Hi Spring fans! Welcome to another installment of This Week in Spring! This week I was in Los Angeles and Chicago and now I'm in San Francisco, taking meetings with Pivotal ecosystem folks and customers. We've got an incredibly busy week's worth of stuff ahead of us, so let's get to it!

• Reactor project lead Stephane Maldini has announced that Reactor Bismuth-SR5 is out with fixes, Reactive Streams 1.0.2, Netty 4.1.20 and a few new cool features there
• Check out this post by Spring Security ninja Joe Grandja on what the future of OAuth 2 support in Spring is
• Spring Security lead Rob Winch has just announced an immediate update for a CVE for Spring Security 5.0.1, 4.2.4, and 4.1.5
• Reactive Spring web ninja Sebastien Deleuze has just announced the integration and support for Reactive Smile (binary JSON) support in Spring Framework 5.0.4
• Vedran Pavić has …

On behalf of the team, it is my great pleasure to announce that Spring Boot 2.0.0.RC1 has been released and is now available from our milestone repository.

This release closes a massive 313 issues and pull requests, and is our first release candidate. At this point we're not anticipating that any major API changes or new features will be added before our final 2.0 GA release.

We've refined a number of items from previous milestone, and provide a number of notable new features including:

• A module to help with legacy property migration
• HTTP/2 support for Jetty (to go along with the Tomcat and Undertow that was added in M7)
• Greatly enhanced GSON support (thanks to an external contribution)
• Improved actuator JSON structures
• Helpful security matchers for both Servlet and Reactive deployements
…

I am pleased to announce that Spring IO Platform Brussels-SR7 is now available from both repo.spring.io and Maven Central.

This maintenance release upgrades the versions of a number of the projects in the Platform:

• Spring AMQP 1.7.6
• Spring Boot 1.5.10
• Spring Data Ingalls-SR10
• Spring Framework 4.3.14
• Spring Integration 4.3.14
• Spring Retry 1.2.2
• Spring Security 4.2.4
• Spring Web Flow 2.4.7

The versions of a number of third-party dependencies have also been updated.

Project Page | GitHub | Issues | Documentation

We have released Spring Security 5.0.1, 4.2.4, and 4.1.5 to address CVE-2018-1199: Security bypass with static resources Users are encouraged to update immediately.

One of the changes introduced for this CVE was setting StrictHttpFirewall as the default HttpFirewall. User’s can refer to the Javadoc and reference for additional information on how to configure it.

Project Site | Reference | Help

Note

See the latest announcements on Announcing the Spring Authorization Server and Spring Security OAuth 2.0 Roadmap Update

Current State

The current state of OAuth 2.0 Support, within the Spring projects portfolio, is spread out between Spring Security OAuth, Spring Cloud Security, Spring Boot 1.5.x, and the new support introduced in Spring Security 5. As a user of OAuth, you may be asking, "Which project(s) do I use? And why has Spring Security 5 introduced new support into the mix?"

To put it simply, there was a need to unify the OAuth 2.0 support into one project in order to provide a…

Improvements, new features, and fixes have landed in a Maven Central mirror near you under Bismuth-SR5 Bill Of Material. This version is now used by Spring Framework 5.0.3 and the upcoming Spring Boot 2.0.RC1! Our site projectreactor.io has been updated with the latest versions.

Reactor-Core 3.1.3

release notes

A quality update including more than a dozen fixes and just a couple new features: new Flux#delaySequence and Signal#getContext access to the current flow Context.

reactor-test also welcomed new features including Context verification facilities and a StepVerifier#toString…

We are pleased to announce the availability of the following maintenance releases; users are encouraged to upgrade at the earliest opportunity.

• Spring Integration - 5.0.1, 4.3.14 and 4.2.13

• Spring Integration for Apache Kafka 3.0.1

• Spring for Apache Kafka - 2.1.2, 2.0.3 and 1.3.3

• Spring AMQP - 2.0.2 and 1.7.6

Spring Integration 4.3.13, Spring AMQP 1.7.6 will be used in the upcoming Spring Boot 1.5.10 release. Spring Integration 5.0.1, Spring AMQP 2.0.2 and Spring for Apache Kafka 2.1.2 will be used in the upcoming release candidate for Spring Boot 2.0.

See the respective project pages at spring.io/projects…

This post was authored by Vedran Pavić

On behalf of the community I’m pleased to announce the release of Spring Session 2.0.1.RELEASE. This maintenance release is focused primarily on addressing a classloading related regression when using a Redis backed session store in combination with Spring Boot’s DevTools.

You can find the complete details of the release in the changelog.

Feedback Please

If you have feedback on this release, I encourage you to reach out via StackOverflow, GitHub Issues, or via the comments section. You can also ping Rob @rob_winch, Joe @joe_grandja, or me @vedran_pavic on…

On behalf of the Spring Data team, I’d like to announce the Ingalls SR10 and Kay SR3 service releases. The Ingalls service release ships on top of the just-released Spring Framework 4.3.14 and in preparation of the upcoming Spring Boot 1.5.10 release. The Kay service release picks up Spring Framework 5.0.3 in and will be picked up by Spring Boot 2.0 RC1 for your convenience.

Both releases ship with 105 tickets fixed in total and are recommended upgrades to all users of the Ingalls and Kay release trains. You can find all details within the linked changelogs.

Spring Data Ingalls SR10

• Spring Data Commons 1.13.10 - Artifacts - JavaDocs - Documentation - Changelog
• Spring Data JPA 1.11.10 - Artifacts - JavaDocs - Documentation - Changelog
• Spring Data MongoDB 1.10.10 - Artifacts - JavaDocs - Documentation - Changelog
• Spring Data for Apache Cassandra 1.5.10 - Artifacts - JavaDocs - Documentation - Changelog
• Spring Data KeyValue 1.2.10 - Artifacts - JavaDocs - Documentation - Changelog
• Spring Data Gemfire 1.9.10 - Artifacts - JavaDocs - Documentation - Changelog
• Spring Data Neo4j 4.2.10 - Artifacts - JavaDocs - Documentation - Changelog
• Spring Data for Apache Solr 2.1.10 - Artifacts - JavaDocs - Documentation - …