Spring IO Platform Release Management

Question

Since the Spring IO platform has been implemented, we manage project dependencies using the Spring IO platform-bom. Thus, we no longer specify dedicated versions for individual Spring components (or even platform libraries) (and we are careful when it comes to rewriting them).

The disadvantage of this solution is that we cannot use new versions of individual components, as recommended, for example, (yesterday) announced a new version 4.1.6 of the Spring Framework until it is integrated into the new version of the Spring IO platform.

It would be nice to learn more about Spring IO platform release management. Is there a general plan for when to release a new version? I thought that in fact the new version of the Spring Framework will launch the new version of the Spring input platform, but that doesn't seem to be the case (the new version is with Spring Framework 4.1.5 and I will assume that the next version will include Spring Framework 4.1.6) .

Any understanding of Spring IO platform release management would be interesting and useful to me.

Answer 1

The general rule is that we release a new version of the platform every 6-8 weeks. This is not set in stone, as there will be cases where more frequent emissions are warranted; for example, to fix a security vulnerability.

As you already know, the platform is built on top of Spring Boot. It extends the Spring Boot bom, adding dependency management for a number of other Spring projects and their dependencies. Generally speaking, when a new version of Spring Boot is released, which initiates the release of a new version of the platform. In addition, a new version of the Spring Framework often launches a new version of Spring Boot.

As you already noticed, the exception to this rule was Spring Framework 4.1.5 and Spring Boot 1.2.2. While Spring Boot 1.2.2 was released shortly after Spring Framework 4.1.5, there is no platform version containing these two releases. The reason for this is that in Spring Boot 1.2.2, several Spring security-related errors were discovered that we would like to avoid for platform users. To do this, we decided to postpone the release of platform 1.1.2 until Spring Boot 1.2.3 is available and the Spring security issues have been fixed. There is a slight compromise between being at the forefront and having some error protection.

You should consider the Platform as the recommended set of versions to use, but it is definitely not the only set of versions that you can use. Using version properties on the bom platform is deliberate, and it makes it easier for users to redefine versions to meet their needs. The drives of various Spring projects take backward compatibility very seriously, and you should always be able to upgrade to the new service version of any project without any difficulty. In many cases, you can also upgrade to a new small version, but more carefully it will be guaranteed.