Ryan Baxter

Husband. Spring Cloud Engineer at Broadcom. Health Coach.

[Spring Cloud @springcloud]

On behalf of the entire Spring Cloud team I am pleased to announce the release of Spring Cloud 2026.0.0-RC2. This release is compatible with @springboot 4.2.0-RC2 and adds new features in several projects. All the details can be found on our blog https://t.co/Cis1JC0pBb

[Dan Vega @therealdanvega]

Spring Boot 4.2.0-RC1 is out: faster startup in executable jars, a properties migrator that can fail startup on warnings, and a new Ubuntu 26.04 buildpacks builder. Test it before GA. https://t.co/7aCr72jje4

[Dan Vega @therealdanvega]

1/ WHAT AN INSANE AND SCARY week in security. It's only going to get worse.

Here's what happened in the last 7 days. If you write code for a living, a lot of this hits close to home. 🧵

2/ LiteLLM got hit by a supply chain attack.

Version 1.107.0 on PyPI and Docker shipped a credential stealer and a backdoor. The likely cause? Stolen GitHub CLI tokens from three engineers.

Pin to 1.106.2 and rotate your cloud and AI keys.

3/ PHP shipped emergency patches for two critical RCE flaws (PHP2Shell).

No login needed. Someone tried to exploit it 4 days before it was even public.

Upgrade to 8.5.12, 8.4.27, 8.3.36 or 8.2.35.

4/ GitLab has a CVSS 10.0 flaw.

Unauthenticated code execution on self-managed instances. It affects every version back to 7.0. That's 12 years of releases.

5/ Node.js has a Brotli decoder bug that could allow remote code execution.

Fixed in 22.23.4, 24.22.1 and 26.12.1. Still on Node 20? No fix is coming. It's end of life.

6/ AI coding tools are a target now too.

OpenCode had a flaw that let a malicious MCP server run code on your machine during sign-in (Windows and WSL). Update to 1.18.33.

Be careful which MCP servers you connect to.

7/ Secrets are leaking everywhere.

Railway says an intruder may have read customer environment variables. Meta had GitHub repos accessed with stolen employee credentials.

If your secrets live on a platform, plan for the day you have to rotate them.

8/ Zero-days in the tools meant to keep us safe.

BeyondTrust Remote Support was exploited for weeks before anyone knew. Ivanti Connect Secure is being chained into root access. Both are on CISA's exploited list.

9/ And it's not just software.

Attackers heated supermarket fridges in France to 50°C. Some hardware wallets bought through resellers had implants that steal seed phrases. SafePay ransomware has hit 600+ orgs and wipes backups.

10/ Why do I think it gets worse?

Researchers used a public AI model to build a full Chrome exploit in 6 days. Attackers are using AI agents to break into companies at scale.

Finding bugs is getting cheap. Patching is not.

11/ What you can do this week:

• Update PHP, Node and GitLab
• Pin your dependencies
• Rotate tokens you haven't touched in a while
• Turn on 2FA everywhere, especially GitHub
• Review the MCP servers and AI tools you've installed

Stay safe out there. 🔒

[Spring Cloud @springcloud]

Spring Cloud Bus has been consolidated into Spring Cloud Stream. The 5.0.x branch remains in the Bus GitHub repo until OSS support for it ends at the end of July 2027. https://t.co/eR4Kv1pGbt

The docs in the new location.
https://t.co/nBUebIA3fm

[Spring Cloud @springcloud]

The Spring Cloud team is pleased to announce the release of Spring Cloud 2025.1.4 and 2026.0.0-RC1. 2026.0.0-RC1 contains a number of features to try out and 2025.1.4 contains several important fixes.
https://t.co/aZCxUXtGLG
https://t.co/yOaUeUCCWz

[Spring AI @SpringAICentral]

Spring AI 2.1.0-M1 is out 🍃

🧩 Message parts: ordered text, reasoning, tool calls & media
🤖 OpenAI Responses API: reasoning + tool calling on GPT-5.4+
📥 VectorStore.upsert() for pre-computed embeddings

Feedback welcome: https://t.co/OsokDRcxjr

#SpringAI #Java

[Spring Cloud @springcloud]

On behalf of the Spring Cloud team we are please to announce the first milestone of Spring Cloud 2026.0.0. This is the first release of Spring Cloud which is compatible with Spring Boot 4.2.x. See our blog for more details: https://t.co/WiaMhvZUGs

[Dan Vega @therealdanvega]

The Spring release train has been updated from a two week long train to a single day 🤯

https://t.co/TP4UICSdfR

[Devnexus @devnexus]

The #Devnexus #CFP has been extended to September 30.

We would love to hear from you. Submit your talk(s) at https://t.co/fwdFZHLXgm

[Josh Long @starbuxman]

I did a video which I think you might enjoy if you really want to understand how to approach Spring and @SpringBoot, from a very fundamental perspective.

Watch this, understand it, and I promise you'll be MUCH better prepared for working with Spring

Enjoy!

https://t.co/1HgNiqrgHA

[DaShaun @dashaun]

Not a small Feat. #springofficehours #PhilWebb

watch more at https://t.co/SQcIcz8g40

[Dan Vega @therealdanvega]

Spring Office Hours: S5E17 - Spring Boot 4.1 with Phil Webb https://t.co/9cagP1Gsf9

[Marcin Grzejszczak @MGrzejszczak]

Yup! It's official, @springcloud contract goes to https://t.co/gUY8pksTfh !

[Spring Cloud @springcloud]

Today, we are announcing a transition for Spring Cloud Contract. All maintenance, support, and ownership of the project will be officially transferred to one of its original creators, @MGrzejszczak , under https://t.co/Myt17PiNwy https://t.co/GchGRvkqjY

[Dan Vega @therealdanvega]

Episode 8 of Fundamentals of Software Engineering is up. Nate and I dig into open source sustainability, AI tooling realities, and why the token crisis matters for developers.

Catch the recording here👇🏻

https://t.co/HMNki3NJQd

[Josh Long @starbuxman]

the new @SpringBoot 4.1 brings with it a ton of nice new features including auto configuration for @MongoDB-backed @springbatch job repositories.

I wrote about it here! https://t.co/CMO0z641H6

[Dan Vega @therealdanvega]

No, Broadcom did not close source Spring.

Spring is still Apache 2.0. Still on GitHub. Patches still ship to the public repos. Nothing about the license changed.
But there's a real story here, and it's bigger than Spring.

🧵

[Spring AI @SpringAICentral]

🚀 Spring AI 2.0.0 GA is now available!

🏗️ Improved foundations: Spring Boot 4 baseline, null-safety, Jackson 3, re-designed options
🤖 Agentic improvements: unified tool calling, tool search, self-correcting output
🔌 MCP 2025-11-25 spec integration

https://t.co/VEfs8ryriW

[Spring Cloud @springcloud]

The Spring Cloud team is pleased to announce the release of Spring Cloud 2025.1.2. This release contains bug and CVE fixes and a handful of enhancements. In addition this releases introduces compatibility with @springboot 4.1.0.
https://t.co/uu7qjLrSA9

[Spring Cloud @springcloud]

The Spring Cloud team is pleased to announce the release of Spring Cloud 2025.0.3. This release contains bug and CVE fixes. In addition, this will be the final open source release of the 2025.0.x release train, open source support ends this month. https://t.co/XzNZvziYsa