Spring Boot 3.5 Patch Releases Now Gated Behind Enterprise Support

·1 views

Mikhail Polivakha, technical lead of the Axelix project, describes how a security scan can fail on a dependency whose fix never reaches public repositories. Using Spring Boot 3.5.16, released June 25, 2026, he notes that the next patch, 3.5.17, appears on the Spring calendar but is marked enterprise-only and will not show up on Maven Central. He explains that Spring's release train aligns many projects together, so vulnerability fixes depend on which Boot line carries them. The article also clarifies that the 'LTS' label does not guarantee open-source patches for a given line. It additionally covers the twice-yearly release cadence and how AI-driven changes have affected the 2026 release schedule.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Why Cash Conversion Cycle Matters Alongside Revenue Growth

The article argues that revenue shows a business is selling, but the cash conversion cycle reveals how quickly those sales become cash. The author examines inventory days, receivable days, and payable days together rather than relying on any single metric. Longer inventory holding and slower customer payments can tie up cash even while revenue and profit rise. The key question is whether a company can fund this working capital from its operations or whether growth keeps increasing its funding needs. The piece is general information only and not financial advice.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Building a Serverless PDF Summarizer with Claude, S3, and Lambda

The article explains how a PDF uploaded to an S3 bucket can be automatically summarized without managing any servers. It describes how AWS Lambda runs code only when triggered, scales automatically with concurrent uploads, and charges only for execution time. The workflow combines S3 for storage, Lambda for event-driven processing, and Amazon Bedrock for access to Claude's language model, with IAM roles granting the needed permissions. A minimal TypeScript Lambda handler is presented as a starting point, with the full summarization logic to be added in later steps.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

cdk-nag v3 Moves Security Checks into CDK Policy Validation and Changes Exceptions

cdk-nag, the AWS CDK security checking library from cdklabs, was released as version 3.0.0 on June 12, 2026, with the current version at 3.0.2. The rewrite replaces its earlier Aspect-based rule packs with the CDK's built-in policy validation framework, so simply upgrading the version typically causes build errors. Exceptions now use Validations.of(construct).acknowledge() with a required reason instead of NagSuppressions, and wildcard findings must be acknowledged individually. The article demonstrates setup, exception handling, and Vitest-based testing with validateScope() using a fictional bike rental application, and explains how to write a custom rule pack.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

GitLab fixes 500 errors from oversized comments across nine vulnerability GraphQL mutations

A GitLab merge request, gitlab-org/gitlab!269616, adds a length check to the comment argument of nine GraphQL mutations in its vulnerability management features. The bug stemmed from a 50,000-character limit that the model enforced but the API did not, so oversized input produced a generic internal server error. Bulk dismiss was worse, failing only at the database constraint because it skipped model validations. The change went through several rounds of CI fixes, including regenerating public GraphQL docs and introspection schemas, and was refined after reviewer feedback. The author's write-up highlights how easily such validation gaps ship unnoticed.

0 comments Read more at DEV Community