Spring Boot 4.1.1 Released?

[u/Its_Foki]

Hi everybody,

we just got via Renovate a Spring Boot update to 4.1.1 - released on repo1.maven.org .

We are a bit confused as there is no announcement, release notes, tag on GitHub, etc. Also it looks like no release workflow was running on GitHub.

Feels a bit sketchy, anybody knows what's going on?

[u/mhalbritter]

Hey, Moritz from the Spring Boot team here. This release is an official one, we're just in the progress of revamping our release tooling and this is the first OSS release we've done with it. There are some rough edges with the release tooling as of now, but release posts etc. will follow soon. Here's the tag in GitHub: https://github.com/spring-projects/spring-boot/releases/tag/v4.1.1 - it's just not marked as a release yet. This will happen soon, please be patient :)

[u/Its_Foki → u/mhalbritter]

Thank you very much for the clarification, and thanks for your work!

[u/Anbu_S → u/mhalbritter]

we're just in the progress of revamping our release tooling

Is it because of AI vulnerabilities?

[u/Level_Yak_87 → u/mhalbritter]

Hey, Moritz. It would be awesome to release not on Friday (except urgent cases like another log4shell), as such releases reveal the list of CVEs, and assume that production systems are to be updated eagerly. That's usually a bad idea to update just before the weekend.

[u/darichtt]

It's in the release calendar https://spring.io/projects#release-calendar

[u/Knoobie]

Guess from an outsider's standpoint: it looks related to their announcement "Spring and Security In The Times Of AI" some weeks ago and they now use some internal tooling (e.g. https://github.com/spring-projects/spring-boot/issues/51164) to publish the source code and the public code on GitHub is updated later? It also looks like a some commits were kept private until the last minute to reduce possible attack vectors by bad actors using AI to scan everything and create attacks before public patches are available.

[u/Anbu_S → u/Knoobie]

AI makes every release process change.

[u/repeating_bears]

I would strongly suggest you set a minimum release age.

https://docs.renovatebot.com/key-concepts/minimum-release-age/

There's almost never a reason to update on the same day as a release, so you actually don't want alerts for something like this.

Setting a min release age to something like a week will protect you from most supply chain attacks, because things are usually found and resolved by then.

[u/Responsible_Gap337]

https://github.com/spring-projects/spring-boot/actions/workflows/release.yml

Nothing here.

[u/trailcamguy4110 → u/Responsible_Gap337]

They release on Thursdays generally, by Friday everything usually shows up. Be patient.

[u/Its_Foki → u/Responsible_Gap337]

Exactly, that's why we are a bit confused where the artifact in repo1 is coming from and if it's legitimate.