Spring News Roundup: First Release Candidates of Boot, Framework, Data

Open the source listing →

During the week of October 19, 2026, the Spring engineering team shipped first release candidates across sixteen portfolio libraries, detailed in InfoQ's report. The synchronized release cycle updates Spring Boot 4.2.0, Spring Framework 7.1.0, Spring Data 2026.1.0, Spring Cloud 2026.0.0 Paddington, Spring Security 7.2.0, and eleven complementary projects.

This review details foundational runtime adjustments, architectural consolidations, security patches, and artificial intelligence interface changes across the ecosystem. It provides technical guidance for enterprise Java developers, platform architects, and systems engineers evaluating upgrade timelines ahead of final production availability.

The offer: Spring News Roundup

Spring Boot 4.2.0-RC1 anchors this release cycle with key infrastructure upgrades, including a migration to the Ubuntu Resolute builder that replaces the Noble Java Tiny Builder. The release also improves Uber-Jar performance by enabling direct lookup of classes and resources within nested jars. Beneath Boot, Spring Framework 7.1.0-RC1 refines nullability in DataAccessUtils and LinkedCaseInsensitiveMap. It also introduces overloaded onRetrySuccess() and onRetryFailure() methods in RetryListener with a RetryState parameter for direct state access during retries. Spring Data 2026.1.0-RC1 upgrades all subprojects, adding Redis subscription forwarding via SubscriptionListener.

Spring Cloud 2026.0.0, codenamed Paddington, delivers dependency upgrades based on Spring Boot 4.2.0-RC1 while absorbing Spring Cloud Bus directly into Spring Cloud Stream. For access control, Spring Security 7.2.0-RC1 updates StrictServerWebExchangeFirewall so non-canonical HTTP method casing is no longer detected as distinct, leveraging normalized casing from HttpMethod.valueOf(). Additionally, RestClientOpaqueTokenIntrospector and SpringOpaqueTokenIntrospector now set Content-Type to application/x-www-form-urlencoded. Concurrently, Spring Session 4.2.0-RC1 integrates the Spring Security Settings Plugin and Spring Security Maven Plugin while standardizing continuous integration across environments for public and private build pipelines.

How to get Spring News Roundup

Teams can obtain these first release candidate builds through standard Maven and Gradle milestone repositories to test compatibility across runtime components. Adopting these milestones requires synchronizing inter-project dependencies, such as in Spring for GraphQL 2.1.0-RC1, which pulls in Spring Framework 7.1.0-RC1, Spring Data 2026.1.0-RC1, and Spring Security 7.2.0-RC1. GraphQL 2.1.0-RC1 also reinstates the Content-Length response header for WebFlux applications to preserve backward compatibility. Similarly, Spring HATEOAS 3.2.0-RC1 aligns dependencies with Spring Framework 7.1.0-RC1, Spring Plugin 4.2.0-RC1, and Reactor 2026.0.0-RC1 across modern reactive stacks.

Quality assurance teams can integrate testing modules like Spring REST Docs 4.1.0-RC1, which upgrades to Spring Framework 7.1.0-RC1, adds JSpecify nullability, and supports the RestTestClient interface. Complementing documentation tooling, Spring Modulith 2.2.0-RC1 enhances modular event management by adding ABANDONED and RESUBMITTED enumerations to EventPublication.Status to distinguish failed from abandoned events. Furthermore, Modulith now completes event publications within a listener transaction by default using the Spring Framework TransactionSynchronization interface, preventing completion failures when listeners commit. These components allow teams to validate events and generated documentation prior to production.

How Spring News Roundup compares

Data processing components introduce notable architectural changes compared to previous versions. Spring Batch 6.1.0-RC1 delivers the new PageableItemReader class as a type-safe alternative to RepositoryItemReader, taking a function from Spring Data Pageable to Slice. Batch also introduces the @JobParameter annotation to inject job parameters into beans without requiring SpEL expressions. In AI systems, Spring AI 2.1.0-RC1 replaces the deprecated ChatMemory interface with the new SessionService interface for session creation and retrieval. In addition, OpenAiChatModel and DeepSeekChatModel now construct assistant messages for each choice from ordered message parts.

Messaging abstractions also diverge from legacy implementations through notable performance, configuration, and security updates. Spring AMQP 4.2.0-RC1 removes calls to Assert.noNullElements(), allowing RabbitAdmin and AmqpAdmin to accept null or empty arrays for exchanges, queues, and bindings, while simplifying buildMessage() in listener adapters. Spring for Apache Kafka 4.2.0-RC1 outputs the KafkaHeaders.DELIVERY_ATTEMPT value when using CommonDelegatingErrorHandler with deliveryAttemptHeader set to true. Meanwhile, Spring Integration 7.2.0-RC1 aligns DefaultJmsHeaderMapper headers with DefaultHttpHeaderMapper and deprecates the default SerializingHttpMessageConverter constructor, introducing an allowedPatterns attribute to strengthen payload deserialization security.

Who should buy Spring News Roundup

Organizations operating enterprise directory infrastructure and web services gain essential stability fixes from this release bundle. Spring LDAP 4.2.0-RC1 provides string parameterization in logging to prevent non-constant filename lengths, adds test coverage in DefaultObjectDirectoryMapperTests, and resolves ClassCastException bugs in DirContextAdapter.getStringAttribute(). For SOAP environments, Spring Web Services 5.1.0-RC1 enables DefaultWsdl11Definition to attach policy documents, such as WS-Policy or WS-SecurityPolicy fragments, directly to every binding. Enterprise platforms with integrated LDAP access and legacy web services should evaluate these candidate versions during upcoming internal integration review cycles.

Engineering teams building distributed systems and event-driven architectures should evaluate these candidate updates to streamline infrastructure. Distributed cloud deployments running on Spring Cloud 2026.0.0 benefit from the consolidation of Spring Cloud Bus into Spring Cloud Stream, simplifying messaging topologies. Systems requiring reliable Redis notification handling benefit from SubscriptionListener support in Spring Data Redis. Furthermore, teams deploying reactive microservices gain predictable header behavior from the reinstated WebFlux Content-Length support in Spring for GraphQL 2.1.0-RC1 and robust transaction-bound event completion guarantees within Spring Modulith 2.2.0-RC1 deployments.

The catch with Spring News Roundup

Adopting these release candidates involves navigating multiple deprecations and breaking changes across project boundaries. Spring Framework 7.1.0-RC1 removes several deprecated APIs, requiring legacy codebases to remediate obsolete calls. In Spring Integration 7.2.0-RC1, the default constructor for SerializingHttpMessageConverter is deprecated, requiring developers to configure allowedPatterns explicitly to avoid security warnings. Additionally, Spring AI 2.1.0-RC1 deprecates the ChatMemory interface, requiring applications managing conversational context to migrate state management to SessionService. Upgrading without adjusting these deprecated integration patterns will cause compilation errors or runtime configuration failures.

Security and directory behavior changes also demand careful verification before adoption. Spring LDAP 4.2.0-RC1 introduces explicit breaking changes alongside bug fixes, necessitating comprehensive validation against directory schemas. In Spring Security 7.2.0-RC1, HttpMethod.valueOf() normalizes HTTP method casing, preventing StrictServerWebExchangeFirewall from treating non-canonical case as distinct values, while token introspection classes now require application/x-www-form-urlencoded content types. Because all sixteen releases represent preliminary candidate milestones rather than general availability releases, engineering teams must validate performance, test dependency graphs, and verify regression suites thoroughly before deploying to production.