Spring Framework

The language piece, it's also the platform and the tooling that we built around all of this, in particularly frameworks on top.

Think about Spring.

Think about Quarkus.

They are almost adding an enterprise level of abstraction on top of the sheer standards platform.

Love

that.

So with all this history behind Java, obviously that Java runtime isn't operating alone, right? There's all these frameworks supporting it, the Springs, Quarkus.

How are these frameworks sort of making it easier for adjuncting Java on the enterprise?

Hi Spring fans, welcome to another installment of a beautiful podcast.

It is the 3rd of September 2026 as I record this.

Can you believe what I just said? It's September.

It is quite lovely either way, but summer is better for me.

Although you do have to, the ever-present sun is something else, that's for sure.

Hi, Spring.

Hi, partner.

We are here.

Today I'm going to start with a tiny anecdote because I remembered when my guest today mentioned he's going to come on, I remembered an email exchange eight or nine years ago.

I wanted to get into public speaking a bit and I had some talks about Spring and Spring Boot and whatnot.

I messaged a couple of Java user groups in Germany I said, can I come give a talk? And I did give quite a few talks and was always very well received.

And then I sent one specific user group, I sent an email saying, hey, could I give the talk? And I got kind of a negative reply back saying, oh, it sounds a bit basic and it sounds a bit like not so interesting.

And what do you want to talk about Spring Boot? Everyone knows what the deal is with Spring Boot.

And I said, well...

Well, it's a bit of a background and the details internals.

Let's say I come from a very database centric, old school background.

Today is Monday, August 31st, 2026, and this is Spring Office Hours, Season 5, Episode 21, Pro Spring Boot 4 with Felipe Gutierrez.

My name is Dan Vega, Spring Developer Advocate at Broadcom, joined by my good friend and colleague, Deshawn Carter.

Deshawn, how's it going, my friend?

It's fantastic.

It is a great day to be a Spring Developer.

Another great day to be a Spring Developer.

I am in Las Vegas at Explore.

So, yeah, it's going to be an exciting week.

If you're there, I sure look forward to seeing you.

And then it's off to Amsterdam for the JavaZone conference, and, uh, I'm doing, I'm going to do a meetup, a Spring meetup about Spring and Kotlin in Paris as well along, along the way.

And then, um, it's off to, uh, Amsterdam, like I say, for the IntelliJ IDEA conference.

And then it's off to, uh, Kansas City for KCDC.

I mean, it's always been important, uh, to deal with and to think about security in the world of bad actors in the human, you know, meat space.

But now, with, with the autonomous agents moving as quickly and adroitly as they do, my goodness, it's more important than ever that there be strong, well-understood firewalls, you know? Uh, logical firewalls, a- if not actual software firewalls, right? You need to make your system production worthy.

And at the sort of solar, you know, star around which my entire security universe orients is, uh, the Spring Authorization Server.

I love the Spring Authorization Server.

Supply chain risk is another area where the stakes are rising.

A new report highlights that ninety-one recently disclosed Spring Framework vulnerabilities CVEs impact more than two hundred and nine thousand software components across the s-- supply chain.

The Spring framework is widely used in enterprise applications, and attackers are increasingly targeting these open source dependencies as a way to compromise, um, organizations at scale.

This amplifies the importance of comprehensive software bill of materials or SBOM management.

Uh, knowing exactly which components you're running, where they come from, and how they're maintained is critical.

The other example is versions.

So you're using, for example, Spring.

We'll pick on Spring, just Java.

You're using Spring, right? And you're on, let's say you're on Spring Boot 2.5.

Well, that's gone end of life.

The community has moved on.

If there's a commercial vendor that offers LTS, that's also expired.

And so if you're an enterprise and you're, let's say you're using a runtime that's Java 8 dependent, you've built on legacy Spring, so you're on Spring Boot 2.5, your choices now are you have to go through not only the Spring migration, but you maybe have to upgrade from Java 8 to some scary number while working on Spring.