Spring News Roundup: First Milestone Releases for Boot, Framework, Data, Security, Modulith, Batch

After a 10-week hiatus since the last batch of Spring ecosystem releases, there was a flurry of activity during the week of August 17th, 2026, highlighting first milestone releases of: Spring Boot, Spring Framework, Spring Data, Spring Security, Spring Integration, Spring HATEOAS, Spring Modulith, Spring Batch, Spring AMQP and Spring for Apache Kafka.

In addition, over 90 CVEs were addressed across many of the Spring projects, some of which we examine here. More details may be found in the Spring Security Advisories page.

Spring Boot

The first milestone release of Spring Boot 4.2.0 delivers bug fixes, documentation improvements, dependency upgrades and new features such as: support for the AMQP 1.0 specification with features from RabbitMQ; and use of the Eclipse Jetty GracefulHandler class, rather than the StatisticsHandler class, to coordinate graceful shutdown of Jetty. More details on this release may be found in the release notes and this wiki page.

Spring Framework

The first milestone release of Spring Framework 7.1.0 ships with bug fixes, dependency upgrades and new features such as: a new forParameter() method, added to the ResolvableType class, as a convenient factory method that returns a ResolvableType for a specified instance of the Java Parameter class; and support for custom parameter names in the ParameterResolutionDelegate class. Further details on this release, including breaking changes and deprecations, may be found in the release notes.

Spring Data

The first milestone release of Spring Data 2026.1.0 provides bug fixes, documentation improvements, dependency upgrades and one new feature that introduces a new RedisJsonTemplate class that provides initial support for Redis JSON. There were also upgrades to sub-projects such as: Spring Data Commons 4.2.0-M1; Spring Data MongoDB 5.2.0-M1; Spring Data Elasticsearch 6.2.0-M1; and Spring Data Neo4j 8.2.0-M1.

Spring Security

The first milestone release of Spring Security 7.2.0 delivers bug fixes, dependency upgrades and new features such as: the addition of implicit detection of the Spring Framework CorsConfigurationSource and PreFlightRequestHandler interfaces to the <cors> XML namespace for consistency with similar detection with the CorsConfigurer class; and the addition of a missing a preauthentication check before authorizing an account in the OneTimeTokenAuthenticationProvider class. More details on this release may be found in the release notes.

Spring Integration

The first milestone release of Spring Integration 7.2.0 ships with bug fixes, dependency upgrades and new features such as: an update to the putIfAbsent() method, defined in the JdbcMetadataStore class, so that it returns null for an existing row containing a null in the METADATA_VALUE column; and resolutions to the HTTP outbound gateway configurations used in the now-depracted Spring Framework RestTemplate class.

CVEs addressed in this release include:

• CVE-2026-59307, a vulnerability that allows an attacker to write bytes into INT_MESSAGE.MESSAGE_CONTENT due to the addAllowedPatterns() method, defined in the JdbcMessageStore class, replace the store's deserializing converter with a new permit-all instance, but the row mapper retains its original reference and continues to use it. This results in a Java-deserialization remote code execution despite the caller believing an allow-list is enforced.
• CVE-2026-59321, a vulnerability by which processing of concurrent messages using scripting engines, defined in JSR-223, Scripting for the Java Platform, that report THREADING=null, can corrupt engine-internal state. This may potentially lead to leaking the message's payload and header bindings into another message's script evaluation or throwing spurious exceptions.

Further details on this release may be found in the release notes and this what's new page.

Spring HATEOAS

The first milestone release of Spring HATEOAS 3.2.0 provides dependency upgrades and maintains compatibility with Kotlin 2.2 and Jackson 3.2. More details on this release may be found in the release notes.

Spring Modulith

The first milestone release of Spring Modulith 2.2.0 delivers bug fixes, dependency upgrades and two improvements: use of the Namastack version property in the spring-modulith-events-core module; and a modernization of auto-configuration registration that removes setting the heritage spring.factories property from the moments, events and observability modules. Further details on this release may be found in the release notes.

Spring Batch

The first milestone release of Spring Batch 6.1.0 ships with bug fixes and dependency upgrades to: Spring Framework: 7.1.0-M1, Spring Integration: 7.2.0-M1, Spring AMQP: 4.2.0-M1, Spring for Apache Kafka: 4.2.0-M1, Spring Data: 2026.1.0-M1 and Micrometer: 1.18.0-M1. More details on this release may be found in the release notes.

Spring AMQP

The first milestone release of Spring AMQP 4.2.0 provides bug fixes, documentation improvements, dependency upgrades and new features such as: a new RoutingAmqpConnectionFactory interface and AbstractRoutingAmqpConnectionFactory class that routes calls to the getConnection() method to one of several target AmqpConnectionFactory interfaces; and a new RestClientNodeLocator class that replaces the now-deprecated RestTemplateNodeLocator class.

CVEs addressed in this release include:

• CVE-2026-47860, a vulnerability where an attacker can publish a 1MB message to a queue consumed by an application that has message decompression enabled. This may crash the consumer JVM and, as a result, the application terminates, requiring an operator to manually purge the message.
• CVE-2026-59271, an exposure that configured admin password is embedded as clear text in the thrown exception message upon failure of the RabbitMQ management aliveness check such that anyone with log-read access can harvest it.

Further details on this release may be found in the release notes and this what's new page.

Spring for Apache Kafka

The first milestone release of Spring for Apache Kafka 4.2.0 delivers bug fixes, documentation improvements, dependency upgrades and one new feature that now provides consistency with batch vs. non-batch observability using the @KafkaListener annotation. More details on this release may be found in the release notes.