<p><strong>TLDR:</strong> Spring Boot 4.1.0-RC1 dropped this week alongside RC1s for Spring Security, Integration, Modulith, AMQP, and Kafka. A critical CVSS 9.1 sandbox bypass in Thymeleaf needs your immediate attention if you’re on anything before 3.1.4. Java 26 hit GA and the JavaOne 2026 architects session covered everything from Lombok’s compiler hacking to the slow death of the module system debate. Quarkus had a busy week with a new LTS (3.33), the 3.34 feature release, and several maintenance drops.</p>
<hr>
<h2>Spring Boot 4.1.0-RC1 and the ecosystem wave</h2>
<p>The Spring team shipped RC1s across the board this week. Boot 4.1 adds OpenTelemetry Protocol SDK exporter support and improved transaction management. Security 7.1 gets a new <code>anyOf()</code> method and <code>PreFlightRequestFilter</code> support. Integration 7.1 refactors <code>RedisLockRegistry</code> to use Redis 8.4+ native commands. Also worth noting: Spring Data AOT Repositories — coming in Boot 4 — shifts repository proxy generation to compile time, with benchmarks showing startup dropping from 10.1s to 8.7s, though compile times go up from 11s to 25s.</p>
<h2>Thymeleaf CVE-2026-40478: upgrade now</h2>
<p>A CVSS 9.1 Server-Side Template Injection vulnerability was patched in Thymeleaf 3.1.4.RELEASE. The sandbox bypass exploited two weaknesses: a string check that only blocked ASCII spaces after the <code>new</code> keyword (tab characters slipped through), and a class blocklist covering <code>java.*</code> but not <code>org.springframework.*</code>. Researchers built a working proof-of-concept using a tab character and <code>FileSystemResource</code>. There’s no workaround — upgrade immediately if you’re running any version before 3.1.4.</p>
<h2>Java 26 GA and the JavaOne architects session</h2>
<p>Java 26 reached general availability this week. The JavaOne 2026 architects Q&amp;A covered a lot of ground worth reading: structured concurrency is near finalization, Project Babylon is heading toward incubation, and the Java team was blunt about Lombok — it’s considered a bad citizen for hacking compiler internals. JDK 26 also improves G1 throughput via JEP 522 by streamlining write barriers, and JEP 500 starts restricting final field mutation via reflection, so anything relying on that trick for DI or serialization needs a migration plan.</p>
<h2>Quarkus 3.33 LTS and 3.34</h2>
<p>Quarkus shipped a lot this week. 3.33 is the new LTS (12-month support window), built on 3.32 with additional bugfixes and platform component upgrades including Camel Quarkus 3.33.0 and Quarkus Vault 4.7.0. 3.34 is the current feature release with Dev UI and Panache Next enhancements. Separately, Quarkus 3.35 will enable reflection-free Jackson serializers by default — a build-time metaprogramming approach that’s been opt-in for months and has now passed the full test suite.</p>
<hr>
<h2>Also notable</h2>
<ul>
<li><strong>Azul Zulu on Docker Official Images:</strong> Azul Zulu joins Docker’s Official Images program after two years of review, available as <code>azul-zulu</code> without a namespace prefix. The old <code>azul/zulu-openjdk</code> images are planned for deprecation by end of 2026.</li>
<li><strong>Hibernate ORM 7.3 Final:</strong> Adds a <code>KeyType</code> enum for loading entities by natural id, a new <code>@NaturalIdClass</code> annotation for composite natural ids, and Jackson 3 JSON/XML <code>FormatMapper</code> support.</li>
<li><strong>Jakarta Persistence 4.0 M2:</strong> Improves criteria query verbosity with specialized expression types (<code>ComparableExpression</code>, <code>TextExpression</code>), enhances the <code>EntityGraph</code> API with <code>BatchSize</code> support, and adds <code>FlushModeType.EXPLICIT</code> for finer flush control.</li>
<li><strong>Google ADK for Java 1.0:</strong> Adds external tool integrations (GoogleMapsTool, ContainerCodeExecutor, ComputerUseTool with Playwright), an App and Plugin architecture, event compaction for long-running sessions, and native Agent2Agent (A2A) protocol support.</li>
<li><strong>Timefold Solver 2.0:</strong> Ships full list variable support, a new declarative neighborhoods API, and a 91% speedup on course scheduling via precomputed joins. The paid Plus edition moves explainability features out of the open-source tier; the core solver stays Apache 2.0.</li>
<li><strong>JRuby 10.1.0.0:</strong> Targets Ruby 4.0 compatibility, reduces object sizes from 32 to 24 bytes (16 with Project Lilliput compact headers), and adds Prism parser support. Production users are advised to stay on 10.0 LTS while 10.1 stabilizes.</li>
<li><strong>Room 3.0:</strong> Drops Java codegen and KAPT entirely in favor of Kotlin-only output with KSP, adopts coroutine-first DAO APIs, and adds JavaScript and WebAssembly platform support. Room 2 enters maintenance mode.</li>
<li><strong>Ubuntu 26.04 LTS:</strong> Ships with OpenJDK 25, Linux kernel 7.0, and Canonical devpacks for Spring that bundle framework tooling into single-command installs. Wayland is now the only supported desktop session — no Xorg fallback.</li>
<li><strong>RHEL 10 Tomcat upgrade:</strong> Red Hat is moving the RPM-packaged Tomcat from 9.0 to 10.1, meaning the <code>javax.*</code> to <code>jakarta.*</code> namespace migration is now mandatory. A <code>tomcat9</code> compatibility package is available through November 2026.</li>
<li><strong>index4j:</strong> Dynatrace Research open-sourced a Java FM-Index library for fast arbitrary substring search over compressed log data — ~180MB of Android logs compressed to ~70MB, with count and locate queries running in microseconds.</li>
<li><strong>JavaFX 26 headless CI:</strong> JavaFX 26 ships a headless glass platform that lets you run rendering tests in GitHub Actions without Xvfb or Docker display tricks, using <code>-Dglass.platform=headless</code>.</li>
<li><strong>IntelliJ IDEA 2026.1.1:</strong> Bug-fix release restoring WSL Python SDK setup, fixing Gradle sync class cast errors, and speeding up Spring project code completion.</li>
</ul>


Spring Boot, JVM updates, and Java ecosystem news.

Java Digest

Spring Boot 4.1.0-RC1 arrived alongside RC1s for Spring Security, Integration, Modulith, AMQP, and Kafka, bringing OpenTelemetry SDK exporter support and startup improvements via AOT repository generation. A critical CVSS 9.1 SSTI vulnerability (CVE-2026-40478) was patched in Thymeleaf 3.1.4 — a sandbox bypass exploiting tab characters and a Spring class blocklist gap — requiring immediate upgrade. Java 26 hit GA with G1 throughput improvements and new reflection restrictions on final fields. Quarkus shipped LTS 3.33, feature release 3.34, and previewed reflection-free Jackson serializers in 3.35. Additional notable releases include Hibernate ORM 7.3, Jakarta Persistence 4.0 M2, Google ADK for Java 1.0, Room 3.0 (Kotlin/KSP only), JRuby 10.1, Ubuntu 26.04 LTS with OpenJDK 25, and IntelliJ IDEA 2026.1.1.

Spring Boot 4.1 RC1 lands, Thymeleaf patches a critical SSTI