Spring updates Boot, Security, AI, Kafka and Vault in June release wave

Spring project teams released a large set of updates during the week of June 8, 2026, led by Spring Boot 4.1.0, Spring AI 2.0.0 and Spring Data 2026.0.0. The release set also covered Spring Security, Spring Session, Spring Integration, Spring Modulith, Spring AMQP, Spring for Apache Kafka, Spring LDAP, Spring Vault and Spring gRPC.

The update gives Java teams a wide upgrade surface. Platform teams get new framework baselines and dependency refreshes. Application teams get gRPC support, AI model updates, Redis listener improvements, AMQP 1.0 client support, outbox integrations and several security fixes across hypermedia, Kafka and LDAP.

Spring Boot 4.1.0 anchors the release wave. The update adds support for Spring gRPC, improves exception diagnostics through a public InvalidConfigurationPropertyValueException constructor and reduces memory use for repeated WritableJson.toByteArray() calls. For teams that run Boot as the common runtime across microservices, those changes matter in the places that hurt during production work: service wiring, failure messages and memory pressure.

Spring Data 2026.0.0 adds Kotlin 2.3.20 and Vavr 0.11.0 support, annotated Redis publish and subscribe listeners and type-safe property paths. The Redis listener feature gives teams a cleaner eventing model for cache invalidation, lightweight notifications and local service coordination. Type-safe paths reduce string-based query mistakes that surface late in test runs or after schema changes.

Spring Security 7.1.0 adds an InetAddressMatcher functional interface and a new anyOf() method on AllRequiredFactorsAuthorizationManager. Architects can model access policies that accept one of several approved authentication factor combinations. That helps teams support step-up authentication without copying authorization logic across controllers and filters.

Spring Session 4.1.0 updates its dependency stack, including Spring Boot 4.1.0, Spring Security 7.1.0, Spring Framework 7.0.8, Spring Data 2025.1.6, Project Reactor 2025.0.6, Jackson 3.1.4 and Testcontainers 2.0.5. Session infrastructure often sits under login flows, API gateways and clustered web apps, so the dependency refresh gives teams a cleaner baseline for security and compatibility work.

Spring Integration 7.1.0 adjusts CORS handling by moving away from allowCredentials on @CrossOrigin toward originPatterns, matching Spring MVC behavior. It also simplifies ExpressionEvaluatingMessageProcessor constructors by using Spring Framework Assert checks. Integration-heavy applications depend on small consistency fixes like these because message endpoints tend to span HTTP, queues, files and database triggers.

Spring HATEOAS 3.1.0 improves caching in StringLinkRelation and aligns TypeConstrainedJacksonJsonHttpMessageConverter.canWrite() with Spring Framework behavior. The release also addresses CVE-2026-41006, which exposed a security-sensitive property through a Jackson annotation bypass, and CVE-2026-41007, which allowed malicious hypermedia through an unbounded static cache. Teams that expose hypermedia APIs should treat this update as a security patch, not a routine library bump.

Spring Modulith 2.1.0 adds event outbox support for Namastack through classes such as NamastackOutboxEventRecorder, adds JobRunrEventExternalizer for JobRunr integration and introduces @ModuleSlicing for module slice tests alongside Spring Boot slice test annotations. These features serve teams that keep one deployable application while enforcing module boundaries inside it.

Spring AI 2.0.0 updates Google GenAI model support and improves null safety in image observation code by replacing deprecated Jackson JsonNode methods. The Google model enum now favors GEMINI_3_1_PRO_PREVIEW while deprecating older Gemini entries. Java teams building retrieval, tool-calling or multimodal workflows with Spring AI gain a fresher model surface without leaving Spring conventions.

Spring AMQP 4.1.0 adds RabbitMQ 4.3.0 compatibility, removes wildcard trust from Jackson message converters and adds a spring-amqp-client module for generic AMQP 1.0 interaction. The trust change tightens message deserialization defaults. Teams that use RabbitMQ for domain events, background jobs or integration streams should review trusted package settings during the upgrade.

Spring for Apache Kafka 4.1.0 adds batch support to FailedRecordProcessor.setBackOffFunction() and addresses three CVEs. CVE-2026-41726 involved malicious selector headers that could drive heap growth, garbage collection pressure and out-of-memory failures. CVE-2026-41727 involved a malicious retry_topic-attempts header that could disrupt retry routing. CVE-2026-41731 involved malicious header values against trusted packages in Kafka header mappers. Kafka consumers often sit on business-critical paths, so teams should prioritize this update for services that accept records from shared topics or external producers.

Spring LDAP 4.1.0 adds dependency upgrades and replaces several LdapClient methods with map(), single(), optional(), list() and stream(). The release also addresses CVE-2026-41720, which allowed a user with a valid username to gain authorization with an empty or null password under one DirContextAuthenticationStrategy implementation. Identity code deserves careful upgrade testing because small authentication semantics can affect access control across many applications.

Spring Vault 4.1.0 adds VaultClient and ReactiveVaultClient interfaces for relative path handling against VaultEndpoint, plus a ManagedSecret class for managed secret consumption. The new client layer reduces the chance that application code sends an unintended absolute path to Vault. Teams that centralize database credentials, API tokens or certificate material in Vault should review their wrappers and test path behavior.

Spring gRPC 1.1.0 adds named in-process channel configuration through application properties and annotation-based exception handling for gRPC services. Boot 4.1.0 support makes gRPC a more natural option for Spring teams that need low-latency service calls, streaming APIs or strongly typed internal contracts.

The main use case spans managed service architecture inside Java shops. A team can run Boot as the base runtime, use Spring Security for factor-based access, use Spring Data with Redis listeners, publish through AMQP or Kafka, externalize secrets through Vault and add Spring AI behind service boundaries. Spring Modulith gives the same team a way to keep domain modules inside one deployable unit before it splits services apart.

The trade-off comes from upgrade breadth. Teams that take the full stack at once must test serialization rules, Kafka retry behavior, LDAP login handling, Vault paths and AI model names in the same release cycle. The security fixes justify urgency for exposed services, but production systems need focused regression tests around message headers, trusted packages, authentication factors and secret lookup paths.

For cloud-native Java teams, the June Spring updates point toward a platform with tighter defaults and broader integration coverage. The strongest pattern sits in the combination of Boot, gRPC, messaging, Vault and AI: Spring keeps pushing complex infrastructure behind familiar configuration while still exposing enough hooks for architects who need control.