The following CVEs have been published today:

• CVE-2018-11039: Cross Site Tracing (XST) with Spring Framework
• CVE-2018-11040: JSONP enabled by default in MappingJackson2JsonView

Fixes for those vulnerabilities have been released with Spring Framework 5.0.7 & 4.3.18, Spring Boot 1.5.14 and Spring Boot 2.0.3.

Please, review the information in the CVE reports and upgrade immediately.

On behalf of the Reactor team, I have the pleasure of announcing a first shipment of Reactor goodness this week: Reactor Bismuth-SR10 is out ?

Stay tuned for a Reactor Californium milestone later this week ??‍♂️

Reactor Bismuth-SR10

The latest maintenance BOM of the 3.1.x line, Bismuth-SR10, is out. It includes two new artifacts (click on the version numbers to see the release notes on GitHub):

• reactor-core 3.1.8.RELEASE
• reactor-netty 0.7.8.RELEASE

One update considerations though: Flux.last() used to skip throwing a NoSuchElementException on some category of empty sources (Flux or Mono that are Callable, like Flux.empty()). This is a bug…

On behalf of the Spring Data team, I'd like to announce the availability of the Ingalls SR13 and Kay SR8 service releases. The Ingalls service release ships on top of the just-released Spring Framework 4.3.18 and in preparation of the upcoming Spring Boot 1.5.14 release. The Kay service release picks up Spring Framework 5.0.7 and will be picked up by Spring Boot 2.0.3, for your convenience.

Both releases ship with 119 tickets fixed in total and are recommended upgrades to all users of the Ingalls and Kay release trains. You can find all details within the linked changelogs.

Ingalls SR 13

• Spring Data Commons 1.13.13 - Artifacts - Javadoc - Documentation - Changelog
• Spring Data JPA 1.11.13 - Artifacts - Javadoc - Documentation - Changelog
• Spring Data for Apache Cassandra 1.5.13 - Artifacts - Javadoc - Documentation - Changelog
• Spring Data Neo4j 4.2.13 - Artifacts - Javadoc - Documentation - Changelog
• Spring Data KeyValue 1.2.13 - Artifacts - Javadoc - Documentation - Changelog
• Spring Data for Apache Solr 2.1.13 - Artifacts - Javadoc - Documentation - Changelog
• Spring Data Gemfire 1.9.13 - Artifacts - Javadoc - Documentation - Changelog
• Spring Data MongoDB 1.10.13 - Artifacts - Javadoc - Documentation - …

On behalf of the team, I am pleased to announce that Spring Boot 1.5.14 has been released and is is now available from repo.spring.io and Maven Central.

Spring Boot 1.5.14 includes 42 fixes, improvements and dependency updates. Thanks to all that have contributed with issue reports and pull requests.

How can you help?

If you're interested in helping out, check out the "ideal for contribution" tag in the issue repository. If you have general questions, please ask on stackoverflow.com using the spring-boot tag or chat with the community on Gitter.

Project Page | GitHub | Issues | Documentation | Stack Overflow | …

This post was authored by Vedran Pavić

On behalf of the community I’m pleased to announce the release of Spring Session BOM Apple-SR3. This release includes an update of Spring Session core modules (which include Data Redis, Hazelcast and JDBC) to 2.0.4.RELEASE.

The following table provides an overview of all the included modules and their respective versions:

Module

Version

Spring Session Core

2.0.4.RELEASE

Spring Session Data GemFire

2.0.2.RELEASE

Spring Session Data Geode

2.0.2.RELEASE

Spring Session Data MongoDB

2.0.2.RELEASE

Spring Session Data Redis

2.0.4.RELEASE

Spring Session Hazelcast

On behalf of the team, I am pleased to announce that Spring Boot 2.0.3 has been released and is is now available from repo.spring.io and Maven Central.

Spring Boot 2.0.3 includes 99 fixes, improvements and dependency updates. Thanks to all that have contributed with issue reports and pull requests.

How can you help?

If you're interested in helping out, check out the "ideal for contribution" tag in the issue repository. If you have general questions, please ask on stackoverflow.com using the spring-boot tag or chat with the community on Gitter.

Project Page | GitHub | Issues | Documentation | Stack Overflow | …

On behalf of the Spring Cloud team, it is my pleasure to announce a new milestone release of Spring Cloud Pipelines - 1.0.0.M8.

What’s new?

This release adds a lot of new features and quality and testing improvements. As for main features, we’ve added support for a project with multiple modules, and for mono-repos (projects with standalone application sources in it). As for quality and testing, we’re approaching 200 Bash tests (we’ve written missing tests for the Concourse pipeline). We’ve started publishing the project’s sources as a downloadable artifact. That way instead of cloning the repo or downloading the ~25mb archive, you can fetch around 150kb of sources. The docs for 1.0.0.M8…

On behalf of the team, I am pleased to announce that the Spring Framework 5.0.7 and 4.3.18 maintenance releases are available now.

Spring Framework 5.0.7 includes 39 fixes and selected improvements while Spring Framework 4.3.18 includes 15 fixes and selected improvements. Those are the base for the upcoming Spring Boot 2.0.3 and 1.5.14 maintenance releases later this week.

Project Page | GitHub | Issues | Documentation

On behalf of the community, I am pleased to announce that the Spring Security 5.0.6 (changelog) and 4.2.7 (changelog) have been released. The releases primarily delivers bug fixes and dependency version updates along with some minor improvements. The releases will be found in the upcoming Spring Boot maintenance releases coming later this week.

Project Site | Reference | Help