A Bootiful Podcast: Vaadin's Marcus Hellberg on rich UIs, Spring Boot 3, GraalVM native images, and more

Hi, Spring fans! In this installment, Josh Long @starbuxman talks to Vaadins Marcus Hellberg @marcushellberg about rich UIs, Vaadin Flow, the new Hilla Framework, GraalVM native image compilation, and so much more...

Do more with Azure Spring Apps – scale to zero and enhance productivity

In 2020, Spotify coined the term "Golden Path” to refer to a supported approach and set of components to build and deploy software. Having these paths simplifies the development process, lets developers focus on their applications instead of infrastructure and speeds time to production. Microsoft...

This Week in Spring - December 6th, 2022

Hi, Spring fans! Welcome to another installment of This Week in Spring! How are you? You know what Ive wanted to do? See my friends on the Spring team in person since the pandemic descended. And, Im overjoyed to relate, Ive just had the privilege of a nice meeting with several of them last night...

Spring WS Samples upgraded for Spring Boot 3.0!

With the recent announcement of Spring Boot 3.0 going GA, some of you may be interested in upgrading your Spring Web Services-based applications to take full advantage of this. The Spring WS team has upgraded our set of sample apps to help you carry that out. The main branch now tracks the versio...

A Bootiful Podcast: Java Champion Gunnar Morling about messaging middleware, Debezium, change data capture, and more.

Hi, Spring fans! In this installment, Josh Long @starbuxman talks to Java Champion Gunnar Morling @gunnarmorling about messaging middleware, Debezium, and more...

This Week in Spring - November 29th, 2022 (Spring Boot 3 has arrived)

Hi, Spring fans! Its here! Its finally here, at long last! Spring Boot 3!! And of course with Spring Boot 3.0 comes a whole portfolio of integrated projects that have also been updated! Remember, a huge theme in this release is support for GraalVM native images, and thats now supported across the...

Spring Tips: the road to Spring Framework 6: the new Ahead-of-Time Compilation Engine and GraalVM

Hi, Spring fans! Spring Boot 3 is here or will be tomorrow, on the 24th of November, 2022, to be more precise!, bringing a fantastic new Ahead-of-Time AOT compilation engine that supports GraalVM native images. Join me, and well dive deep into the engine and its interactions with the Spring...

This Week in Spring - November 22nd, 2022 - Spring Boot 3 and Thanksgiving edition!

Hi, Spring fans! Its Tuesday, the 22nd of November, 2022, as I write this, which means were two days away from Spring Boot 3 and Thanksgiving. Spring Boot 3, Ive written about in abundance so I wont rehash that. If you want to learn more about some of the amazing new features in Spring Framework ...

A Bootiful Podcast: Java Champion, legendary engineer, and teacher Trisha Gee

Hi, Spring fans! In this installment, Josh Long @starbuxman talks to Java Champion, legendary engineer, and teacher Trisha Gee @trishagee bout her extraordinary career working at organizations like LMAX, MongoDB, Jetbrains, and her new books, Heads First Java, and Getting to Know IntelliJ IDEA...

This Week in Spring - November 15th, 2022

Hi, Spring fans! Howre you doin this fine Tuesday morning? Ive returned home to San Francisco and am up and at em nice and early to catch a flight to Seattle, where Ill speak at the Java User Group tonight. If youre in Seattle, dont miss it! Weve got a ton of cool stuff to get into this week, but...

Updates on Spring Cloud Stream 4.0.0 Schema Registry Support

This blog gives an update on the Schema Registry support that is part of Spring Cloud Stream version 4.0.x. Many enterprises use a schema registry for schema evolution use cases, such as the Confluent Schema Registry. Starting with version 1.1.x of Spring Cloud Stream until 3.0.0, we provided a...

A Bootiful Podcast: RabbitMQ engineer Arnaud Cogoluègnes on the new and novel in RabbitMQ

Hi, Spring fans! In this episode, Josh Long @starbuxman talks to RabbitMQ engineer Arnaud Cogoluègnes @acogoluegnes on the new and novel in RabbitMQ...

This Week in Spring - November 8th, 2022

Hi, Spring fans! Welcome to another installment of This Week in Spring! Ive been busy this last week! Ive been visiting with customers and talking to the community here in South East Asia. I was in Malaysia last week, and now Im in Bangkok, Thailand. Im near the end of my time here in SE Asia,...

CVE Report Published for Spring Tools

We have released STS 4.16.1 for Eclipse and Spring VSCode extensions 1.40.0 to address the following CVE report: - CVE-2022-31691: Remote Code Execution via YAML editors in STS4 extensions for Eclipse and VSCode Please review the information in the CVE report and upgrade immediately. Eclipse: STS...

A Bootiful Podcast: Java Champion, legend, and prolific open source contributor Andres Almiray

Hi, Spring fans! In this installment, Josh Long @starbuxman talks to Java Champion, legend, and prolific opensource contributor Andres Almiray @aalmiray...

Remote Code Execution via YAML editors in STS4 extensions for Eclipse and VSCode

Spring Tools 4 for Eclipse version 4.16.0 and below as well as VSCode extensions such as Spring Boot Tools, Concourse CI Pipeline Editor, Bosh Editor and Cloudfoundry Manifest YML Support version 1.39.0 and below all use Snakeyaml library for YAML editing support. This library allows for some...

This Week in Spring - November 1st, 2022

Hi, Spring fans! Welcome to another installment of This Week in Spring! Howre you doin? I hope youre doing well and had a great Halloween if you celebrate. Im doing great. Im in sunny Kuala Lumpur, Malaysia, eating delicious food and hanging out with amazing people. Tomorrow, Im off to Penang,...

CVE-2022-31690: Privilege Escalation in spring-security-oauth2-client

Spring Security 5.6.9 and 5.7.5 released on October 31st, 2022 included a fix for CVE-2022-31690 affecting the mapping of authorized scopes in spring-security-oauth2-client. Users are encouraged to update as soon as possible. Impact Users who have applied the mitigation should take note of the...

CVE-2022-31692: Authorization rules can be bypassed via forward or include in Spring Security

Spring Security 5.6.9 and 5.7.5 released on October 31st, 2022 included a fix for CVE-2022-31692 affecting the AuthorizationFilter. Users are encouraged to update as soon as possible...

Authorization rules can be bypassed via forward or include dispatcher types in Spring Security

Spring Security, versions 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9 could be susceptible to authorization rules bypass via forward or include dispatcher types. Specifically, an application is vulnerable when all of the following are true: An application is not vulnerable if any of the following i...

Privilege Escalation in spring-security-oauth2-client

Spring Security, versions 5.7 prior to 5.7.5 , and 5.6 prior to 5.6.9 , and older unsupported versions could be susceptible to a privilege escalation under certain conditions. A malicious user or attacker can modify a request initiated by the Client via the browser to the Authorization Server whi...

Bootiful Podcast: Spring Mad Scientist Andy Clement on SpringOne 2022, AOT, Azure Spring Apps, and more

Hi, Spring fans! In this installment, Josh Long @starbuxman talks to Spring mad scientist Andy Clement @andyclement about the new native support in Spring Boot 3, SpringOne 2022, and Azure Spring Apps, among other things...

Spring Session 3.0.0-RC1

Spring Session 3.1.0-RC1 has been released. The biggest news from this release is that Spring Session Geode was removed which means all of the Spring Modules now belong to the same lifecycle. This means that the Spring Session BOM no longer uses CalVer and instead uses the same version as the...

Spring Tips: the road to Spring Boot 3: Spring Framework 6

Hi, Spring fans! In this installment, we begin a journey to Spring Boot 3, due end of November 2022. In this installment, well look - at a very high level - at some of the amazing features in Spring Framework 6, which underpins Spring Boot 3. Want to learn more about Spring Framework 6 and Spring...

This Week in Spring - October 25th, 2022

Hi, Spring fans! Welcome to another installment of This Week in Spring! When last we spoke, I was in Las Vegas, NV, for the JavaOne show. It was amazing! Im in sunny Singapore, then off to Malaysia and Thailand. Its the first time Ive been to any of these places since 2019! How good it is to be...

Introducing Spring Modulith

When designing software systems, architects and developers have plenty of architectural options to choose from. Microservice-based systems have become ubiquitous in the last couple of years. However, the idea of monolithic, modular systems has also regained popularity recently. Independent of the...

A Bootiful Podcast: Microsoft's Asir Selvasingh on Azure Spring Apps, Java at Microsoft, application security, and more

Hi, Spring fans! In this installment, Josh Long @starbuxma talks to his friend, Microsofts Asir Selvasingh @asirselvasingh, about Azure Spring Apps, Java at Microsoft, Spring, application security, and more. Want to learn more? Join us at SpringOne 6-8 December 2022! Want to meet amazing people...

CVE-2022-31684: Reactor Netty HTTP Server may log request headers

The Reactor Netty 1.0.24 release on October 11 included fix for CVE-2022-31684 affecting Reactor Netty HTTP Server. Users are encouraged to update as soon as possible. Reactor Netty is used internally in many frameworks including Spring WebFlux and its WebClient. If you have a Spring Boot...

Reactor Netty HTTP Server may log request headers

Reactor Netty HTTP Server, in versions 1.0.11 - 1.0.23, may log request headers in some cases of invalid HTTP requests. The logged headers may reveal valid access tokens to those with access to server logs. This may affect only invalid HTTP requests where logging at WARN level is enabled...

This Week in Spring - October 18th, 2022

Hi, Spring fans! Howre you doin? Im doin alright! Last week I was in Antwerp, Belgium, for the amazing Devoxx BE show. I did a presentation with my friend and hero James Ward on Spring and Kotlin that was voted third most-liked talk at a show with more than 250 speakers! That was a personal caree...

Spring at JavaOne 2022

Hi, Spring fans! Its Sunday the 16th of October as I write this and Im winging my way to sunny Las Vegas, Nevada, where Ill be attending and presenting at the first JavaOne show in years! It didnt exist as the JavaOne we know and love for years, even before the pandemic interrupted life as we kno...

Learn more about Spring Framework 6 and Spring Boot 3 in these two great talks from Devoxx 2022

Hi, Spring fans! I was just at Devoxx in Belgium, where hundreds of experts from across the Java ecosystem converged for the first time since 2019 to deliver their biggest and best. I could do a proper trip report, but I really just came here to point you to two talks from two of my amazing...

A Bootiful Podcast: Google mad scientist Josh Suereth on Observability with OpenTelemetry, building better build tools, and so much more

Hi, Spring fans! In this installment, Josh Long @starbuxman looks at the latest and greatest in Spring Boot 3 AOT, then talks to Googles Josh Suereth @jsuereth about observability with OpenTelemetry, building better build tools, and so much more. Want to learn more about Spring Boot and the wider...

Observability with Spring Boot 3

The Spring Observability Team has been working on adding observability support for Spring Applications for quite some time, and we are pleased to inform you that this feature will be generally available with Spring Framework 6 and Spring Boot 3! What is observability? In our understanding, it is...

Embracing Virtual Threads

Project Loom has made it into the JDK through JEP 425. Its available since Java 19 in September 2022 as a preview feature. Its goal is to dramatically reduce the effort of writing, maintaining, and observing high-throughput concurrent applications. Where Virtual Threads make sense This makes...

This Week in Spring - October 11th, 2022

Hi, Spring fans! Welcome to another installment of This Week in Spring! I write this installment as I pack and prepare for my trip to Antwerp, Belgium, for the always-amazing Devoxx show in Antwerp, Belgium. Ive so missed this show over the pandemic and am so looking forward to returning. I hope ...

Spring Tips: Spring Boot & Apache Kafka

Hi, Spring fans! In this installment of Spring Tips, I look at the venerable Apache Kafka broker and its integrations at various level of abstraction in the Spring Boot ecosystem. Want to learn more about event driven architectures, AOT and GraalVM, Apache Kafka, and Spring Boot? SpringOne 2022 i...

A Bootiful Podcast: Spring and Java community legend Marten Deinum

Hi, Spring fans! In this installment, Josh Long @starbuxman talks to longtime Spring community member and legend Marten Deinum @mdeinum about scuba diving, software, Spring, community, and more. Also: I fixed the odd silence in the middle of the last few episodes! thanks for suffering through it...

This Week in Spring - October 4th, 2022

Hi, Spring fans! Welcome to another installment of This Week in Spring! Its October 4th, 2022, and Im in Austin, TX, for the new version of show formerly known as the Kafka Summit, here to talk to folks about the amazing opportunities for Spring Boot and Apache Kafka. On the 12th, Ill be in...

A Bootiful Podcast: thought leader Chris Richardson (and no, I'm not using that title ironically!)

Hi, Spring fans! In this installment, Josh Long @starbuxman talks to his friend Chris Richardson @crichardson, who helped articulate and advance cloud computing, reactive programming, microservices, domain-driven design, event sourcing, and so much more years before the zeitgeist. Also, we used t...

Delete Passwords: Passwordless Connections for Spring Boot Apps to Azure Services

Using username/password credentials to access one application from another presents a huge security risk for many reasons. Today, we are announcing the preview of passwordless connections for Java applications to Azure database and eventing services, letting you finally shift away from using...

This Week in Spring - September 27th, 2022

Hi, Spring fans! Welcome to another installment of This Week in Spring! Its the last week of September, already! The years more done than not. The days are receding into darkness earlier. And the Pumpkin Spice Lattes are upon us. The darker and colder days are kind of a bummer, but Im stil excite...

Native Support in Spring Boot 3.0.0-M5

The Spring Team has been working on native image support for Spring Applications for quite some time. After 3+ years of incubation in the Spring Native experimental project with Spring Boot 2, native support is moving to General Availability with Spring Framework 6 and Spring Boot 3! Native image...

My SpringOne 2022

It has taken me an embarrassingly long time to appreciate and understand that the devil is in the details regarding software development. Writing happy-path business logic isnt the hard part! Its the failure cases, observability, resilience, and process. Its security and other so-called...

A Bootiful Podcast: Couchbase and Cloud legend Laurent Doguin

Hi, Spring fans! In this installment, Josh Long @starbuxman talks to his friend, fellow Java Champion, and director of developer relations and strategy at Couchbase, Laurent Doguin @ldoguin SpringOne 2022 is almost here! This is our first in-person event since the pandemic and its when we release...

Spring Session 2022.0.0-M3 Released

On behalf of the team, I’m pleased to announce the release of Spring Session 2022.0.0-M3. These releases deliver, enhancements, bug fixes, and dependency upgrades. For your convenience, Spring Boot will pick up these artifacts with its upcoming releases. The following modules were updated as part...

This Week in Spring - September 20th, 2022

Hi, Spring fans! Welcome to another installment of This Week in Spring wherein I endeavor as best as I can to capture the latest-and-greatest in the wide, wacky, and wonderful world of Springdom! Naturally, I fail miserably basically every week. Theres no way I could hope to capture everything of...

Spring Data REST Vulnerability (CVE-2022-31679)

Updates - 09-19 Vulnerability announced here and Spring Data REST 3.6.7 and 3.7.3 released - 09-19 Blog post updated to refer to the CVE report published The Spring Data 2021.1.7 and 2021.2.3 releases shipped on September 19th contained releases for Spring Data REST 3.6.7 and 3.7.3 which include...

Potential Unintended Data Exposure for Resource Exposed by Spring Data REST

Applications that allow HTTP PATCH access to resources exposed by Spring Data REST in versions 3.6.0 - 3.6.5, 3.7.0 - 3.7.2, and older unsupported versions, if an attacker knows about the structure of the underlying domain model, they can craft HTTP requests that expose hidden entity attributes...

A Bootiful Podcast: big data legend, former Pivot, and friend to the Spring community, Tim Spann

Hi, Spring fans! In this installment, Josh Long @starbuxman talks to big data legend, former Pivot, and friend to the Spring community, Tim Spann @PaaSDev, about big data, StreamNative, and Apache Pulsar, and Spring for Apache Pulsar. Get your notebooks ready for this one, class!...