We have released Spring Security 5.3.2, 5.2.4, 5.1.10, 5.0.16 and 4.2.16 to address the following CVE reports:

• CVE-2020-5407: Signature Wrapping Vulnerability with spring-security-saml2-service-provider
• CVE-2020-5408: Dictionary attack with Spring Security queryable text encryptor

Please review the information in the CVE report and upgrade immediately.

Spring Boot users should upgrade to 2.2.7 or 2.1.14.

Reading Time: about 7 minutes. Coding Time: about 20 minutes.

If you've been following my series on RSocket, you've heard me refer to "clients and servers" many times. But, with RSocket, the line between client and server is blurry. With Rsocket, servers can send messages to clients, and clients can respond to these requests in the same way a server would.

In fact, the RSocket docs don't use the terms 'client' or 'server.' The docs use the terms 'requester' and 'responder' instead. In RSocket, any component can act as a requester, and any component can act as a responder or even both at the…

Hi, Spring fans! Welcome to another installment of This Week in Spring! I hope you're all doing well, staying safe, taking socially distant walks every day to get some fresh air and exercise, and so on. I'm trying my best to stay sane. We just crossed into month three-under quarantine, having gone into quarantine on 11 March 2020. It's pretty crazy to think about how slowly and quickly time has flown.

One of the things that makes me happy? Learning new things. This weekly roundup, This Week in Spring, has always been a lot of fun for me. It's become even more of a privilege in the age of quarantine, having something to learn and soak up. I know that most of us will get through this, but I've been very keen on not letting this time go to waste for me. It's exhausting to live under this quarantine. It's exhausting to be anxious about things. I completely understand the instinct to want to just stay in bed until it all blows over. It's completely normal. You're allowed to be anxious, to worry, to feel despair. I have those days, too. But, I have found it helpful to try to plan activities with my family and to focus on backburner projects. And I find walking to be helpful. My condo's gym is closed because of…

Dear Spring community,

On behalf of the Spring Data team and many contributors, it is my pleasure to announce that Spring Data Neumann is generally available from repo.spring.io as well as Maven Central! This release ships with over 650 features, bugfixes and improvements containing numerous major version and driver upgrades.

This very tightly curated overview summarizes the most significant changes:

• Repository support for Kotlin Coroutines.
• Upgrade to MongoDB Driver 4.
• Upgrade to Cassandra Driver 4.
• Upgrade to Couchbase SDK 3
• Upgrade to Querydsl 4.3
• Upgrade to Elasticsearch 7 and fully revise Template API for consistent Elasticsearch usage.
• Inclusion of Spring Data R2DBC into the release train.
• Merge of Spring Data for Apache Geode and Spring Data GemFire into a single Spring Data Geode module.
• Joda-Time and ThreeTenBackport support deprecated.
…

On behalf of the community, I’m pleased to announce the release of Spring Security OAuth2 Auto-config 2.3.0.RC1 (release notes), 2.2.7.RELEASE (release notes), 2.1.14.RELEASE (release notes). The release delivers dependency updates to be compatible with the last versions of Spring Boot. Users are encouraged to update to the latest patch release.

Project Site | Reference | Help

We are pleased to announce that Spring Cloud Task 2.3.0-M1 is now available on Github and the Spring download repository. Many thanks to all of those who contributed to this release.

What's New?

Spring Cloud Task 2.3.0-M1 is intended to be the version of the framework aligned with Spring Boot 2.3. Updates from 2.2.x include:

• Updates to all dependencies.
• Support for specifying a PlatformTransactionManager to be used by Spring Cloud Task.
• A starter for singl-step Spring Batch jobs.

Let's walk through these updates in more detail.

Update to All Dependencies

As stated earlier, this is first…

In January 2018, we announced that the Spring Security OAuth (legacy) project is officially in maintenance mode. Later in November of 2019, we provided an update in the Spring Security OAuth 2.0 Roadmap, stating that the 2.3.x line will reach end-of-life in March 2020.

The currently supported version branches are 2.4.x and 2.5.x, with the 2.5.0 release scheduled for May 2020, which will be the final minor release.

To that end, the plan is to provide patch and security fixes for the 2.4.x and 2.5.x line until May 2021. Additionally, security fixes will be supported for the 2.5.x line until May 2022, at which point the project will have reached end-of-life. The same end-of-life timeline applies to the Spring Boot 2 auto-configuration project…

UPDATE 2020-05-13: The following versions of Spring Security address CVE-2020-5407 and CVE-2020-5408

On behalf of the community, I’m pleased to announce the release of Spring Security 5.3.2 (release notes), 5.2.4 (release notes), 5.1.10 (release notes) , 5.0.16 (release notes), 4.2.16 (release notes). These releases deliver bug fixes along with some minor improvements. Users are encouraged to update to the latest patch release.

Project Site | Reference | Help

On behalf of the community, I’m pleased to announce the release of Spring LDAP 2.3.3 (release notes). The release delivers bug fixes along with some minor improvements. Users are encouraged to update to the latest patch release.

Project Site | Reference | Help