Hi, Spring fans! In this installment, Josh Long (@starbuxman) talks to Java Champion, legendary engineer, and teacher Trisha Gee (@trisha_gee) bout her extraordinary career working at organizations like LMAX, MongoDB, Jetbrains, and her new books, Heads First Java, and Getting to Know IntelliJ IDEA.

Hi, Spring fans! How're you doin' this fine Tuesday morning? I've returned home to San Francisco and am up and at 'em nice and early to catch a flight to Seattle, where I'll speak at the Java User Group tonight. If you're in Seattle, don't miss it!

We've got a ton of cool stuff to get into this week, but let's not bury the lede here: Spring Framework 6 comes out tomorrow, Wednesday, the 16th of November, 2022! And you know where to go to get the bits: the Spring Initialzr, start.spring.io!

Let's dive into this week's roundup!

• Did you see the new Reactor 2022.0.0 release? This release contains integration with Micrometer Tracing, context propagation, and plenty of other improvements. See this for more.
• Spring Boot 3.0.0-RC2 available now
• Spring Cloud 2021.0.5 (codename Jubilee) Has Been Released
• Spring Framework 6.0.0-RC4 available now
• Spring Security 6.0.0-RC2 is available now
• Updates on Spring Cloud Stream 4.0.0 Schema Registry Support
• Coming with the RC of Spring Modulith: improved module canvas listing cross-module bean references (first image) and publicly exposed value types (second image).
• …

This blog gives an update on the Schema Registry support that is part of Spring Cloud Stream version 4.0.x.

Many enterprises use a schema registry for schema evolution use cases, such as the Confluent Schema Registry. Starting with version 1.1.x of Spring Cloud Stream until 3.0.0, we provided a schema registry server and AVRO-based schema registry client converters that can reconcile the schema from the schema registry server. Spring Cloud Stream version 3.0.0 moved the Schema Registry components into a top-level spring-cloud project, and Spring Cloud Stream included those in its BOM for the…

Hi, Spring fans! In this episode, Josh Long (@starbuxman) talks to RabbitMQ engineer Arnaud Cogoluègnes (@acogoluegnes) on the new and novel in RabbitMQ

Hi, Spring fans! Welcome to another installment of This Week in Spring! I've been busy this last week! I've been visiting with customers and talking to the community here in South East Asia. I was in Malaysia last week, and now I'm in Bangkok, Thailand. I'm near the end of my time here in SE Asia, which makes me sad. I'm dearly going to miss the food and the weather, but time waits for no person, and it's almost time to go home.

And with time comes a jam-packed roster of new things we can read and learn from. So, without further ado, let's dive right into it!

• A Bootiful Podcast: Java Champion, legend, and prolific open source contributor Andres Almiray
• CVE Report Published for Spring Tools
• Can a Java Application Use More Memory than the Heap Size?
• JUnit – Testing Methods That Call System.exit()
• Spring Authorization Server 0.4.0-RC1 available now
• Spring Authorization Server 1.0.0-RC1 available now
• Spring Data 2022.0.0-RC2 available
• Spring Modulith 0.1 M2 released
• Have you tested your application against the upcoming Spring Boot 3? There's a ton of amazing new features arriving in this release and you should definitely be kicking the tires now. Remember: Spring Framework 6 is due in about a week's time and Spring Boot 3 is due less than a few weeks after that! And you know where to go: …

Hi, Spring fans! In this installment, Josh Long (@starbuxman) talks to Java Champion, legend, and prolific opensource contributor Andres Almiray (@aalmiray)

We have released STS 4.16.1 for Eclipse and Spring VSCode extensions 1.40.0 to address the following CVE report:

• CVE-2022-31691: Remote Code Execution via YAML editors in STS4 extensions for Eclipse and VSCode

Please review the information in the CVE report and upgrade immediately.

Eclipse: STS upgrade to 4.16.1 VSCode: Spring Boot Tools upgrade to 1.40.0 VSCode: Concourse CI Pipeline Editor upgrade to 1.40.0 VSCode: Bosh Editor upgrade to 1.40.0 VSCode: Cloudfoundry Manifest YML Support upgrade to 1.40.0

See Spring Tools page to find the latest releases

Spring Security 5.6.9 and 5.7.5 released on October 31st, 2022 included a fix for CVE-2022-31692 affecting the AuthorizationFilter. Users are encouraged to update as soon as possible.

Spring Security 5.6.9 and 5.7.5 released on October 31st, 2022 included a fix for CVE-2022-31690 affecting the mapping of authorized scopes in spring-security-oauth2-client. Users are encouraged to update as soon as possible.

Impact

Users who have applied the mitigation should take note of the following impact:

No authorized scopes are mapped to the principal (current user) when the Authorization Server (AS) responds to the OAuth2 Access Token Response with an empty or missing scope parameter.

If you are affected by this vulnerability, users will not be granted any authorities beginning with SCOPE_ when the AS does not return scopes. Only the special authority ROLE_USER…