Spring Moves to a Single Monthly "Patch Thursday" Release Day
In a September 21 post, Michael Minella announced a basic change to how the Spring portfolio ships. The old model was a two-week release window with projects releasing on staggered days. Under the new model, every project releases on a single "Patch Thursday": the Thursday after the third Monday of each month. The first patch release day under the new scheme is October 22. The September 24 slot was limited to milestone releases.
The reason is security volume. The Spring team says it has averaged nearly 80 new community security reports a month since March and has patched more than 160 CVEs recently. The post attributes much of that rise to AI-powered vulnerability discovery. A staggered release window made coordinated fixes across dependent projects slow and hard to follow. Releasing everything on one day means a fix that touches Framework, Security, and Boot arrives together.
The team also redesigned spring.io/security. Advisories were published in a blog-style feed and can now be filtered by CVE ID, severity, and project. For teams that run Spring in production, the practical takeaway is to plan dependency upgrades around a predictable monthly date, much like many teams already do for OS patching.
Read more — Spring Blog
Spring Boot 4.2.0-M2 Adds LDAPS SSL Bundles and OpenTelemetry Semantic Conventions
Spring Boot 4.2.0-M2 was released on September 25 with 141 enhancements, documentation improvements, dependency upgrades, and bug fixes. It is the second milestone on the way to the 4.2 GA later this year, and it lines up with a wave of second milestones across Batch, Security, Data, and other portfolio projects.
The headline features concern security and observability. SSL bundles, the Boot abstraction for configuring certificates and trust material in one place, now cover LDAP connections, and the embedded LDAP server supports LDAPS. On the observability side, Boot now supports OpenTelemetry's semantic conventions. It also adds common configuration properties for the OTLP endpoint, headers, and compression, so one set of properties applies to traces, metrics, and logs.
The milestone is on Maven Central. Teams already running Boot 4.1 can use it to try their observability and LDAP configuration against the new properties before GA.
Read more — Spring Blog
Spring Cloud 2026.0.0-M1 "Paddington" Kicks Off the Next Release Train
The first milestone of the Spring Cloud 2026.0.0 release train, codenamed Paddington, shipped on September 24. It is built on Spring Boot 4.2.0-M2, and all 15 core modules move to 5.1.0-M1, including Gateway, Config, OpenFeign, Stream, Kubernetes, Vault, and Circuitbreaker.
The notable changes include:
- Circuitbreaker: upgraded to Resilience4J 2.4.0.
- Config: a new HTTP property-path notifier and Azure DevOps workload identity support.
- Gateway: retry support moved from Reactor Addons to Spring Framework core, and handling of forwarded headers from untrusted proxies was hardened.
- OpenFeign: upgraded to Feign 13.14.
- Vault: upgraded to Spring Vault 4.1.0.
The Gateway forwarded-header change is worth checking if a service sits behind a chain of proxies. Stricter trust rules can change which client IP and scheme downstream services see.
Read more — Spring Blog
Links & Sources
You May Also Enjoy
