News

Java Framework Makers Ship Fixes, Security Patches, and Milestone Builds in March Sprint

  • By John K. Waters
  • March 31, 2026

Key Takeaways

  • The releases are milestone builds, not final versions. Spring Boot 4.1.0 and Spring AI 2.0.0 are still in pre-production, meaning enterprise teams should not read this activity as a signal that major upgrades are ready for production deployment.
  • Security patching was a material part of the Spring AI release. Four CVEs were addressed across the 2.0.0-M4, 1.1.4, and 1.0.5 streams, which is relevant to teams running earlier versions who may need to evaluate their exposure.
  • The cluster of releases around the JDK 26 launch date reflects the Java ecosystem's six-month release rhythm in action. Framework teams are actively aligning their roadmaps to the new platform baseline, with general availability releases expected later in 2026.

Several widely used Java frameworks and tools released new versions in the weeks surrounding Oracle's March 17 launch of JDK 26, as the Spring ecosystem and related projects continued iterating toward their next major releases.

The Spring engineering team published the fourth milestone of Spring Boot 4.1.0 on March 26. The release includes 30 enhancements, documentation improvements, dependency upgrades, and bug fixes, and primarily reverts RabbitMQ and AMQP changes introduced in the prior milestone that will now be delivered in Spring Boot 4.2.

Spring AI, the framework's library for building AI-powered applications, also reached its fourth milestone on the same date. Spring AI versions 1.0.5, 1.1.4, and 2.0.0-M4 were released and made available from Maven Central, delivering a combined total of 51 improvements, bug fixes, and documentation updates across multiple release streams. The releases also include security dependency upgrades addressing four CVEs: CVE-2026-22738, CVE-2026-22742, CVE-2026-22743, and CVE-2026-22744.

Alongside those releases, the week of March 23 also saw a fourth milestone release of Spring Modulith 2.1.0, delivering a new JobRunrEventExternalizer class to support event externalization with JobRunr, and the ability to opt out of persisting an event publication for methods annotated with Spring Framework's @TransactionalEventListener.

On the persistence side, EclipseLink 5.0.0 reached general availability, shipping with support for the Jakarta Persistence 3.2 specification under Jakarta EE 11, improved query processing, and platform-level updates for Oracle, MySQL, DB2, and PostgreSQL.
IBM's Open Liberty 26.0.0.3 was also released in March, adding a new getUsersByAttribute() method to the UserRegistry interface and support for the latest Jandex index formats to optimize application startup times.

All of these releases remain pre-production milestones or point updates, published ahead of expected general availability dates later in 2026.

About the Author

John K. Waters is the editor in chief of a number of Converge360.com sites, with a focus on high-end development, AI and future tech. He's been writing about cutting-edge technologies and culture of Silicon Valley for more than two decades, and he's written more than a dozen books. He also co-scripted the documentary film Silicon Valley: A 100 Year Renaissance, which aired on PBS.  He can be reached at [email protected].

Most   Popular