<p><strong>TLDR:</strong> Broadcom released what it’s calling the largest set of Spring security updates in the framework’s history, driven by a 1,700% spike in AI-discovered vulnerabilities between March and April 2026. The A2A Java SDK reached 1.0.0.Final, giving Java developers a stable, GA implementation of the Linux Foundation’s Agent2Agent protocol. JDK 27 entered rampdown with nine finalized JEPs, and a high-severity deserialization CVE in Spring Statemachine requires immediate attention from anyone using its Kryo-backed persistence.</p>
<hr>
<h2>Broadcom releases largest Spring security update in framework history amid AI-driven vulnerability surge</h2>
<p>Monthly security advisories reported to Broadcom jumped over 1,700% from March to April 2026, with AI-powered scanners finding vulnerabilities in Spring’s dependency graph faster than teams can patch them. The response covers more than 100,000 validated dependency builds under a SLSA Level 3 clean-room architecture. Enterprise Tanzu Spring customers get day-zero CVE-only patches before open-source publication — a move that’s drawing criticism given how widely Spring is deployed. Roughly 60% of Spring runtimes being downloaded are already out-of-support versions, which makes the exposure picture worse. <a href="https://app.daily.dev/feed-by-ids?id=MF7TfzS0m&amp;id=uechdZnsP&amp;id=RDqWNJ8Ef&amp;id=ML17nHiky" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>CVE-2026-41862: Spring Statemachine Kryo deserialization enables RCE, breaks wire format on upgrade</h2>
<p>A high-severity CVE in Spring Statemachine 3.2.0–3.2.4 and 4.0.0–4.0.1 allows remote code execution via Kryo deserialization without a class allowlist across JPA, MongoDB, Redis, and ZooKeeper backends. The fix enables registration-required mode and introduces an explicit allowlist — but this is a breaking change. Application-specific state and event types must be manually registered, pre-upgrade persisted contexts are wire-format incompatible, and Redis users face a key namespace change that makes existing keys invisible after upgrade. Plan a migration window, not just a dependency bump. <a href="https://app.daily.dev/posts/yWRsfbjXZ" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>A2A Java SDK 1.0.0.Final released with gRPC, JSON-RPC, and Jakarta EE reference implementations</h2>
<p>After six months of development and seven pre-releases, the Agent2Agent Java SDK reached its first GA release. It supports three transports — JSON-RPC, gRPC, and HTTP+JSON/REST — and ships with an Integration Test Kit for cross-SDK interoperability validation. Domain classes use Java records throughout. Reference implementations target Quarkus and WildFly/Jakarta EE, which makes this immediately usable for teams already in the Spring or Jakarta ecosystem building multi-agent systems. <a href="https://app.daily.dev/posts/xWApJtPTK" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>JDK 27 enters rampdown with G1 as default GC, post-quantum TLS, and JDK 28 expert group formed</h2>
<p>JDK 27 hit Rampdown Phase One with nine JEPs finalized, including G1 as the new default garbage collector, post-quantum TLS support, and PEM cryptographic encodings. The JDK 28 Expert Group (JSR 403) has also been formed, with GA planned for March 2027. GlassFish 8.0.3 filed Compatibility Certification Requests for Jakarta EE 11 Platform and Core Profile 11, and Kotlin 2.4.0 adds JDK 26 support alongside WebAssembly Component Model and ES2015 features. <a href="https://app.daily.dev/feed-by-ids?id=Ug6Xlq8SR&amp;id=FFlTxi9bn&amp;id=qDVoJXNMO&amp;id=pTVKVJRjH" target="_blank" rel="noopener nofollow">Read more</a></p>
<hr>
<h2>Also notable</h2>
<ul>
<li><strong>JDK 26 performance: G1 dual card-table yields 5-15% throughput gains, AOT cache now supports ZGC:</strong> JDK 26’s G1 dual card-table design (JEP 522) cuts write-barrier synchronization overhead for 5–15% throughput improvement in reference-heavy workloads, the AOT cache gains GC-agnostic support including ZGC via JEP 516, and the new LazyConstant API enables JVM constant-folding for lazy initialization — worth reviewing before your next JVM upgrade decision. <a href="https://app.daily.dev/posts/4AS8hy8yL" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>OpenJDK bans AI-generated contributions; GraalVM permits them under contributor accountability:</strong> Oracle’s OpenJDK Governing Board approved an interim policy broadly banning AI-generated content in contributions, citing reviewer burden and unresolved IP questions, while Oracle Labs’ GraalVM project permits AI-assisted contributions provided the human contributor can fully explain and maintain the change — two opposing stances under the same Oracle Contributor Agreement. <a href="https://app.daily.dev/feed-by-ids?id=vJlxWOMR1&amp;id=MHC6rCp78" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Spring Statemachine CVE also covered in jqwik anti-AI affair retrospective: 1.10.0 pulled from Maven Central:</strong> Johannes Link, creator of jqwik, published a detailed retrospective on adding a prompt injection string to jqwik’s output as protest against agentic coding tools — version 1.10.0 was pulled from Maven Central after legal threats and public backlash, and the post raises concrete questions about agentic coding security risks that are worth reading alongside the OpenJDK AI contribution ban. <a href="https://app.daily.dev/posts/vEgKHp7qm" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Apache Flink 1.20.5 fixes RocksDB LRUCache memory leak and SubQueryDecorrelator query plan bug:</strong> Flink 1.20.5 patches a RocksDB ColumnFamilyOptions and LRUCache memory leak in the Compactor and fixes incorrect query plans from SubQueryDecorrelator for correlated EXISTS with HAVING on aggregate outputs — both are production-impacting bugs worth upgrading for if you’re on the 1.20 series. <a href="https://app.daily.dev/posts/xSVZPoEte" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>ZGC weak reference overhead: clear_path_dyn cuts Concurrent Process Non-Strong phase by 81%:</strong> A master’s thesis investigation found that pipeline optimizations to ZGC’s weak reference processing achieve an 81% reduction in the Concurrent Process Non-Strong phase, but only ~8% total collection time improvement — while replacing WeakReference objects with an @weak field annotation yields 41% major-collection-time savings and 53% heap reduction, suggesting the real problem is Java’s object-based representation model. <a href="https://app.daily.dev/posts/F5Hg62Efe" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>


Spring Boot, JVM updates, and Java ecosystem news.

Java Digest

Broadcom released the largest Spring security update in the framework's history, driven by a 1,700% spike in AI-discovered vulnerabilities between March and April 2026. A high-severity CVE (CVE-2026-41862) in Spring Statemachine enables RCE via Kryo deserialization and requires a migration window due to breaking wire-format changes. The A2A Java SDK reached 1.0.0.Final with gRPC, JSON-RPC, and Jakarta EE reference implementations for building multi-agent systems. JDK 27 entered rampdown with nine finalized JEPs including G1 as default GC and post-quantum TLS. Notable items include OpenJDK banning AI-generated contributions, JDK 26 G1 performance gains of 5–15%, and Apache Flink 1.20.5 bug fixes.

Spring gets its biggest security patch wave ever, A2A Java SDK hits 1.0