On behalf of the community, I’m pleased to announce the release of Spring Security 4.2.3 which fixes CVE-2017-4995. Users are encouraged to update immediately.

For additional changes included in this, refer to the changelog.

Note

Spring Boot users can update to Spring Boot 1.5.4 or customize the Spring Security version using spring-security.version.

Project Site | Reference | Guides | Help

On behalf of the Spring Data team, I'd like to announce the availability of Ingalls SR4 and Hopper SR11 service releases. Both of them ship 60 issues fixed in total. Service releases are bugfix ones and recommended upgrades for all users. The releases are going to be picked up by the upcoming Boot 1.5 and 1.4 services releases for your convenience.

The complete list of issues fixed for Ingalls SR4 can be found here, the one for Hopper SR 11 here.

Spring Data Ingalls SR4

• Spring Data Commons 1.13.4 - Artifacts - JavaDocs - Documentation - Changelog
• Spring Data JPA 1.11.4 - Artifacts - JavaDocs - Documentation - Changelog
• Spring Data KeyValue 1.2.4 - Artifacts - JavaDocs - Documentation - Changelog
• Spring Data for Apache Cassandra 1.5.4 - Artifacts - JavaDocs - Documentation - Changelog
• Spring Data for Apache Solr 2.1.4 - Artifacts - JavaDocs - Documentation - Changelog
• Spring Data Gemfire 1.9.4 - Artifacts - JavaDocs - Documentation - Changelog
• Spring Data Neo4j 4.2.4 - Artifacts - JavaDocs - Documentation - Changelog
• Spring Data MongoDB 1.10.4 - Artifacts - JavaDocs - Documentation - …

It is my pleasure to announce that Spring Boot 1.4.7 is now available from repo.spring.io and Maven Central.

Spring Boot 1.4.7 includes over 30 changes, mostly a selection of dependency upgrades and documentation improvements. Thanks to all that have contributed!

We expect Spring Boot 1.4.7 to be the last maintenance release in the 1.4 line. If you haven't upgraded to 1.5.x yet, we advise you to do so as soon as possible.

How can you help?

If you're interested in helping out, check out the "ideal for contribution" tag in the issue repository. If you have general questions, please ask on stackoverflow.com using the spring-boot tag…

On behalf of the team, I am pleased to announce that Spring Framework 4.3.9 is available now.

This maintenance release is the base for the upcoming Spring Boot 1.4.7 and 1.5.4 maintenance releases and includes 30 fixes and selected improvements.

Project Page | GitHub | Issues | Documentation

On behalf of the Spring Cloud team it is my pleasure to announce a new milestone release of Spring Cloud Pipelines - 1.0.0.M5.

What’s new?

With 1.0.0.M5 we’ve added a new step in the Build stage called API Compatibility check. Now, your pipeline can break when, as a HTTP / messaging producer, you’re doing a backward incompatible change. We’re checking what were the latest contracts you’ve defined for your most recent production deployment and from those contracts we’re generating tests to your current application.

You can read more about this feature in Spring Cloud Pipelines Docs

Also, the…

I am pleased to announce that Gradle dependency management plugin 1.0.3.RELEASE is now available from Maven Central, Bintray, and the Gradle Plugin Portal. This maintenance release fixes a handful of issues and is a recommended upgrade for all users of the plugin.

On behalf of the community, I’m pleased to announce the releases of Spring Security OAuth 2.1.1 and 2.0.14.

Both are maintenance releases that primarily include bug fixes and minor improvements.

Project Page | GitHub | Documentation | Help

On behalf of the Spring Cloud Data Flow team, I’m pleased to announce the release of Spring Cloud Data Flow and Spring Cloud Data Flow for Cloud Foundry 1.2.1.RELEASE. This release provides several improvements around OAuth2 authorization.

Here are the relevant links to documentation and getting started guides.

• Local: Quick Start, Getting Started Guide
• Cloud Foundry: Getting Started Guide

Spring Cloud Data Flow now provides role support for OAuth2, converging with the VIEW, CREATE, MANAGE roles that Data Flow supports when using the traditional security option. Considering the varying use-case requirements across organizations in regards to security roles, the out-of-the-box implementation will assign all the VIEW, CREATE, MANAGE roles to the OAuth authenticated user. However, this can be customized by providing your own AuthoritiesExtractor…

On behalf of the community, I am pleased to announce that the Service Release 1 (SR1) of the Spring Cloud Dalston Release Train is available today. The release can be found in Maven Central. It is mostly a bugfix and documentation update. You can check out the Dalston release notes for more information.

The following modules were updated as part of Dalston.SR1: