Spring AI Agentic Patterns (Part 1): Agent Skills - Modular, Reusable Capabilities

Agent Skills are modular folders of instructions, scripts, and resources that AI agents can discover and load on demand. Instead of hardcoding knowledge into prompts or creating specialized tools for every task, skills provide a flexible way to extend agent capabilities. Spring AI's implementatio...

LLM Response Evaluation with Spring AI: Building LLM-as-a-Judge Using Recursive Advisors

The challenge of evaluating Large Language Model LLM outputs is critical for notoriously non-deterministic AI applications, especially as they move into production. Traditional metrics like ROUGE and BLEU fall short when assessing the nuanced, contextual responses that modern LLMs produce. Human...

Access API Moves to Spring Security Access

Five years ago, Spring Security began the journey of modernizing its authorization API. This has paved the way for a number of exciting features like Authorized POJOs, value masking, and, planned for Spring Security 7, Multi-Factor Authentication. This also deprecated the majority of the Access...

This Week in Spring - June 24th, 2025

Hi, Spring fans! Welcome to another installment of This Week in Spring! We're in the middle of June already! And you know what that means? Warm weather, fun, and of course: the amazing SpringOne event in lovely Las Vegas, NV! The content catalog went live today! I'll be there doing, among other...

This Week in Sprng - April 1st, 2025

Hi, Spring fans! Welcome to another exciting installment of This Week in Spring! It's April Fools day, so be wary of things you read on the internet, but it's also the 11th anniversary of Spring Boot 1.0, which was released this day in 2014! that's not an April Fools. Happy birthday! I'm in...

Bootiful Spring Boot 3.4: Spring Batch

The new release of Spring Batch 5.2 has a ton of features! Spring Batch is a compelling way to handle large but finite sequential data access. Think: reading from an SQL database and writing to a CSV, or reading from an FTP server and writing out an analysis of a MongoDB - batch processing. You...

Spring Tips: Further, Faster with Spring Boot 3.3

Hi, Spring fans! In this installment we look at ways to make your applications go further, faster, with AppCDS, GraalVM, AOT on the JRE, and Project CRaC coordinate restore at checkpoint springboot java graalvm programming coding...

This Week in Spring - May 21st, 2024

Welcome to another installment of This Week in Spring! It's been yet another amazing and exciting week and with it a bevy of new releases. And of course, in about a week's time, we will find ourselves at Spring IO, ready to show a lot of these new things. Will you be there? I will! Anyway, let's...

A Bootiful Podcast: Spring Data legend Greg Turnquist on optimizations and queries and more

Hi, Spring fans! In this installment, we'll talk to Spring Data legend Greg Turnquist @gregturn about the incredible next-level optimizations and query enhancements, the work in general, and so much more. Recorded live at SpringOne 2023 in Las Vegas!...

Spring Boot 3.1's ConnectionDetails abstraction

If you've used Spring Boot for a while, you're probably familiar with setting up connection details using properties. For example, you may have used spring.datasource.url to configure a JDBC connection. In Spring Boot 3.1 this continues to work as you'd expect, but we've changed things a bit unde...

This Week in Spring - June 13th, 2023

This Month in Spring - June 13th, 2023 Hi, Spring fans! Welcome to another installment of This Week in Spring! I am in beautiful Taipei, eating delicious food and meeting amazing people in the sweltering weather. How're you doin'? I've got to join a meeting, so I'll make this quick. One quick thi...

A Bootiful Podcast: Moderne founder Jon Schneider on OpenRewrite, modernizing code bases en masse, freedom and responsibility, and more

Hi, Spring fans! In this installment, Josh Long @starbuxman talks to Moderne @moderneinc founder Jon Schneider @jonkschneider on OpenRewrite, modernizing code bases en masse, freedom and responsibility, and more...

The new Spring Boot version validation and upgrade support in Spring Tools

New releases of Spring Boot are being released on a quite frequent schedule and updating your projects to newer versions of Spring Boot is something that many teams and organizations around the globe do as part of their daily work. Sometimes those upgrades are simple and easy, for example for new...

Bootiful Podcast: Spring Mad Scientist Andy Clement on SpringOne 2022, AOT, Azure Spring Apps, and more

Hi, Spring fans! In this installment, Josh Long @starbuxman talks to Spring mad scientist Andy Clement @andyclement about the new native support in Spring Boot 3, SpringOne 2022, and Azure Spring Apps, among other things...

Zip-slip mitigation bypass in Spring Integration Zip extension

spring-integration-zip , versions prior to 1.0.4, exposes an arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive affects other archives as well, bzip2, tar, xz, war, cpio, 7z, that holds path traversal filenames. So when the filename gets concatenated to...

A Bootiful Podcast: JReleaser creator and fellow Java Champion Andres Almiray

Hi, Spring fans! What if the JVM could feel as frictionless as the modern dev tools people rave about on other platforms? In this wide-ranging, high-energy conversation, you’ll hear two longtime friends Andres Almiray is a fellow Java champion and a legend geek out over the future of desktop Java...

A Bootiful Podcast: BellSoft's Catherine Edelveis on hardened runtime images, container security, and more

Hi, Spring fans! I chat with BellSoft’s Catherine Edelweiss about using buildpacks and hardened images to ship Spring Boot apps with stronger security, cleaner defaults, and far less Dockerfile pain. BellSoft Docker Java JRE SpringBoot...

cve-2026-47878 - MEDIUM - Unsafe Java deserialization in DefaultExecutionContextSerializer without class allowlist

cve-2026-47878 - MEDIUM - Unsafe Java deserialization in DefaultExecutionContextSerializer without class allowlist...

cve-2026-47894 - MEDIUM - Spring Cloud Config Server Native Environment Repository Exposure

cve-2026-47894 - MEDIUM - Spring Cloud Config Server Native Environment Repository Exposure...

cve-2026-41708 - HIGH - Spring Cloud Sleuth instrumentation of Spring TX DoS vulnerability

cve-2026-41708 - HIGH - Spring Cloud Sleuth instrumentation of Spring TX DoS vulnerability...

cve-2026-41697 - MEDIUM - Spring Data Relational Parameter not Escaped for Query By Example LIKE Pattern

cve-2026-41697 - MEDIUM - Spring Data Relational Parameter not Escaped for Query By Example LIKE Pattern...

cve-2026-41719 - MEDIUM - Spring Data KeyValue - SpEL Injection vulnerability in SpelPropertyComparator

cve-2026-41719 - MEDIUM - Spring Data KeyValue - SpEL Injection vulnerability in SpelPropertyComparator...

cve-2026-41008 - MEDIUM - Spring Security Authorization Server Open Redirect via request_uri

cve-2026-41008 - MEDIUM - Spring Security Authorization Server Open Redirect via requesturi...

cve-2026-41726 - MEDIUM - In Spring for Apache Kafka, unbounded delegate cache keyed on user-controlled, potentially malicious selector header

cve-2026-41726 - MEDIUM - In Spring for Apache Kafka, unbounded delegate cache keyed on user-controlled, potentially malicious selector header...

cve-2026-41696 - MEDIUM - Spring Data MongoDB Bind Parameter Literal Quoting Breakout

cve-2026-41696 - MEDIUM - Spring Data MongoDB Bind Parameter Literal Quoting Breakout...

cve-2026-40991 - MEDIUM - XML External Entity (XXE) injection when documenting untrusted XML content

cve-2026-40991 - MEDIUM - XML External Entity XXE injection when documenting untrusted XML content...

cve-2026-41006 - HIGH - Spring HATEOAS Collection+JSON/UBER deserializers do not honor Jackson configuration

cve-2026-41006 - HIGH - Spring HATEOAS Collection+JSON/UBER deserializers do not honor Jackson configuration...

Spring Cloud Config Clients Can Access Secrets From Any Project The Config Server Has Access To On Google Secrets Manager

When using Google Secrets Manager as a backend for the Spring Cloud Config server a client can craft a request to the config server potentially exposing secrets from unintended GCP projects...

A Bootiful Podcast: A Bootiful Podcast: Dr. Venkat Subramaniam and James Ward on Intelligent Kotlin and So Much More

I am beyond thrilled that I got to co-present with two legends, Dr. Venkat Subramaniam and James Ward, at Voxxed Days Amsterdam, and even more so that they both sat down for a quick discussion with me right before that presentation. Enjoy!...

A Bootiful Podcast: the legendary Craig Walls

Hi Spring fans! In this installment we talk to the legendary Craig Walls, author of Spring In Action , Spring AI in Action , and more!...

A Bootiful Podcast: Java developer advocate Ana-Maria Mihalceanu

I had a wonderful chat with Java Developer Advocate Ana-Maria Mihalceanu about Java Flight Recorder, Project Babylon, Project Panama, and so many other exciting things in the Java ecosystem...

A Bootiful Podcast: Daniel Garnier-Moiroux on MCP Security

Hi Spring, AI, Spring AI, security, and Spring Security fans! In this installment I talk to the legendary Daniel-Garnier Moiroux! ai mcp security java...

Blending Chat with Rich UIs with Spring AI and MCP Apps

The way humans typically interact with AI is via a chat-style interface such as ChatGPT or Claude Desktop. In fact, the ability to converse with an AI in natural language is perhaps one of the most amazing things about this technology. It lets humans talk to computers in human terms, rather than...

Null-safe applications with Spring Boot 4

This is a new blog post in the Road to GA series, this time sharing an update on the status of the null-safety support across the Spring portfolio, as a follow-up of my previous related blog post Null Safety in Spring applications with JSpecify and NullAway and related Spring I/O talk. Are we...

Spring Expression Language property modification using Spring Cloud Gateway Server WebFlux

The following versions of Spring Cloud Gateway Server Webflux may be vulnerable to Spring Environment property modification. An application should be considered vulnerable when all the following are true:...

A Bootiful Podcast: Spring Cloud guru Ryan Baxter

Hi, Spring fans! In this installment we talk to the amazing Spring Cloud contributor Ryan Baxter, live from SpringOne 2025!...

A Bootiful Podcast: Andrew Lombardi, Beginning Spring AI co-author, and friend of the show

Hi, Spring fans! In this installment I am thrilled to talk to my longtime friend Andrew Lombardi about the latest-and-greatest, his new book Beginning Spring AI , and more...

This Week in Spring - July 29th, 2025

It's the end of July! JULY! The seventh month of the year, done and dusted! AHHHHH! I've got memories of being on a tropical beach over the winter holidays, sipping rum and dodging mosquitoes like I was doing a rhythmic gymnastics routine just recently. It turns out that was seven months ago, not...

A Bootiful Podcast: DevOps and AI luminary Patrick Debois

Hi, Spring, cloud native, and AI fans! In this installment, I had the opportunity to briefly sit down and talk with DevOps and AI luminary Patrick Debois, from the amazing Devoxx UK 2025 show...

A Bootiful Podcast: Micrometer.io lead Tommy Ludwig on the latest-and-greatest in observability for the Spring developer

Hi, Spring fans! In this episode, I talk to Micrometer.io lead Tommy Ludwig on the latest-and-greatest in observability for the Spring developer...

A Bootiful Podcast: The legendary Daniel Garnier-Moiroux on security, AI, MCP, and more

Hi, Spring fans! In this installment I talk to the legendary Daniel Garnier-Moiroux on security, AI, MCP, and more, recorded live at Devoxx UK 2025...

A Bootiful Podcast: IntelliJ IDEA lead Aleksey Stukalov

Hi, Spring fans! In this installment I talk to IntelliJ IDEA lead Aleksey Stukalov...

Spring Security authorization bypass for method security annotations on private methods

Spring Security Aspects may not correctly locate method security annotations on private methods. This can cause an authorization bypass. Your application may be affected by this if the following are true: In that case, the target method may be able to be invoked without proper authorization. You...

Using Spring AI 1.0.0-SNAPSHOT: Important Changes and Updates

Using Spring AI 1.0.0-SNAPSHOT: Important Changes and Updates Spring AI 1.0.0-SNAPSHOT introduces several important changes to artifact IDs, dependency management, and autoconfiguration. This blog post outlines these changes and provides guidance on how to update your projects. The most significa...

Hello DCO, Goodbye CLA: Simplifying Contributions to Spring

The Spring team will be rolling out a simplified contribution process that replaces the requirement to sign a Contributor License Agreement CLA with a Developer Certificate of Origin DCO. The process will start this week with Spring Framework, Spring Security, & Spring Boot and then roll out to t...

Spring Tips: Testcontainers, Docker Compose, and Service Connections, oh my

Hi, Spring fans! In this installment, we look at the amazing service connection mechanism in Spring Boot. Service connections are what allow Spring Boot to connect to Testcontainers or Docker Compose containers for supporting infrastructure like SQL databases, middleare, and more. java...

This Week in Spring - July 2nd, 2024

Hi, spring fans! Welcome to another amazing installment of This Week in Spring! In last week's installment of A Bootiful Podcast, recorded a few weeks ago at Spring IO, I talked with Spring Security legend Laur Spilca In last week's installment of Spring Tips, I looked at a number of ways you cou...

Spring Cloud Function Web DOS Vulnerability

Description In Spring Cloud Function framework, versions 4.1.x prior to 4.1.2, 4.0.x prior to 4.0.8 an application is vulnerable to a DOS attack when attempting to compose functions with non-existing functions. Specifically, an application is vulnerable when all of the following are true: User is...

Arbitrary File Write Vulnerability in Spring Cloud Data Flow

Spring Cloud Data Flow is a microservices-based Streaming and Batch data processing in Cloud Foundry and Kubernetes. The Skipper server has the ability to receive upload package requests. However, due to improper sanitization for upload path, a malicious user who has access to skipper server api...

A Bootiful Podcast: Stuart Marks (aka ”Dr. Deprecator”) on Java, its amazing features, and more

Hi, Spring fans! Happy one-day-belated Java 22 release day to those who celebrate! To ring in the new release, we've got an extra special and incredible discussion with a Java legend - somebody who's been involved in the Java community and work for decades - Stuart Marks, or "Dr. Deprecator," as...