Framework
Java framework providing authentication and authorization for Spring applications, including filter chains, request matchers, and role-based access control.
FINOS says its bank-funded OSERA alliance now ships patched builds of more than 50 older open-source project lines that member banks still run. The signed, tested builds go only to paying members, while anyone can read the patched source.
Reality
Four annotations and one @EnableJpaAuditing fill created_by in five minutes. The hook underneath is a no-argument method that can only see the thread doing the write, and a dev.to walkthrough starts where that leaves a scheduler.
Reality
Spring gives three places to run code around a request, and each one sees a different amount. A dev.to walkthrough puts filters outside the DispatcherServlet, interceptors inside it, and aspects around any bean method.
Reality
A team sent internal metrics out through the public edge before a routine doctl listing showed both droplets on the same private /16. The rewrite keeps the OAuth grant and retires the two route-based controls.
Reality
A gateway ACL and a backend router are separate parsers with no agreed decode order, which is why /%2Fadmin still lands. Normalizing earlier relocates the window; refusing ambiguous paths is what closes it.
Reality
InfoQ's roundup examines two of the CVEs, both in Spring Integration, and one of them is a hardening call that leaves the deserialization path unguarded. Everything else you triage off the advisories page yourself.
Reality
A dev.to post, published twice by the same author, argues that switching off env and heapdump while leaving exposure.include set to the wildcard is worse than no policy. The subtraction backs it up.
Reality