example, so we will go ahead and implement that in vanilla Javascript. Here’s a stream tab:

<div class="tab-pane fade" id="stream" role="tabpanel">
	<div class="container">
		<div id="load"></div>
	</div>
</div>

and some Javascript to populate it:

<script type="module">
	var events = new EventSource("/stream");
	events.onmessage = e => {
		document.getElementById("load").innerHTML = e.data;
	}
</script>

Dynamic Content with React

Hi, Spring fans! In this installment, Josh Long talks to JobRunr.io creator Ronald Dehuysser (@rdehuyss) about JobRunr, which is a distributed job scheduling engine that plugs right into Spring Boot.

Hi, Spring fans! In this installment, we continue our tour of all things @Controller by looking at the nascent Spring GraphQL project

Hi, Spring fans! How are you? Welcome to another installment of This Week in Spring! I'm doing alright! It's noon as I write this, and I've got GSUG joint presentation with Matt Raible later today. Then, tonight at midnight my time to 5 am or 6 am, I'm kicking off a two-day workshop for GOTO! I look forward to seeing ya there! Anyway, we've got a lot to cover so let's dive into it!

• Read this first! If you've been living under a rock, you may not have heard of the recent Log4J2 vulnerability. If you're using the default, out-of-the-box Spring Boot logging support, then this does not apply to you! But, if you are using Log4j2, specifically, then you need to read this post on Log4j2 and Spring Boot!
• Bruno Borges tweets this very simple workaround for those of you who are using Log4j2 and can't change the startup scripts of your application afflicted by the Log4j2 exploit
• Once you're sure your applications are healthy and happy, check out the new Spring Native 0.11 release! And its new AOT engine, which brings Spring Native to the Next Level…

Updates: Since this blog post has been published, a new logback 1.2.9 version has been published. While this fixes a security issue, prerequisites for exploits are very different as they "requires write access to logback's configuration file". Log4J also released a new 2.17.0 version with fixes for CVE-2021-45046 and CVE-2021-45105. Spring Boot 2.5.8 and 2.6.2 haven been released and provide dependency management for logback 1.2.9 and Log4J 2.17.0. Log4J 2.17.1 contains a fix for CVE-2021-44832

As you may have seen in the news, a new zero-day exploit has been reported against the popular Log4J2 library which can allow an attacker to remotely execute code. The vulnerability has been reported with CVE-2021-44228 against the log4j-core jar and has been fixed in Log4J v2.15.0…

Hi, Spring fans! This week, Josh Long (@starbuxman) talks to transformational leader, my old boss, legendary technologist, and friend Patrick Chanezon (@chanezon).

On behalf of the team and everyone who has contributed, it is my pleasure to announce the release of Spring Native 0.11, which provides native support for Spring Boot 2.6. This ambitious release is the result of five months of hard work by the Spring team, who have been working on a brand new architecture to bring Spring support for creating native executables with GraalVM to the next level. You can already try it on start.spring.io!

Learn more about Spring Native 0.11 and see it in action in this new Spring Tips video from Spring Developer Advocate Josh Long.

New Ahead-Of-Time Engine

The…