JavaGolangJavaScriptSwiftAndroidRustMiddleware
1 hours ago
logback
qos-ch

Logback 1.6.4

2026-09-24 Release of logback version 1.6.4

• Variable substitution is again applied to the scan attribute of the <configuration> element. The scanning refactoring in version 1.5.27 had dropped substitution, so values such as ${logback.scan.enabled:-true} were no longer resolved. As before version 1.5.27, an unrecognized non-empty value turns scanning on. The same substitution now applies to the scan attribute of <propertiesConfigurator>. This regression was reported in issues/1065 by vaibhavjain2.

• OutputStreamAppender and FileAppender now handle stateful encoders. The Encoder interface has a new default method called isStateful(), which returns false. An encoder that keeps state between calls to encode() can return true. For such encoders, the appender holds its write lock while encoding and while writing, so the output of concurrent appends cannot interleave. Stateless encoders still encode outside the lock, so their performance does not change. Existing encoders need no changes.

• Several race conditions in OutputStreamAppender and FileAppender were fixed. The appender is now marked started and the encoder header is written while the same lock is held, so a concurrent append can no longer write an event before the header. After acquiring the lock, the appender checks again whether it has been stopped, so no event is written after the footer. In prudent mode, FileAppender now encodes and writes each event while holding the lock.

• Fixed a data race on the logger count in LoggerContext. Loggers are created under the lock of their parent logger, so loggers with different parents could be created at the same time and increments of the shared counter could be lost. As a result, LoggerContext.size() could return a value lower than the actual number of loggers. The counter is now an AtomicInteger. This issue was reported in issues/1038 by hcantunc. The fix was contributed in PR #1055 by seonwoo_jung.

• TimeBasedRollingPolicy now supports half-day periods. Date patterns with the AM/PM marker, for example %d{yyyy-MM-dd-a}, used to be detected as daily and rolled over only at midnight. They now roll over at both 00:00 and 12:00. This issue was reported in issues/976 by shakthifuture. The fix was contributed in PR #1051 by seonwoo_jung. See TimeBasedRollingPolicy.

• If org.jline.jansi.AnsiConsole cannot be found on the class path, JansiConsoleAppender now emits warnings that explain how to add org.jline:jansi-core and then writes to the plain console stream. See codes.html#missingJlineJansi.

• The unused ch.qos.logback.classic.util.LogbackMDCAdapterSimple class was removed. LogbackMDCAdapter remains the default MDC adapter.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit 07d291ca0d280bc5da934ec9ff5f1da634fd7937 associated with the tag v_1.6.4. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

Full Changelog: https://github.com/qos-ch/logback/compare/v_1.6.3...v_1.6.4

2 hours ago
Activiti
Activiti

7.21.0-rc.625

Full Changelog: https://github.com/Activiti/Activiti/compare/7.21.0-rc.624...7.21.0-rc.625

5 hours ago
Activiti
Activiti

7.21.0-rc.624

Full Changelog: https://github.com/Activiti/Activiti/compare/7.21.0-rc.623...7.21.0-rc.624

6 hours ago
lettuce
redis

7.8.0.RELEASE

The Lettuce team is pleased to announce the Lettuce 7.8.0 minor release!

Lettuce 7.8.0 supports Redis 2.6+ up to Redis 8.x. In terms of Java runtime, Lettuce requires at least Java 8 and works with Java 24. The driver is tested against Redis 8.10, Redis 8.8, Redis 8.6, Redis 8.4, Redis 8.2, Redis 8.0, Redis 7.4 and Redis 7.2.

Thanks to all contributors who made Lettuce 7.8.0.RELEASE possible.

📗 Links Reference documentation: https://lettuce.io/core/7.8.0.RELEASE

⭐ New Features

🐞 Bug Fixes

⚙️ Maintenance

💡 Other

❤️ New Contributors - Welcome to the Lettuce family!

Full Changelog: https://github.com/redis/lettuce/compare/7.7.0.RELEASE...7.8.0.RELEASE

6 hours ago
lettuce-core
lettuce-io

7.8.0.RELEASE

The Lettuce team is pleased to announce the Lettuce 7.8.0 minor release!

Lettuce 7.8.0 supports Redis 2.6+ up to Redis 8.x. In terms of Java runtime, Lettuce requires at least Java 8 and works with Java 24. The driver is tested against Redis 8.10, Redis 8.8, Redis 8.6, Redis 8.4, Redis 8.2, Redis 8.0, Redis 7.4 and Redis 7.2.

Thanks to all contributors who made Lettuce 7.8.0.RELEASE possible.

📗 Links Reference documentation: https://lettuce.io/core/7.8.0.RELEASE

⭐ New Features

🐞 Bug Fixes

⚙️ Maintenance

💡 Other

❤️ New Contributors - Welcome to the Lettuce family!

Full Changelog: https://github.com/redis/lettuce/compare/7.7.0.RELEASE...7.8.0.RELEASE

9 hours ago
Activiti
Activiti

7.21.0-rc.623

Full Changelog: https://github.com/Activiti/Activiti/compare/7.21.0-rc.622...7.21.0-rc.623

9 hours ago
Activiti
Activiti

7.21.0-rc.622

Full Changelog: https://github.com/Activiti/Activiti/compare/7.21.0-rc.621...7.21.0-rc.622

10 hours ago
spring-security
spring-projects

7.2.0-M2

⭐ New Features

  • @EnableMethodSecurity should pick up PermissionEvaluator bean
  • Allow configurable DPoP Proof verifier
  • Expose OAuth2AuthorizationCodeRequestValidatingFilter
  • Ignore Apple touch icon requests (apple-touch-icon*.png) in the default RequestCache
  • Ignore browserconfig.xml requests in the default RequestCache
  • Ignore Chrome DevTools' .well-known/appspecific/com.chrome.devtools.json probe in the default RequestCache
  • Ignore web app manifest requests (manifest.json / manifest.webmanifest) in the default RequestCache
  • KerberosRestClient should rethrow original RestClientException
  • Make authenticationSuccessHandler Configurable in Resource Server DSL
  • Modernize the default RequestCache background-request ignore list
  • Modernize the default RequestCache background-request ignore list
  • Simplify ProviderManager null provider check
  • Test cache full rejection and replay detection
  • Update cryptography.adoc to use include-code

🪲 Bug Fixes

  • Downgrade to Jackson 3.1
  • Header Writers should not corrupt Jetty HttpFields state in reactive ResponseBodyEmitter handlers
  • NoClassDefFound with version 7.1.0
  • TokenType reference comparison is used in BearerTokenAuthentication

🔨 Dependency Upgrades

  • Bump actions/setup-java from 6.0.0 to 6.0.1
  • Bump antora from 3.2.0-rc.2 to 3.2.0
  • Bump antora from 3.2.0-rc.3 to 3.2.0 in /docs
  • Bump gradle-wrapper from 9.7.0 to 9.7.1
  • Bump io-spring-javaformat from 0.0.47 to 0.0.48
  • Bump io.spring.develocity.conventions from 0.0.25 to 0.0.26
  • Bump io.spring.gradle:spring-security-release-plugin from 1.0.18 to 1.0.19
  • Bump org-bouncycastle from 1.85 to 1.86
  • Bump org-jetbrains-kotlin from 2.4.10 to 2.4.20
  • Bump org.hibernate.orm:hibernate-core from 7.4.5.Final to 7.4.7.Final
  • Bump org.hibernate.orm:hibernate-core from 7.4.7.Final to 7.4.8.Final
  • Bump org.hibernate.orm:hibernate-core from 7.4.8.Final to 7.4.9.Final
  • Bump org.hibernate.orm:hibernate-core from 7.4.9.Final to 7.4.10.Final
  • Bump org.seleniumhq.selenium:htmlunit3-driver from 4.43.0 to 4.47.0
  • Bump org.seleniumhq.selenium:selenium-java from 4.43.0 to 4.47.0
  • Bump org.seleniumhq.selenium:selenium-java from 4.43.0 to 4.48.0
  • Bump org.seleniumhq.selenium:selenium-java from 4.48.0 to 4.49.0
  • Bump spring-io/spring-release-actions/compute-version from 0.0.6 to 0.0.7
  • Bump spring-io/spring-release-actions/get-todays-release-version from 0.0.6 to 0.0.7
  • Bump tools.jackson:jackson-bom from 3.1.6 to 3.2.2
  • Update to HtmlUnit 5
  • Update to Micrometer 1.18.0-M2
  • Update to Node 24
  • Update to Reactor 2026.0.0-M2
  • Update to Spring Data 2026.1.0-M2
  • Update to Spring Framework 7.1.0-M2
  • Update to Spring LDAP 4.2.0-M1
  • Update to spring-security-release-tools v1.0.18

🔩 Build Updates

  • Bump io-micrometer from 1.18.0-M1 to 1.18.0-SNAPSHOT
  • Configure for Reproducible Builds
  • Turn Off Auto-merge for Maintenance Branch

❤️ Contributors

Thank you to all the contributors who worked on this release:

@Siggen, @anthonydahanne, @avsan, @iain-henderson, @morokosi, @rwinch, and @sunghyun1999

10 hours ago
spring-framework
spring-projects

v7.1.0-M2

⭐ New Features

  • Align DispatcherServlet bean detection logs #37296
  • Extract bean property path support into PropertyPath #37275
  • Expose matched PathPattern as MVC request attribute #37272
  • Add a configurable limit for maximum nesting depth in property paths #37252
  • Enforce "data: " (with space) prefix for outgoing SSE data payloads #37242
  • Parse RFC 9651-like date headers #37224
  • Polish ScheduledAnnotationBeanPostProcessor to refine null-safety #37219
  • Add batch update support to JdbcClient #37216
  • Emit multipart parts with empty bodies in PartGenerator #37202
  • Upgrade to HtmlUnit 5 #37194
  • Ignore invalid SSE retry field #37193
  • Handle MIME type parameter names case-insensitively #37192
  • Deprecate SpelParserConfiguration constructors in favor of the builder API #37190
  • When connection to client is lost while writing JSON, it should not be logged as warning #37151
  • JMS SimpleMessageConverter.fromMessage() can return null despite @NullMarked package #37148
  • Avoid unnecessary allocations for cached annotation mappings #37141
  • Update MockCookie#parse(String) validation #37136
  • Add WebFlux OpenTelemetry observation convention #37131
  • Limit bracket depth in PropertyEditorRegistrySupport's addStrippedPropertyPaths() #37020
  • Improve efficiency of map creation in DataBinder #37019
  • Reject overlapping declared and generated key columns in SimpleJdbcInsert #37014
  • Reject MIME type parameters differing only in case #37008
  • Use depth-aware bracket parsing in PropertyAccessorUtils #36999
  • Account for all array objects when checking array size in SpEL #36998
  • Align SpEL's default max auto-grow size with Spring data binding #36995
  • Avoid redundant registration of Date/Calendar/Long converters in DefaultFormattingConversionService #36951
  • Suppress CGLIB validation WARN for lifecycle callbacks #36935
  • Add Cache-Control must-understand directive #36918
  • validate samesite attribute in ResponseCookie #36905
  • Close contexts when clearing test context cache #36825
  • Use immutable map for static cache in TypeDescriptor #36813
  • Add a configurable limit for structural nesting depth in SpEL expressions #36723
  • Simplify programmatic scheduling of cron tasks with time zone #36556
  • Deprecate Derby support #36045
  • Add support for generating resources linked to a feature #35862
  • Add RFC 10008 (QUERY HTTP method) support #34993

🐞 Bug Fixes

  • PartGenerator.switchToFile() doesn't count buffered bytes toward maxDiskUsagePerPart #37238
  • Reject write methods not starting with "set" in Property #37139
  • Meta-annotations with attributes are still unnecessarily synthesized in MergedAnnotations #37135
  • Use the 4-argument Property constructor in SpEL's ReflectivePropertyAccessor #37123
  • Fix BeanFactory.getBean(String, ParameterizedTypeReference) to respect AOP proxy #37047
  • Fix OptionalToObjectConverter applicability check #36913
  • Fix Property name resolution for record-style accessors #36911

📔 Documentation

  • Fix RestClient API usage in documentation #37137
  • Add Validation section examples #36190

🔨 Dependency Upgrades

  • Upgrade to Kotlin 2.4.20 #37271
  • Upgrade to Micrometer 1.18.0-M2 and Tracing 1.8.0-M2 #37288
  • Upgrade to Reactor 2026.0.0-M2 #37263

❤️ Contributors

Thank you to all the contributors who worked on this release:

@DevJunz, @Eymenonar, @Sineaggi, @Will-thom, @blackdurumi, @cookie-meringue, @desiderantes, @dxbjavid, @froggy0m0, @gregjotau, @heka1024, @junhyeong9812, @junhyung8795, @kilink, @lArtiquel, @marschall, @mateo-maza, @ngocnhan-tran1996, @noojung, @quaff, @sabberworm, @seonwooj0810, @shaggyinsomniac, @verhasi, and @vpavic

10 hours ago
spring-boot
spring-projects

v4.2.0-M2

⭐ New Features

  • Deprecate AppOptics as it has retired #51810
  • Improve classpath entry lookup performance during jar creation and extraction #51787
  • Add spring.kafka.listener.await-async-results-on-stop property #51774
  • Rationalize Kafka configuration outside of KafkaProperties #51769
  • Make the active Observation LongTaskTimer on the auto-configured DefaultMeterObservationHandler opt-in #51762
  • Configure allowed HTTP methods in GraphQL transports #51732
  • Allow to use Mongo JobRepository with any PlatformTransactionManager #51725
  • Resolve property placeholders in constructor binding default values #51661
  • Add auto-configured BaggageTaggingSpanProcessor for OpenTelemetry tag fields #51656
  • Improve the performance of layer index creation #51654
  • Speed up layer lookups when extracting a layered jar #51653
  • Move Tomcat's servlet-specific properties beneath server.tomcat.servlet #51603
  • Align handling of null and empty values in SPRING_APPLICATION_JSON with YAML processing #51583
  • Remove Dependency Management for Janino #51567
  • Add jarmode tools command to print / export the SBOM #51505
  • Pick up all @TypeExcludeFilters annotations on test classes #51489
  • Make it easier to map MessageSourceProperties onto a user-provided AbstractResourceBasedMessageSource #51484
  • Support multi-segment additional health endpoint paths #51470
  • Honor spring.ldap.* properties in the Embedded LDAP server #51465
  • Add a configuration property for configuring embedded LDAP operation types that require authentication #51461
  • Add TWENTY_SEVEN to JavaVersion enum #51427
  • Automatically filter additional configuration metadata from Spring Boot-built archives #51386
  • Add SSL bundle support to LDAP auto-configuration #51382
  • Align the default for server.tomcat.use-relative-redirects with Tomcat's default #51173
  • Allow configuring Micrometer Tracing MDC keys #50595
  • Add common OTLP configuration for endpoint, compression and headers #50461
  • Retain probe defaults when configuring other properties on probe health groups #50296
  • Include security error body in WebFlux Cloud Foundry endpoint responses #50256
  • Provide a configuration property to switch from Micrometer to OpenTelemetry semantic conventions #49241
  • Support listener and template specific Kafka Admin properties #38830

🐞 Bug Fixes

  • spring.http.clients.cookie-handling has no effect when using a reactive client backed by an HttpComponents connector #51767
  • NullPointerException can be thrown when using uber jars due to a race condition in NestedJarFileResources #51746
  • Connection fails when rabbitmq Docker Compose service is configured to use SSL #51668
  • SBOM-related manifest attributes are missing from Maven-packaged wars #51652
  • When server.reactive.session.cookie.same-site is not set, session cookies have no SameSite attribute #51640
  • OAuth2 resource server ignores authorities-claim-delimiter when set on its own #51631
  • developmentOnly and testAndDevelopmentOnly configurations do not specify any attributes causing potential resolution problems #51624
  • In a reactive web application, Cloud Foundry security integration returns a 500 rather than a 503 when the cloud controller URL is unavailable #51615
  • ReactiveOAuth2ResourceServerWebSecurityAutoConfiguration annotated with wrong condition #51588
  • WritableJson.toByteArray() may corrupt supplementary characters #51586
  • Layer temp file is not deleted when layer creation fails #51582
  • Docker Compose integration for RabbitMQ skips credential fallbacks when an environment variable has no value #51579
  • Some assertion messages name the wrong parameter #51575
  • OAuth2ResourceServerProperties.Jwt has a setter that does not match its getter #51566
  • jarmode tools commands print stacktrace instead of an error message #51548
  • Docker Compose ProcessRunner can hang or leave orphan processes #51539
  • NestedByteChannel.read(ByteBuffer) incorrectly returns 0 when buffer could not be filled #51521
  • Customizer null checks in HTTP client builders assert the wrong attribute #51514
  • SSL host config customizations may be lost during Tomcat initialization #51512
  • SQL Server Docker Compose integration may duplicate the JDBC URL's encrypt parameter #51482
  • SSL host config customizations are lost when reloading SSL bundles #51458
  • OAuth2ClientProperties are not available when a user-defined ClientRegistrationRepository bean is provided #51451
  • LdapHealthIndicator reports UNKNOWN instead of UP when LDAP server doesn't expose a protocol version #51442
  • JmsHealthIndicator leaks watchdog threads if start fails immediately #51434
  • Honour a wrapper's unwrap when resolving the root DataSource #51420
  • Source is not closed consistently by all JSON marshal testers #51419
  • File handle in SpringBootJoranConfigurator should be closed #51416
  • Validation of deprecated io.buildpacks.stack.id is too aggressive #51401

📔 Documentation

  • Document support for Java 27 #51826
  • Fix broken links from reference documentation to external Javadoc #51821
  • Remove reference to AppOptics in the reference guide as it has retired #51809
  • Fix broken links #51803
  • Update Spring Framework reference links #51772
  • Update testcontainers javadoc links #51766
  • Maven plugin documentation incorrectly references remote restart property #51748
  • Fix documented default of spring.test.database.replace #51729
  • Fix ActiveMQContainer Javadoc link in Testcontainers documentation #51723
  • Correct Jackson 3 Javadoc links #51664
  • Document baggage propagation over gRPC #51657
  • Fix typo in deprecated Pushgateway base-url property metadata #51633
  • Remove references to Spring Data Geode #51565
  • Fix typos in service containers javadoc and reference documentation #51446
  • Document SAML2 back-off in WebFlux security documentation #51436
  • Remove reference to removed SpringBootWebSecurityConfiguration #51414

🔨 Dependency Upgrades

❤️ Contributors

Thank you to all the contributors who worked on this release:

@2heunxun, @CHISANW, @COBI-98, @DevJunz, @JunggiKim, @MacAlsandair, @SebTardif, @Wanbinyu, @basteez, @dhruv9b, @dlwhdgus0810, @dlwldn30, @fabio-grassi, @henriquejsza, @hjm12223, @htjworld, @icikle, @jjh75607, @kdomo, @msridhar, @ngocnhan-tran1996, @nikita-kibitkin, @noojung, @nosan, @o-shevchenko, @ohchanKyu, @philsttr, @piyushrajyadav, @quaff, @scottfrederick, @seanxuu, @shakuzen, @somiljain2006, @vlsi, @xoruddl, @xxxxxxjun, and @yyuneu