Spring ecosystem ships AI 2.0, patches security flaws

Summary

Multiple frameworks expose deserialization and authentication bypasses—Spring HATEOAS, Kafka, and LDAP all ship urgent patches. Spring AI model enum changes break existing code pointing to GEMINI_2_0_FLASH and GEMINI_2_0_FLASH_LIGHT.

Why it matters

Multiple frameworks expose deserialization and authentication bypasses—Spring HATEOAS, Kafka, and LDAP all ship urgent patches. Spring AI model enum changes break existing code pointing to GEMINI_2_0_FLASH and GEMINI_2_0_FLASH_LIGHT.

Sources

1. 1.Spring AI 2.0.0 ships with bug fixes, documentation improvements, dependency upgrades
2. 2.deprecations of the GEMINI_2_0_FLASH, GEMINI_2_0_FLASH_LIGHT and GEMINI_3_PRO_PREVIEW enumerations in favor of a new GEMINI_3_1_PRO_PREVIEW enumeration
3. 3.CVE-2026-41006, a vulnerability that exposes a security-sensitive property due to a bypass of the Jackson access-control annotations
4. 4.a vulnerability that allows an attacker to supply their own malicious hypermedia due to an unbounded static cache
5. 5.removal of the wildcard character from all Jackson message converters to "trust no one" by default
6. 6.new VaultClient and ReactiveVaultClient, designed to provide an "intermediate abstraction layer enforcing relative path handling at its core, preventing unintended absolute path usage"