LoginSign Up
← Back to all sparks
M

Micronaut

DEVOPS
Velocity5.0

JVM framework for building modular microservice and serverless applications

micronaut.io ↗

Micronaut is patching two 5.x trains almost daily, mostly around AOP and introspection

dual-trainaop-proxiesbean-introspectiongraalvmsecurity-backports
◆Current state
Micronaut Core is releasing at an unusually high frequency — six versions in nine days across two parallel lines, 5.0.x and 5.1.x. Individual releases are tiny, often a single commit. The recurring subject matter is the compile-time machinery: method injection on AOP introduction proxies, processing of replaced executable methods, factory beans declared in superclasses, introspection of private JsonProperty fields, and a @Replaces regression on proxied default implementations.
◆Where it's heading
The cluster of AOP, @Replaces and factory-bean fixes in quick succession suggests recent changes to bean processing are still settling, with each edge case found and shipped individually rather than batched. A Jackson security patch applied to both trains on consecutive days shows the backport discipline is intact. The GraalVM warning cleanup and exclusive service-loader strategy point at native-image quality being maintained alongside.
◆Prediction
Expect the two-train patch cadence to continue until the AOP and bean-replacement fixes stop arriving, with 5.0.x receiving only security backports and regressions.

◆Recent moves

  1. 11d ago

    CORS matching fixed and Jackson security patch backported

    Replacing reference equality with value equality in the CORS isAny checks is a real correctness fix, since the old comparison could silently fail to match configured origins. The Jackson dependency patch here is the 5.0.x half of a security update applied to both trains within a day.

    View source ↗
  2. 12d ago

    Jackson security patch on the 5.1 line

    A single dependency update patching Jackson vulnerabilities, cut on its own rather than held for the next fix release. The speed of the matching 5.0.x release a day later is the part worth noting.

    View source ↗
  3. 13d ago

    Fix for processing replaced executable methods

    A one-commit release repairing how replaced executable methods are processed. It belongs to the run of bean-replacement and AOP fixes that defines this stretch of the 5.1 line.

    View source ↗
  4. 14d ago

    Method injection repaired on AOP introduction proxies

    Method injection on AOP introduction proxies is fixed here, another entry in the compile-time proxy thread, alongside a KSP version bump. Small in isolation, but the third proxy-related fix in a week.

    View source ↗
  5. 16d ago

    Private JsonProperty introspection and GraalVM warning cleanup

    The broadest release in this window: introspection now works for private JsonProperty fields, factory beans in superclasses are fixed, and an exclusive service-loader strategy clears GraalVM warnings. The native-image work is the piece that goes beyond bug repair.

    View source ↗
  6. 19d ago

    Regression fix for @Replaces on proxied default implementations

    A single regression fix restoring @Replaces matching for proxied default implementations. Explicitly labelled a regression in the notes, which places it at the start of the bean-replacement fixes that follow through the 5.1 releases.

    View source ↗