CVE Reports Published for Reactor Netty

News | Rossen Stoyanchev | February 27, 2020 | ...

The following CVE reports were published today:

  • CVE-2020-5403 affecting Reactor Netty HttpServer 0.9.3 and 0.9.4.
  • CVE-2020-5404 affecting Reactor Netty HttpClient for all 0.8.x and 0.9.x versions in applications where the automatic following of redirects is explicitly enabled.

The fixes are in Reactor Netty 0.9.5 and 0.8.16. If using the reactor-bom, you can upgrade to Dysprosium-SR5 or Californium-SR16.

Reactor Netty is used internally in many frameworks including Spring WebFlux and its WebClient. If you have a Spring Boot application, you can upgrade to Spring Boot 2.2.5 or 2.1.13.

Spring Data Moore SR5 and Lovelace SR16 released

Releases | Mark Paluch | February 26, 2020 | ...

On behalf of the community, I'd like to announce the availability of the Spring Data Moore SR5 and Lovelace SR16 service releases.

Moore SR5 ships with 61 tickets fixed, and Lovelace SR16 ships with 43 tickets fixed. Both releases contain mostly bug fixes and dependency upgrades. Moore SR5 is built on top of the just-released Spring Framework 5.2.4 and will be picked up by Spring Boot 2.2.5 for your convenience. Similarly, Lovelace SR16 uses Spring Framework 5.1.14 and will be included by Spring Boot 2.1.13 in the next days.

Finally, here are links to the reference documentation, changelogs…

Spring Tips: Apache RocketMQ

Engineering | Josh Long | February 25, 2020 | ...

Hi, Spring fans! In this installment of Spring Tips, we're going to look at Alibaba's Apache RocketMQ. We've talked some about Alibaba in Spring Tips before. Check out the earlier Spring Tips installment in which we explore some of Spring Cloud Alibaba.

Running Apache RocketMQ

In order to use Apache RocketMQ, you'll need to follow the steps in the RocketMQ quickstart. This Spring Tips installment introduces Apache RocketMQ, originally a technology developed and used internally at Alibaba and proven in the forge of 11/11, the famous Chinese sales holiday, sort of like "Cyber Monday," or "Black Friday," in the US. Sort of like that, but waaaaaay bigger. In 2019, Alibaba (alone, with no other e-commerce engines involved), made almost $40 billion USD in 2…

This Week in Spring - February 25th, 2020

Engineering | Josh Long | February 25, 2020 | ...

Hi, Spring fans! This week I am in delicious Philadelphia enjoying the amazing food (scrapple! TastyKakes!) and hanging out with amazing customers using VMWare and Spring to great effect. It's been a busy week since we last talked: I released a new Spring Tips installment, wrote a bunch of blogs, recorded a new podcast, and published a new podcast installment. We've got a lot to get to today so let's get to it!

Spring Framework 5.2.4 and 5.1.14 available now

Releases | Stéphane Nicoll | February 25, 2020 | ...

On behalf of the team and everyone who has contributed, I am pleased to announce that Spring Framework 5.2.4 and 5.1.14 are available now.

The fourth maintenance release of the 5.2 line includes over 60 fixes and improvements. Spring Framework 5.1.14 includes 14 selected fixes and improvements.

As usual, we'll follow up shortly with corresponding Spring Boot releases (2.2.5 and 2.1.13).

Project Page | GitHub | Issues | Documentation

Netflix Built a Spring Application Generator to Boost Dev Productivity. Here's How You Can, Too.

Engineering | Ben Wilcock | February 24, 2020 | ...

If you watch Taylor Wicksell of Netflix's SpringOne Platform keynote you can’t help but be blown away by the sheer productivity of their engineering team. Last year, over 300 Spring-based apps went into production – an incredible achievement.

Taylor Wicksell of Netflix's SpringOne Platform Keynote

What Can Your Enterprise Learn From Netflix?

At Netflix, Taylor and his Java Platform team own the Java developer experience (DevEx). Taylor’s team has one mission: to help Netflix's engineers stay productive – delivering great code at great velocity. It’s a mission that is clearly proving successful.

Netflix's Java Platform Team's Top Technical Priorities

Top of Taylor’s list of productivity secrets is Application Generators. Netflix found that developers adopt platforms far quicker when everything they need to get started is right there, at their fingertips. Application generators help developers to get started quickly by providing useful guide rails that reduce toil and ease their burden. Application generators also encourage common approaches to common problems – particularly useful if you have lots of teams creating microservices…

Spring Boot for Apache Geode & Pivotal GemFire 1.3.0.M2 Available

Releases | John Blum | February 24, 2020 | ...

On behalf of the Spring, Apache Geode & Pivotal GemFire communities, it is my pleasure to announce the release of Spring Boot for Apache Geode & Pivotal GemFire (SBDG) 1.3.0.M2.

The 1.3.0.M2 release aligns with:

  • Spring Framework 5.2.3.RELEASE

  • Spring Boot 2.3.0.M2

  • Spring Data for Apache Geode & Pivotal GemFire (SDG) 2.3.0.M3

  • Spring Data Neumann-M3

  • Spring Session for Apache Geode & Pivotal GemFire (SSDG) 2.3.0.M2

  • Spring Session Dragonfruit-M2

  • Spring Test for Apache Geode & Pivotal GemFire (STDG) 0.0.13.RELEASE

See the changelog for more details.

This release is available in the Spring Milestone Repository as well as available on Spring Initializer at start.spring.io

Spring Session for Apache Geode & Pivotal GemFire 2.3.0.M2 Available

Releases | John Blum | February 24, 2020 | ...

On behalf of the Spring, Apache Geode and Pivotal GemFire communities, it is my pleasure to announce the release of Spring Session for Apache Geode & Pivotal GemFire (SSDG) 2.3.0.M2.

The 2.3.0.M2 release aligns with:

  • Spring Framework 5.2.3.RELEASE

  • Spring Data Neumann-M3

  • Spring Session Dragonfruit-M2

  • Spring Session core 2.3.0.M1

See the changelog for additional details.

The release is available in the Spring Milestone Repository.

Feedback

As always, any feedback is greatly appreciated and welcomed.

Issues | PR | StackOverflow

A Bootiful Podcast: Building China-scale Infrastructure at Alibaba with Spring Cloud, Rsocket, and more

Engineering | Josh Long | February 21, 2020 | ...

Hi, Spring fans! In this installment Josh Long (@starbuxman) talks to friends - Mercy Ma (马昕曦), Andy Shi (施孜海), and Jim Fang (方剑) - from Alibaba. These engineers work on Spring Cloud Alibaba, some of the open source infrastructure coming out of Alibaba designed to support Spring applications running at Alibaba, and more.

Spring Tips: RSocket and Spring Security

Engineering | Josh Long | February 19, 2020 | ...

Hi, Spring fans! In this first installment of Spring Tips season 7, we look at how to lock down RSocket services with Spring Security.

By Josh Long (@starbuxman)

Hi, Spring fans! In this installment, we look at using Spring Security and RSocket together. RSocket is a payload and platform agonostic wire protocol developed by engineers at Netflix and Facebook that supports the Reactive Streams concepts on the wire. The protocol is a stateful-connection centric protocol: a requester node connects and stays connected to another responder node. Once connected, either side can transmit information…

Get the Spring newsletter

Thank you for your interest. Someone will get back to you shortly.

Get ahead

VMware offers training and certification to turbo-charge your progress.

Learn more

Get support

Tanzu Spring Runtime offers support and binaries for OpenJDK™, Spring, and Apache Tomcat® in one simple subscription.

Learn more

Upcoming events

Check out all the upcoming events in the Spring community.

View all