Spring Integration 4.3.23, 5.1.12, 5.2.8 & 5.3.2 available; CVE-2020-5413

Releases | Artem Bilan | July 22, 2020 | ...

Dear Spring community,

On behalf of the team and everyone who contributed, it is my pleasure to announce a number of maintenance releases for Spring Integration. Mostly these versions contain bug fixes and dependency upgrades.

CVE-2020-5413

The Spring Integration framework provides Kryo Codec implementations as an alternative for Java (de)serialization. When Kryo is configured with default options, all unregistered classes are resolved on demand. This leads to the "deserialization gadgets" exploit when the incoming data contains malicious code for execution during deserialization.

In order to protect against this type of attack, Kryo can be configured to require a set of trusted classes for (de)serialization. Spring Integration calls kryo.setRegistrationRequired(true); (trust no one) by default and pre-configures out-of-the-box Message<?> implementations as trusted classes. All other types have to be registered with Kryo using any available KryoRegistrar strategy injected into a PojoCodec

Spring Data Neumann SR2, Moore SR9, and Lovelace SR19 available now

Releases | Mark Paluch | July 22, 2020 | ...

On behalf of the team, I'm pleased to announce a Spring Data release triple feature: Neumann SR2, Moore SR9, and Lovelace SR19. These service releases are built on top of Spring Framework releases 5.2.8 (Neumann and Moore) and 5.1.17 (Lovelace) and ship with mostly dependency upgrades and fixes, along with a few selected improvements.

Spring Data Neumann SR2 contains 70 improvements and fixes. Spring Data Moore SR9 ships with 35 fixes and improvements. Last, Spring Data Lovelace SR19 includes 23 selected fixes.

All service releases will be picked up by the upcoming Spring Boot 2.3.2, 2.2.9, respective 2.1.16 releases for…

This Week in Spring - July 21, 2020

Engineering | Josh Long | July 21, 2020 | ...

Hi, Spring fans! Welcome to yet another installment of This Week in Spring! How're you doing? Good, I hope!

I've just finished recording two epic episodes of a Bootiful Podcast that'll be streaming to ears near you in the not-too-distant future. I can not wait.

I'm also super excited: tomorrow I'll be hosting the Reactive Spring and Spring Tips-themed edition of SpringOne Tour. Do not miss this!

Also, the Spring team wants to hear from you! Please fill this survey out.

We've got a ton of stuff to get into this week, so let's begin.

Spring Framework 5.2.8, 5.1.17, 5.0.18, and 4.3.28 available now

Releases | Brian Clozel | July 21, 2020 | ...

On behalf of the team and everyone who has contributed, I am pleased to announce a full round of Spring Framework releases.

Spring Framework 5.2.8 includes 36 fixes and improvements. Spring Framework 5.1.17 includes 15 selected fixes and improvements.

The maintenance release for 5.0.x (5.0.18) ships with 13 selected fixes and improvements. The 4.3.x branch (4.3.28) also ships with 13 selected fixes and improvements, including a CORS configuration change (see gh-25414 and the CORS section of the reference documentation for more details).

As usual, we'll follow up shortly with corresponding Spring Boot releases (2.3.2, 2.2.9 and 2.1.16

Introducing Java Functions for Spring Cloud Stream Applications - Part 1

Engineering | David Turanski | July 20, 2020 | ...

Introducing Java Functions for Spring Cloud Stream Applications - Part 1

Last week we posted Introducing Java Functions for Spring Cloud Stream Applications - Part 0
to announce the release of Spring Cloud Stream applications 2020.0.0-M2.
Here, we explore function composition, one of the more powerful features enabled by the function oriented architecture presented in Part 0. If you haven’t had a chance to read Part 0, now would be a great time!

Function Composition

Function composition has a solid theoretical foundation in mathematics and computer science.
In practical terms, it is a way to…

Spring Initializr 0.9.0 available now

Releases | Stéphane Nicoll | July 15, 2020 | ...

On behalf of the team and everyone who has contributed, I’m happy to announce that Spring Initializr 0.9.0 has been released and is now available from repo.spring.io and Maven Central.

This release includes 34 fixes, improvements and dependency upgrades. Thanks to all those who have contributed with issue reports and pull requests.

For full upgrade instructions and new and noteworthy features please see the release notes.

GitHub | Issues | Documentation | Stack Overflow | Gitter

This Week in Spring - July 14th, 2020

Engineering | Josh Long | July 14, 2020 | ...

Hi, Spring fans! How're things? Good? Good. I just finished (virtually) presenting for the always-lovely London Java Community this morning. We spoke about Kotlin and Spring and things. It was good. Thank you so much for having me LJC! I also kicked off the epic JetBrains Java Day Online event last Friday. That was a ton of fun! Thank you Jetbrains. I finally, finally, put some elbow grease into automating a listing of some my activity and so now whenever I publish a new Spring Tips video, a new A Bootiful Podcast podcast, or commit to a new public appearance, I'll have information here on my…

The Spring team wants to hear from you!

Engineering | Ben Wilcock | July 14, 2020 | ...

The “State of Spring 2020” report will be published soon, based on the views and experiences of Spring Boot development experts across the globe. In exchange for 15 minutes of your time to complete the survey, you’ll be among the first to receive the survey report and the insights included in it. Please feel free to share this email with your Spring development colleagues. The survey will close at the end of July.

Take the survey now.

Thanks for sharing your thoughts and experiences with us! The Spring Team

Building web applications with Spring Boot and Vaadin

Engineering | Stéphane Nicoll | July 14, 2020 | ...

This post is a guest post by community member Marcus Hellberg (@marcushellberg). Marcus is the head of the Community team at Vaadin. He likes helping developers discover and learn modern web technologies by creating online content and speaking with developers at events.

Building web apps can be a daunting task. There are many moving parts: you need to define the structure in HTML and then use CSS to make it look the way you want. For frontend apps, you also need to write the app logic in JavaScript and connect it to your backend over REST. And of course, you also need to implement the…

Get the Spring newsletter

Thank you for your interest. Someone will get back to you shortly.

Get ahead

VMware offers training and certification to turbo-charge your progress.

Learn more

Get support

Tanzu Spring Runtime offers support and binaries for OpenJDK™, Spring, and Apache Tomcat® in one simple subscription.

Learn more

Upcoming events

Check out all the upcoming events in the Spring community.

View all