Hi, Spring fans! Welcome to another installment of This Week in Spring! I'm back home from the Hawaiin islands. It's so good to be home.

First thing's first: there's a security vulnerability. We've already released guidance on how to mitigate as well as new releases of Spring Framework and Spring Boot that include the mitigation by deault. See the links below for more.

• Spring Framework RCE, Early Announcement
• Spring Framework RCE, Mitigation Alternative
• CVE report published for Spring Cloud Function

Now, back to your regularly scheduled installment of This Week in Spring:

• A Bootiful Podcast: Kubernetes cofounder and vice president of R&D at VMware, Craig McLuckie
• Blog: Is Your Cluster Ready for v1.24?
…

On behalf of the team and everyone who has contributed, I’m happy to announce that Spring Cloud Dataflow 2.9.4 has been released and is now available from Maven Central.

This release contains an update of the Spring Boot version and addresses a couple of CVEs. See the release notes for more information.

Notable Changes in 2.9.4

• Update to Spring Boot 2.5.12
• Resolves CVE-2022-22965
• Resolves CVE-2021-29425

Stay in touch...

As always, we welcome feedback and contributions, so please reach out to us on Stackoverflow or GitHub.

Yesterday we announced a Spring Framework RCE vulnerability CVE-2022-22965, listing Apache Tomcat as one of several preconditions. The Apache Tomcat team has since released versions 10.0.20, 9.0.62, and 8.5.78 all of which close the attack vector on Tomcat's side. While the vulnerability is not in Tomcat itself, in real world situations, it is important to be able to choose among multiple upgrade paths that in turn provides flexibility and layered protection.

Upgrading to Spring Framework 5.3.18+ or 5.2.20+ continues to be our main recommendation not only because it addresses the root cause…

Hi, Spring fans! In this installment we dare to be boring with YugabyteDB, a distributed database that just works. It's a database that feels like PostgreSQL but scales like Apache Cassandra.

Updates

• [04-13] "Data Binding Rules Vulnerability CVE-2022-22968" follow-up blog post published, related to the "disallowedFields" from the Suggested Workarounds
• [04-08] Snyk announces an additional attack vector for Glassfish and Payara. See also related Payara, upcoming release announcement
• [04-04] Updated Am I Impacted with improved description for deployment requirements
• [04-01] Updated Am I Impacted with additional notes
• [04-01] Updated Suggested Workarounds section for Apache Tomcat upgrades and Java 8 downgrades
• [04-01] "Mitigation Alternative" follow-up blog post published, announcing Apache Tomcat releases versions 10.0.20, 9.0.62, and 8.5.78…

On behalf of the team and everyone who has contributed, I'm happy to announce that Spring Boot 2.5.12 has been released and is now available from Maven Central.

The Spring Framework version in this release includes a fix for CVE-2022-22965, check the dedicated blog post for more details.

This release includes 5 bug fixes, documentation improvements, and dependency upgrades. Thanks to all those who have contributed with issue reports and pull requests.

How can you help?

If you're interested in helping out, check out the "ideal for contribution" tag in the issue repository. If you have general questions, please ask on stackoverflow.com using the spring-boot tag or chat with the community on Gitter…

On behalf of the team and everyone who has contributed, I'm happy to announce that Spring Boot 2.6.6 has been released and is now available from Maven Central.

The Spring Framework version in this release includes a fix for CVE-2022-22965, check the dedicated blog post for more details.

This release includes 6 bug fixes, documentation improvements, and dependency upgrades. Thanks to all those who have contributed with issue reports and pull requests.

How can you help?

If you're interested in helping out, check out the "ideal for contribution" tag in the issue repository. If you have general questions, please ask on stackoverflow.com using the spring-boot tag or chat with the community on Gitter…

Hi, Spring fans! Welcome to another installment of a Bootiful Podcast! In this episode, Josh Long (@starbuxman) talks to Kubernetes cofounder, all-around nice person, and vice president of R&D at VMware, Craig McLuckie (@cmcluck).

NOTE: Hi, Spring fans! This is a guest post from Sean Li, our friend at Microsoft

I am pleased to announce that Spring Cloud Azure 4.0 is now generally available. With this major release we aim to bring better security, leaner dependencies, support for production readiness and more. Version 4 represents a significant milestone in our product roadmap that we couldn’t have delivered without the collective wisdom of the Spring community and customer feedback. On behalf of the Spring on Azure product team, thank you for making this happen!

Unified Development Experience

At the Developer Division…