Spring ecosystem ships first milestone releases for ten projects, addresses 90+ CVEs

The Spring ecosystem ended a 10-week release hiatus with a coordinated wave of first milestone releases across ten projects, including Spring Boot, Spring Framework, Spring Data, Spring Security, and Spring Integration. This is a broad update that touches the core framework, data access, security, integration, and messaging. Engineers evaluating these milestones should expect both new features and breaking changes, as the release notes for each project detail deprecations and behavioral shifts. The sheer number of projects updated in a single week suggests a deliberate alignment of the Spring roadmap.

Security is a major theme of this roundup, with over 90 CVEs addressed across many Spring projects. Two vulnerabilities in Spring Integration stand out. CVE-2026-59307 is a Java-deserialization remote code execution in JdbcMessageStore, where the addAllowedPatterns() method replaces the deserializing converter with a permit-all instance, but the row mapper retains its original reference, allowing an attacker to write bytes into INT_MESSAGE.MESSAGE_CONTENT. CVE-2026-59321 involves scripting engines that report THREADING=null, which can corrupt engine-internal state and leak message payloads between script evaluations. These fixes are critical for production systems using Spring Integration.

The new features in these milestones point to the direction of the next Spring generation. Spring Boot 4.2.0's first milestone adds support for the AMQP 1.0 specification with RabbitMQ features and switches to Jetty's GracefulHandler for coordinated graceful shutdown. Spring Framework 7.1.0's first milestone introduces a forParameter() method on ResolvableType and custom parameter names in ParameterResolutionDelegate. Spring Data 2026.1.0's first milestone brings a RedisJsonTemplate for initial Redis JSON support. These additions are useful for engineers building modern applications, but they come with the cost of dependency upgrades and potential API changes.

Adopting these milestone releases requires careful planning. Milestones are not stable; they are intended for testing and feedback, so engineers should not deploy them to production without thorough evaluation. The release notes mention breaking changes and deprecations, such as the deprecation of RestTemplate in Spring Integration's HTTP outbound gateway configurations. Teams should review the release notes for each project, test against their existing codebases, and be prepared for further changes in subsequent milestones. The large number of CVEs also means that upgrading is not just about new features but about closing security holes, making the upgrade a priority for affected teams.