We have released Spring Security 4.2.13 to address CVE-2019-11272: PlaintextPasswordEncoder authenticates encoded passwords that are null.

Users are encouraged to update immediately.

With Spring Boot, you can override the Spring Security version in Maven like so:

<properties>
    <spring-security.version>4.2.13.RELEASE</spring-security.version>
</properties>

Or in Gradle like so:

ext['spring-security.version'] = '4.2.13.RELEASE'

Note that users of Spring Security 5+ are not affected by this vulnerability.

Microservice architectures are great, but as your application programming interfaces (APIs) start to grow, so do the challenges related to their maintenance.

For example, as an existing API matures and adds new features it will need to take its clients along with it on the journey. When the details of an API change, clients need to adjust in order to work with these changes. This process takes time and can really slow your APIs evolution and interfere with your ability to iterate quickly.

Offering multiple APIs brings with it its own set of challenges. How do you route requests and responses…

On behalf of the Spring and Apache Geode communities, it is my pleasure to announce the release of Spring Boot for Apache Geode & Pivotal GemFire (SBDG) 1.0.1.RELEASE and 1.1.0.M2.

New in SBDG 1.0.1.RELEASE

SBDG 1.0.1.RELEASE builds on:

• Spring Framework 5.0.14.RELEASE

• Spring Boot 2.0.9.RELEASE

• Spring Data Kay-SR14

• Spring Session for Apache Geode & Pivotal GemFire 2.0.9.RELEASE

Additionally, SBDG now supports the ability configure and bootstrap a Locator process, which disables the auto-configuration supplying a ClientCache instance, by default.

See the complete changelog for further…

We are pleased to announce the 3.0.2 release of Spring Cloud Open Service Broker. This is a maintenance release that includes the following updates:

• Return correct HTTP status when the X-Broker-API-Version header doesn't exist
• Return correct HTTP status when missing certain required fields and query parameters
• Fix support for service instance binding getLastOperation
• Return correct HTTP status when attempting to retrieve non-existant service instance or service instance binding

Include the following Spring Boot starter:

<dependency>
  <groupId>org.springframework.cloud</groupId…

This post was authored by Vedran Pavić

On behalf of the community I’m pleased to announce the releases of Spring Session Corn-M2 and Bean-SR6. These releases will be picked up by Spring Boot 2.2.0.M4 and 2.1.6.RELEASE, respectively.

Spring Session Corn-M2

The Corn-M2 release is based on:

• Spring Session core modules 2.2.0.M2

• Spring Session Data Geode 2.2.0.M2

• Spring Session Data MongoDB 2.2.0.M3

Some of the highlights of Spring Session 2.2.0.M2 are:

• simple Redis-based implementation of SessionRepository

• reworked @Configuration classes are now compatible with proxyBeanMethods=false

• migration of project’s tests to JUnit 5

• simplified project structure

…

Hi Spring fans! Welcome to another installment of This Week in Spring! This week I'm in delightful Des Moines, Iowa; and then it's off to the twin cities of DescriptionMinneapolis–Saint Paul for the epic SpringOne Tour event there.

We've got tons to look at this week so let's get to it!

• Spring Session Corn-M2 and Spring Session Bean-SR6 Released
• Spring Cloud Open Service Broker 3.0.2 Released
• Getting Started with Spring Cloud Gateway
• Spring Boot for Apache Geode & Pivotal GemFire 1.0.1.RELEASE & 1.1.0.M2 Available
• Spring Session for Apache Geode & Pivotal GemFire 2.1.4.RELEASE & 2.2.0.M2 Available
• Spring Security 5.2.0.M3 Released
• Spring Data Moore RC1 and Lovelace SR9 released
• Spring Cloud Finchley SR4 Released
• in last week's A Bootiful Podcast I talked to Pivotal SVP Ian Andrews on Spring, new product announcements, Kubernetes, our customers, and more
• …

On behalf of the community, I’m pleased to announce the release of Spring Security 5.2.0.M3! You can find the complete details in the changelog and the highlights below:

OAuth 2.0

gh-6727 - Support for Multi-tenancy in Reactive Resource Server

gh-6798 - Support for custom parameters in Opaque Token

gh-6239 - Finer variables for OAuth2 redirectUriTemplate expansion

gh-6863 - OAuth2 login has configurable authentication success handler

gh-6832 & gh-6849 - JWT and opaque token have configurable authentication manager

gh-6634 - Support for mock JWT in tests

Similar to other request post processors, jwt() can be used to establish a SecurityContext with a JwtAuthenticationToken…

On behalf of the team I am pleased to announce Spring Data releases Moore RC1 and Lovelace SR9. The new bits build on the most recent Spring Framework releases and will be picked up by Spring Boot 2.2 M4 and 2.1.6 respectively.

Notable new features amongst others are:

• An EntityCallback API for modifying entities before convert or save.
• Multiple OUT parameters in the stored procedure support of Spring Data JPA.
• Declarative aggregations in Spring Data MongoDB.
• Enhanced SSL support and dynamic client port configuration for Gemfire and Apache Geode.

Please find a high-level overview of what has been added in our release wiki. As always, we’re…

On behalf of the Spring and Apache Geode communities, it is my pleasure to announce the release of Spring Session for Apache Geode and Pivotal GemFire (SSDG) 2.1.4.RELEASE and 2.2.0.M2 releases.

Both SSDG 2.1.4.RELEASE and 2.2.0.M2 now support the ability to turn off client subscriptions. No longer does SSDG require client subscriptions to be enabled to use either Apache Geode or Pivotal GemFire to manage your HTTP Session state. However, if client subscriptions are not explicitly enabled, then the client will no longer receive notifications of Session events that may have originated from…