<p><strong>TLDR:</strong> Spring I/O 2026 made it clear the Spring ecosystem is repositioning itself as an agent platform, not just a web framework. Java 26 landed with ten JEPs including HTTP/3 support and the first real enforcement step against final field mutation via reflection. Spring Framework 7 and Boot 4 are bringing retry and concurrency throttling into the core. Spring Boot 3.5 hits EOL on June 30 — and the CVE silence that follows is the part worth worrying about.</p>
<hr>
<h2>Spring I/O 2026: the agent pivot is real</h2>
<p>About a third of main-track sessions at Spring I/O in Barcelona covered Spring AI, MCP, and LLM-based agents. Rod Johnson was there with his Embabel talk — an Apache-licensed agentic framework built on Spring Boot and Kotlin that uses GOAP (Goal-Oriented Action Planning) for runtime path selection instead of static state machines or LLM improvisation. The pitch is that Java’s type system gives you something Python frameworks like LangChain can’t: structured return types and domain models surfaced directly to the LLM as prompt context. Whether that holds up in practice is an open question, but the direction is unmistakable.</p>
<h2>Java 26 ships, and final field mutation is on notice</h2>
<p>Java 26 released March 17 with ten JEPs. The headline additions: JEP 517 adds HTTP/3 (QUIC) support to the HttpClient API, JEP 500 adds runtime warnings when final fields are mutated via reflection (a hard block is coming in a future release), and JEP 504 permanently removes the Applet API. Structured Concurrency is on its sixth preview and feels close to stable. If you’re still mutating final fields via reflection for serialization or DI, now is the time to migrate — the alternatives are constructor injection, records with <code>readResolve</code>, and copy constructors.</p>
<h2>Spring Boot 3.5 EOL and the CVE blind spot</h2>
<p>Spring Boot 3.5 loses open-source support on June 30, 2026. The migration itself is manageable. The real problem is what happens after: security researchers stop filing CVEs against EOL versions, maintainers stop triaging, and the vulnerability pipeline goes quiet. The vulnerabilities don’t disappear — they just stop being recorded. Spring Boot 2.7’s post-EOL history (CVE-2024-38807 with no open-source fix) is the pattern to expect. If your team is still on 3.5 after June, your scanners will show green while the exposure quietly grows.</p>
<h2>Spring Framework 7 and Boot 4 direction</h2>
<p>Spring Boot 4 modularizes auto-configurations to cut startup times and reduce uber jar sizes. Spring Framework 7 pulls retry support (<code>RetryTemplate</code>, <code>@Retryable</code> including reactive types) and concurrency throttling (<code>@ConcurrencyLimit</code>) directly into the core framework — no more separate dependency for basic resilience patterns. First-class HTTP API versioning lands with support for path, header, query parameter, and media type strategies. A Jackson 2 compatibility module and OpenRewrite recipes are available to ease the Boot 3-to-4 migration.</p>
<hr>
<h2>Also notable</h2>
<ul>
<li><strong>JEP 534 and JEP 533 elevated to Candidate:</strong> Compact Object Headers by Default and Structured Concurrency (7th preview) are now Candidate-status JEPs targeting JDK 27, alongside JDK 27 Build 18 early-access.</li>
<li><strong>Spring Framework 7.0.7 / 6.2.18:</strong> Three CVE fixes covering DoS vulnerabilities in WebFlux and MVC — patch these.</li>
<li><strong>Apache Camel 4.19.0:</strong> Adds Azure Functions, Groovy JSON, and Spring AI Image components, plus quantum-safe TLS support.</li>
<li><strong>IntelliJ IDEA 2026.1:</strong> Ships Java 26 day-one support, Spring Debugger remote debugging for Docker-hosted apps, Kotlin-aware JPA validation, Git worktree support, and free basic JS/HTML/CSS editing — over 1,000 bugs fixed.</li>
<li><strong>Koog integration for Spring AI:</strong> JetBrains’ agent orchestration framework now layers onto existing Spring AI providers, adding type-safe graph workflows, PostgreSQL-backed durable execution, and coroutine-based parallel execution.</li>
<li><strong>CodeQL 2.25.2:</strong> Adds Kotlin 2.3.20 support and reduces false positives across Java/Kotlin queries.</li>
<li><strong>AWS Transform in VS Code and Kiro:</strong> Agentic migration tool now handles Java version upgrades and AWS SDK v1-to-v2 migrations directly from the IDE.</li>
<li><strong>Micronaut 4.10.12:</strong> Maintenance release updating Micronaut Core and Security; Micronaut 3 users should be on 4 by now.</li>
<li><strong>Jakarta EE 12 timeline:</strong> Core Profile 12 targets Q4 2026; Web Profile and Platform releases expected Q1-Q2 2027.</li>
<li><strong>MemorySegment vs ByteBuffer:</strong> If you’re still using ByteBuffer for off-heap access in new code, stop — MemorySegment with Arena gives you 64-bit indexes, manual deallocation, and thread-access controls.</li>
<li><strong>Quantum-safe cryptography for JVM:</strong> NIST-standardized ML-KEM is available today via Bouncy Castle; the “harvest now, decrypt later” threat makes this worth auditing sooner than most teams think.</li>
<li><strong>Spring Documentary:</strong> Official trailer is out, film drops May 7th.</li>
</ul>


Spring Boot, JVM updates, and Java ecosystem news.

Java Digest

Spring I/O 2026 signaled a major pivot toward AI agents, with roughly a third of sessions covering Spring AI, MCP, and LLM-based agents. Rod Johnson's Embabel framework uses GOAP for runtime path selection on top of Spring Boot and Kotlin. Java 26 shipped with ten JEPs including HTTP/3 support via JEP 517, runtime warnings for final field mutation via reflection (a hard block is coming), and permanent removal of the Applet API. Spring Boot 3.5 hits EOL on June 30, 2026 — the key risk being that CVEs stop being filed against EOL versions, creating a false sense of security. Spring Framework 7 and Boot 4 bring retry support, concurrency throttling, and HTTP API versioning into the core, while Boot 4 modularizes auto-configurations to cut startup times. Notable ecosystem updates include IntelliJ IDEA 2026.1 with Java 26 day-one support, Apache Camel 4.19.0 with quantum-safe TLS, and JetBrains' Koog agent orchestration integrating with Spring AI.

Spring I/O shifts toward agents, Java 26 ships HTTP/3 and final field warnings