Serguey Asael Shinder: Spring compressed its release train from two weeks to one Thursday a month
Spring has re-engineered how it releases. Michael Minella set it out on the Spring blog on 21 September: the release train, which used to be spread over two weeks with each layer of the dependency tree shipping on its own day, is now a single day — the Thursday after the third Monday of the month. The next regular patch train is 22 October; this month carries a milestone-only train on 24 September, ahead of the November feature releases.
The reason given is volume, and the figures are in the post. Since March the project has averaged nearly 80 community-provided security reports a month, on top of its own internal scanning. Over the period it has fixed more than 160 CVEs, and in one month it published 91 security advisories, which is what prompted the rework of how advisories appear on the website.
The argument for collapsing the train is stated plainly: under the old model, in each of the last two trains, new CVE fixes were going out every day of the train. Where a vulnerability is exploited in hours rather than days, a two-week staged release means the first day's fix sits in public — with a published advisory — while the rest of the portfolio has not moved. One drop closes that window for everything at once.
Three practical consequences for anyone running Spring in production.
The upgrade rhythm becomes a date rather than a watch. One day a month, the whole portfolio moves together. That is schedulable in a way "sometime over the next fortnight, depending on where your dependency sits" never was, and it removes the situation where an application pulls a patched Framework against an unpatched Boot.
The deliberate choice to keep the day of the month is worth noticing. The train compressed, the date did not move: it remains the Thursday after the third Monday, the day Spring Boot has shipped on for years. Changing the cadence without changing the calendar is the cheapest version of this migration for everyone downstream.
Milestone-only this month means one skipped patch window, not a quiet one. If a CVE lands before 22 October, the fix will not wait for the train — but the routine patch you might have expected in September is not coming as a patch. Plan the October window accordingly.
Source: https://spring.io/blog/2026/09/21/releasing-spring-for-modern-challenges