Hi, Spring fans! Welcome to another installment of This Week in Spring! It's been quite the week since we last talked! I flew to Atlanta, GA, for my first in-person show since the pandemic - Devnexus 2022. I loved the experience! Hopefully, the only souvenirs I'll have are the amazing memories and not COVID. I loved to see so many smiling faces. Thanks so much for having me, Devnexus, and for running an amazing show. It was a privilege to return.

And now, without further ado, let's dive right into the roundup.

• A Bootiful Podcast: Cloud guru Tiffany Jernigan
• Jacky Chan on Twitter: "My new open source tool httpx, CLI and IDE plugins to test REST API, GraphQL, gRPC, RSocket, Kafka etc services with HTTP DSL https://t.co/jkvJG2syff JetBrains/Neovim plugins are all ready. Support by @java and @graalvm" / Twitter
• Ngrok Spring Boot Starter - Tunneling The Easy Way
• Spring Boot with Drools Engine. In this blog we would see how Spring integrates with Drools Engine. | CodeX
• Spring Data 2021.2.0-RC1, 2021.1.4, and 2021.0.11 released
• Spring Framework 5.3.19 and 5.2.21 available now
• …

On behalf of the community, I’m pleased to announce the release of Spring Security 5.7.0-RC1!

In addition to dependency upgrades, bug fixes, and minor enhancements, the release candidate contains a few noteworthy changes:

• Introduced SecurityContextHolderFilter - Ability to require explicit saving of the SecurityContext

• Added DSL support for Cross Origin Policies headers

• Allow configuring PKCE for confidential clients

• Added SAML 2.0 Login & Single Logout XML support

This release candidate is a good opportunity to give feedback before the actual GA release in mid-May. We look forward…

On behalf of the team and everyone who has contributed, I am pleased to announce that Spring Security 5.6.3 and 5.5.6 are available now.

You can find more details about the respective releases here and here.

Hi, Spring fans! In this installment, Josh Long (@starbuxman) talk about his first in-person conference since the pandemic descended upon us -the fabulous Devnexus 2022 show - and talks to colleague, teacher, friend, and Kubernetes legend Tiffany Jernigan (@tiffanyfayj).

On behalf of the team and everyone who has contributed, I am pleased to announce that Spring Framework 5.3.19 and 5.2.21 are available now.

Spring Framework 5.3.19 includes 12 fixes and improvements. Spring Framework 5.2.21 includes 5 selected fixes and improvements.

In addition, Spring Framework 5.3.19 and 5.2.21 include a fix for CVE-2022-22968: Spring Framework Data Binding Rules Vulnerability and are recommended upgrades for all Spring production scenarios.

Project Page | GitHub | Issues | Documentation

Table of Contents

• Overview
• Does This Affect My Application?
• Reassessing Your Data Binding Approach

Overview

While investigating the Spring Framework RCE vulnerability CVE-2022-22965 and the suggested workaround, we realized that the disallowedFields configuration setting on WebDataBinder is not intuitive and is not clearly documented. We have fixed that but also decided to be on the safe side and announce a follow-up CVE, in order to ensure application developers are alerted and have a chance to review their configuration.

• CVE-2022-22968: Spring Framework Data Binding Rules Vulnerability

We have released Spring Framework 5.3.19 and 5.2.21 which contain the fix. Spring Boot 2.6.7 and 2.…

This Week in Spring - Devnexus Edition

Hi, Spring fans! Welcome to another installment of This Week in Spring - I'm at my first in-person event since the virus: Devnexus! WOOHOOO!! Well, technically I'm still in San Francisco as I write this, but I'll be in Atlanta, GA tomorrow for... Devnexus! I hope if you're there that you'll reach out!

Friends, colleagues, and community members from the Spring, Tanzu, and adjoining communities will also be there! Here are some of the people I hope to nab a selfie with and whose talks I hope to see!

• Glenn Renfro
• Adib Saikali
• Joe Grandja
• Whitney Lee
• Hillmer Chona
• Jonatan Ivanov
• Josh Cummings
• Alberto C. Rios
• Simon Brown
…

Hi, Spring fans! In this installment of a Bootiful Podcast, Josh Long (@starbuxman) talks to the GraphQL Java project founder and lead, Atlassian engineer, and Spring GraphQL cofounder Andi Marek (@andimarek).

On behalf of the community, I am pleased to announce that the Milestone 2 (M2) of the Spring Cloud 2022.0.0 Release Train is available today. The release can be found in Spring Milestone repository. You can check out the 2022.0 release notes for more information.

Notable Changes in the 2022.0.0-M2 Release Train

See the project page for all the issues and pull requests included in this release.

Spring Cloud 2022.0.0-M2 is compatible with Spring Boot 3.0.0-M2.

Spring Cloud Stream

• Both Kafka and RabbitMQ binders for Spring Cloud Stream have been migrated as part of the core Spring Cloud Stream repository. With this change, Spring Cloud Stream now follows a mono-repo approach where all the framework-related codebase for Spring Cloud Stream is now part of a single repository. See more details here for the Kafka binder and here for the RabbitMQ binder. We recommend filing new feature requests and bug reports for Kafka and RabbitMQ binders in the core repository.
• Introduced initial support for a new reactive Kafka binder based on Reactor Kafka. This support contains consumer and producer bindings using Reactor Kafka behind the scenes. See this issue…