Hi, Spring fans! Welcome to another installment of This Week in Spring! How are you? It's been a hot minute since we last chatted. I was in Germany this time last week. Now, I'm back in beautiful San Francisco. Today the weather will climb to a monumental 84 F! That's very unusual, for any time of the year, here in San Francisco. Most places here in San Francisco don't have air conditioning. Some have heating. I bought a brand new condo in 2014 and it didn't have air conditioning. You just open the window. I am privileged enough that I have air conditioning today, of course. I mention all this…

Updates

• [06-20] CVE-2022-22980 is published
• [06-20] Spring Data MongoDB 3.4.1 and 3.3.5 are available

Table of Contents

• Overview
• Vulnerability
• Am I Impacted
• Status
• Suggested Workarounds

Overview

We would like to announce that we have released Spring Data MongoDB 3.4.1 and 3.3.5 to address the following CVE report:

• CVE-2022-22980: Spring Data MongoDB SpEL Expression injection vulnerability through annotated repository query methods

This vulnerability was responsibly reported by Zewei Zhang from NSFOCUS TIANJI Lab on Monday, June 13 2022. The full report will be published to MITRE and as security advisory under tanzu.vmware.com/security…

Dear Spring Community,

I am happy to announce the 4.15.1 release of the Spring Tools 4 for Eclipse, Visual Studio Code, and Theia.

fixes and improvements

• (Spring Boot) fixed: VScode incorrectly suggests removing @Autowired annotation from methods (#787)
• (Spring Boot) fixed: VScode quick fix should not suggest removing @Autowired annotation from JUnit tests (#786)
• (Eclipse) fixed: Not able to extract the new version of spring-tool-suite-4-4.15.0.RELEASE-e4.24.0-win32.win32.x86_64.self-extracting.jar on windows 11 (#788)
• (Eclipse) fixed: Cannot open Spring Boot Language Server Java Editor settings menu (#789)
…

Hi, Spring fans! In this installment, Josh Long (@starbuxman) talks to Spring Framework contributor Sébastien Deleuze (@sdeleuze) on GraalVM, AOT, project Leyden, and WebAssembly.

We have released Spring Cloud Function 3.2.6 to address the following CVE report.

• CVE-2202-22979: Spring Cloud Function Dos Vulnerability

Please review the information in the CVE report and upgrade immediately.

Hi, Spring fans! Welcome to another installment of This Week in Spring! I've just arrived in beautiful Berlin, Germany, for the forthcoming We Are Developers show with more than five thousand attendees. I was in Toronto, Canada, for the epic SpringOne Tour installment there. I've also had the privilege of taking these last two trips with my daughter, Kimly. She's on summer break from school. It's made the long miserable hours in economy bearable, and something for which I couldn't be more grateful. I'm also looking forward to being at the upcoming SpringOne Tour installment in New York City…

Hi, Spring fans! In thi^^^ these installments, we continue our series introducing the Spring for GraphQL project. This series features Spring for GraphQL lead Rossen Stoyanchev (@rstoya05) - whose work you may know from basically everything in the wide and wonderful world of Springdom having to do with the web (HTTP, RSocket, WebSockets, GraphQL, JSF, MVC, etc) - and GraphQL Java engine founder and lead Andi Marek (@andimarek) and of course yours truly, Spring Developer Advocate Josh Long (@starbuxman). It provides an in-depth look at all things Spring for GraphQL.

This week I'm publishing two…

Hi, Spring fans! In thi^^^ these installments, we continue our series introducing the Spring for GraphQL project. This series features Spring for GraphQL lead Rossen Stoyanchev (@rstoya05) - whose work you may know from basically everything in the wide and wonderful world of Springdom having to do with the web (HTTP, RSocket, WebSockets, GraphQL, JSF, MVC, etc) - and GraphQL Java engine founder and lead Andi Marek (@andimarek) and of course yours truly, Spring Developer Advocate Josh Long (@starbuxman). It provides an in-depth look at all things Spring for GraphQL.

This week I'm publishing two…

Hi, Spring fans! In this installment, Josh Long (@starbuxman) talks to Kubernetes legend and fellow Tanzu Developer Advocate Cora Iberkleid (@ciberkleid) about Kubernetes and Cartographer supply chains