# Spring Boot: what changed from 3 to 4

- Product: Spring Boot (https://whatsnew.fyi/product/spring-boot)
- Vendor: Broadcom
- Range: changelog entries numbered after v3.5.16 up to and including v4.1.1, stable releases only
- Entries below: 6 releases (newest first)
- Resolved: 3 is v3.5.16 and 4 is v4.1.1, the newest stable release of each major we track
- Carrying security changes: 0 · CVEs mentioned: 0 · Mentioning breaking changes: 0 · Removing or deprecating something: 1
- Page: https://whatsnew.fyi/product/spring-boot/compare/3...4

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

## What changed (88 changes, grouped by kind)

### Added

#### v4.1.0 (2026-06-10)

- Add public constructor to InvalidConfigurationPropertyValueException that accepts a cause

### Changed

#### v4.1.1 (2026-08-20)

- Spring Boot's Gradle plugin no longer automatically configures gRPC when the Protobuf plugin is applied; opt in by configuring the protobuf extension with the grpc plugin using an empty block

#### v4.1.0 (2026-06-10)

- Reduce memory consumption when repeatedly calling WritableJson.toByteArray

### Fixed

#### v4.0.8 (2026-08-21)

- Kafka consumer-specific security protocol is not taken into account (also in v4.1.1)
- Temporary file is not deleted when ExportedImageTar construction fails (also in v4.1.1)
- spring-boot-h2-console pulls servlet-api as transitive dependency (also in v4.1.1)
- Methods that return the result of Map#remove are not declared with a @Nullable return type (also in v4.1.1)
- PropertiesLauncher does not log nested archive paths (also in v4.1.1)
- JarFile is not closed when finding main class from archive (also in v4.1.1)
- CloudFoundry reactive auto-configuration should not require a WebClient.Builder bean to be defined (also in v4.1.1)
- Resources are not cleaned up when resolving an image that is not yet present in the builder (also in v4.1.1)
- Context refresh fails on reactive Cloud Foundry when using Actuator without spring-boot-health (also in v4.1.1)
- GraphQlWebMvcAutoConfiguration should apply customizers in order (also in v4.1.1)
- Micrometer registries pin the application context (also in v4.1.1)
- Context refresh fails when using Actuator on Jersey without spring-boot-health (also in v4.1.1)
- Context refresh fails on Cloud Foundry when using Actuator without spring-boot-health (also in v4.1.1)
- IllegalStateException when binding properties to a @Validated class that contains a map whose value type is a wildcard
- Setting 'server.servlet.session.cookie.partitioned' to false still emits the 'Partitioned' cookie attribute
- Application-managed JUL bridge handler should only be removed if installed (also in v4.1.1)
- Inconsistent handling of empty string values of spring.security.oauth2.resourceserver.jwt issuer-uri and jwk-set-uri
- PropertiesWebClientHttpServiceGroupConfigurer has highest precedence, preventing other configurers from being ordered ahead of it
- High number of connections due to Mongo health indicator
- NativeImageResourceProvider flattens Flyway migration paths in subdirectories (also in v4.1.1)
- Metadata annotation processor ignores getter-level @NestedConfigurationProperty for records (also in v4.1.1)

#### v4.1.1 (2026-08-20)

- Structured logging: a failed JSON encode corrupts the next log event written on the same thread
- Fix ordering of Kotlinx Serialization CodecCustomizer
- Auto-configured RedisMessageListenerContainer does not use virtual threads when spring.threads.virtual.enabled is true

#### v4.0.7 (2026-06-10)

- MailSender auto-configuration now enables hostname verification (also in v4.1.0)
- Artemis auto-configuration no longer uses a predictable default location for the embedded broker's data (also in v4.1.0)
- Fix NullPointerException in reactor-netty SniProvider and unmapped SSL bundle with RSocket
- SSL is no longer enabled when an SSL bundle is overridden to an empty string
- Docker Compose support now restores thread interrupt flag when catching InterruptedException
- RabbitProperties no longer enables SSL when spring.rabbitmq.ssl.bundle is overridden to an empty string
- Fix NullPointerException in reactor-netty SniProvider when SSL bundle uses client-auth or server truststore without server-name-bundles
- Test auto-configuration no longer integrates Spring Security with HtmlUnitDriver (also in v4.1.0)
- Layer written outside the output location exception is no longer thrown when using extract layers in root directory
- ConfigurationPropertiesReportEndpoint no longer exposes AOP proxy internals (also in v4.1.0)
- StackTracePrinter instances now have access to the Environment (also in v4.1.0)
- MappingsEndpoint now reports the correct parentId when a parent context exists
- Buildpack module now validates long-to-int casts
- GraphQL WebSocket support now configures allowed origins
- Configuration property metadata now includes correct class references
- Spring Boot Loader now supports RSA and EC signed jars (also in v4.1.0)
- Meter registries are now removed from the global registry when the context is closed
- EndpointRequest links matcher no longer unnecessarily matches HTTP methods other than GET
- Apply HTML escaping to timestamp attribute in Whitelabel error page
- Setting server.servlet.session.cookie.partitioned=true now has effect when using Tomcat

#### v4.1.0 (2026-06-10)

- Embedded LDAP SSL is not enabled when its bundle is empty
- InetAddressFilter.externalAddresses now excludes special purpose addresses from RFC 6890
- NullPointerException in reactor-netty SniProvider and unmapped SSL bundle with RSocket
- SSL is not enabled when a SSL bundle is overridden to an empty string
- Configuration property metadata no longer includes incorrect class references
- Docker Compose support restores thread interrupt flag when catching InterruptedException
- RabbitProperties does not enable SSL when spring.rabbitmq.ssl.bundle is overridden to an empty string
- NullPointerException in reactor-netty SniProvider when SSL bundle uses client-auth or server truststore without server-name-bundles
- Layer written outside the output location of '//' exception is no longer thrown when using extract layers in root directory
- MappingsEndpoint reports the correct parentId when a parent context exists
- Meter registries are removed from the global registry when the context is closed

#### v4.0.6 (2026-04-23)

- Default security is misconfigured when spring-boot-actuator-autoconfigure is present and spring-boot-health is not
- Elasticsearch Rest5Client auto-configuration misconfigures underlying HTTP client
- ApplicationPidFileWriter does not handle symlinks correctly
- RandomValuePropertySource is not suitable for secrets
- Cassandra auto-configuration misconfigures CqlSessionBuilder
- ApplicationTemp does not handle symlinks correctly
- Remote DevTools performs comparison incorrectly
- spring.rabbitmq.ssl.verify-hostname is applied inconsistently
- Whole number values are ignored when configuring min and max expected values and SLO boundaries for a distribution summary meter
- Classic starters are missing several modules
- Module spring-boot-resttestclient is missing from spring-boot-starter-test-classic
- Annotations like @Ssl don't work on @Bean methods when using @ServiceConnection
- EnversRevisionRepositoriesRegistrar should reuse @EnableEnversRepositories rather than configuring the JPA counterpart
- WebFlux Cloud Foundry links endpoint includes query string from received request in resolved links
- Imports on a containing test class are ignored when a nested class has imports
- With spring.jackson.use-jackson2-defaults set to true, FAIL_ON_UNKNOWN_PROPERTIES is enabled
- 500 response from env endpoint when supplied pattern is invalid
- Reactive MongoDB starter has a transitive dependency on the synchronous MongoDB driver
- HTTP method is lost when configuring excludes in EndpointRequest
- Honor HttpMethod for reactive additional endpoint paths

#### v4.0.5 (2026-03-26)

- Test starter for Spring Integration now includes Spring Integration test module
- Sliced tests that import TransactionAutoConfiguration now also import TransactionManagerCustomizationAutoConfiguration
- WebSocket messaging's task executors and stompWebSocketHandlerMapping are now auto-configured regardless of whether Jackson is present
- WebSocket app no longer fails to start when Jackson is on the classpath but there is no JsonMapper bean
- Metadata annotation processor now respects method-level @NestedConfigurationProperty when using constructor binding
- Property overrides in external application.properties or application.yaml are no longer ignored
- NativeImageResourceProvider now finds Flyway migration scripts in subdirectories
- NettyReactiveWebServerAutoConfiguration now includes @ConditionalOnWebApplication
- @GraphQlTest now includes @ControllerAdvice

### Deprecated

#### v4.1.0 (2026-06-10)

- SpringJtaPlatform is deprecated

## Release notes

### v4.0.8

- Date: 2026-08-21
- Version: v4.0.8
- Original notes: https://github.com/spring-projects/spring-boot/releases/tag/v4.0.8
- Permalink: https://whatsnew.fyi/product/spring-boot/releases/v4.0.8

- **fixed** — Kafka consumer-specific security protocol is not taken into account
- **fixed** — Temporary file is not deleted when ExportedImageTar construction fails
- **fixed** — spring-boot-h2-console pulls servlet-api as transitive dependency
- **fixed** — Methods that return the result of Map#remove are not declared with a @Nullable return type
- **fixed** — PropertiesLauncher does not log nested archive paths
- **fixed** — JarFile is not closed when finding main class from archive
- **fixed** — CloudFoundry reactive auto-configuration should not require a WebClient.Builder bean to be defined
- **fixed** — Resources are not cleaned up when resolving an image that is not yet present in the builder
- **fixed** — Context refresh fails on reactive Cloud Foundry when using Actuator without spring-boot-health
- **fixed** — GraphQlWebMvcAutoConfiguration should apply customizers in order
- **fixed** — Micrometer registries pin the application context
- **fixed** — Context refresh fails when using Actuator on Jersey without spring-boot-health
- **fixed** — Context refresh fails on Cloud Foundry when using Actuator without spring-boot-health
- **fixed** — IllegalStateException when binding properties to a @Validated class that contains a map whose value type is a wildcard
- **fixed** — Setting 'server.servlet.session.cookie.partitioned' to false still emits the 'Partitioned' cookie attribute
- **fixed** — Application-managed JUL bridge handler should only be removed if installed
- **fixed** — Inconsistent handling of empty string values of spring.security.oauth2.resourceserver.jwt issuer-uri and jwk-set-uri
- **fixed** — PropertiesWebClientHttpServiceGroupConfigurer has highest precedence, preventing other configurers from being ordered ahead of it
- **fixed** — High number of connections due to Mongo health indicator
- **fixed** — NativeImageResourceProvider flattens Flyway migration paths in subdirectories
- **fixed** — Metadata annotation processor ignores getter-level @NestedConfigurationProperty for records

##### :lady_beetle: Bug Fixes

- Kafka consumer-specific security protocol is not taken into account [#51365](https://github.com/spring-projects/spring-boot/issues/51365)
- Temporary file is not deleted when ExportedImageTar construction fails [#51117](https://github.com/spring-projects/spring-boot/pull/51117)
- spring-boot-h2-console pulls servlet-api as transitive dependency [#51094](https://github.com/spring-projects/spring-boot/issues/51094)
- Methods that return the result of Map#remove are not declared with a `@Nullable` return type [#50972](https://github.com/spring-projects/spring-boot/pull/50972)
- PropertiesLauncher does not log nested archive paths [#50968](https://github.com/spring-projects/spring-boot/pull/50968)
- JarFile is not closed when finding main class from archive [#50949](https://github.com/spring-projects/spring-boot/pull/50949)
- CloudFoundry reactive auto-configuration should not require a WebClient.Builder bean to be defined [#50928](https://github.com/spring-projects/spring-boot/issues/50928)
- Resources are not cleaned up when resolving an image that is not yet present in the builder [#50919](https://github.com/spring-projects/spring-boot/pull/50919)
- Context refresh fails on reactive Cloud Foundry when using Actuator without spring-boot-health [#50916](https://github.com/spring-projects/spring-boot/pull/50916)
- GraphQlWebMvcAutoConfiguration should apply customizers in order [#50908](https://github.com/spring-projects/spring-boot/pull/50908)
- Micrometer registries pin the application context [#50886](https://github.com/spring-projects/spring-boot/pull/50886)
- Context refresh fails when using Actuator on Jersey without spring-boot-health [#50858](https://github.com/spring-projects/spring-boot/pull/50858)
- Context refresh fails on Cloud Foundry when using Actuator without spring-boot-health [#50857](https://github.com/spring-projects/spring-boot/pull/50857)
- IllegalStateException when binding properties to a `@Validated` class that contains a map whose value type is a wildcard [#50798](https://github.com/spring-projects/spring-boot/pull/50798)
- Setting 'server.servlet.session.cookie.partitioned' to false still emits the 'Partitioned' cookie attribute [#50781](https://github.com/spring-projects/spring-boot/pull/50781)
- Application-managed JUL bridge handler should only be removed if installed [#50779](https://github.com/spring-projects/spring-boot/pull/50779)
- Inconsistent handling of empty string values of spring.security.oauth2.resourceserver.jwt issuer-uri and jwk-set-uri [#50755](https://github.com/spring-projects/spring-boot/pull/50755)
- PropertiesWebClientHttpServiceGroupConfigurer has highest precedence, preventing other configurers from being ordered ahead of it [#50737](https://github.com/spring-projects/spring-boot/pull/50737)
- High number of connections due to Mongo health indicator [#50734](https://github.com/spring-projects/spring-boot/pull/50734)
- Return type nullability of ApplicationContextAssert's getBean methods does not indicate that bean may be null [#50701](https://github.com/spring-projects/spring-boot/pull/50701)
- NativeImageResourceProvider flattens Flyway migration paths in subdirectories [#50433](https://github.com/spring-projects/spring-boot/pull/50433)
- Fix ordering of Kotlinx Serialization CodecCustomizer [#50428](https://github.com/spring-projects/spring-boot/pull/50428)
- Metadata annotation processor ignores getter-level `@NestedConfigurationProperty` for records [#50096](https://github.com/spring-projects/spring-boot/issues/50096)

##### :notebook_with_decorative_cover: Documentation

- spring.profiles.group should have a 'spring-profile-name' hint provider [#51273](https://github.com/spring-projects/spring-boot/issues/51273)
- Remove reference to removed InfluxDB auto-configuration [#51172](https://github.com/spring-projects/spring-boot/pull/51172)
- Use JacksonJsonSerde in Kafka Streams documentation [#51152](https://githu

_[Truncated at 4000 characters — full notes: https://github.com/spring-projects/spring-boot/releases/tag/v4.0.8]_

### v4.1.1

- Date: 2026-08-20
- Version: v4.1.1
- Original notes: https://github.com/spring-projects/spring-boot/releases/tag/v4.1.1
- Permalink: https://whatsnew.fyi/product/spring-boot/releases/v4.1.1

- **changed** — Spring Boot's Gradle plugin no longer automatically configures gRPC when the Protobuf plugin is applied; opt in by configuring the protobuf extension with the grpc plugin using an empty block
- **fixed** — Kafka consumer-specific security protocol is not taken into account
- **fixed** — Structured logging: a failed JSON encode corrupts the next log event written on the same thread
- **fixed** — Micrometer registries pin the application context
- **fixed** — Temporary file is not deleted when ExportedImageTar construction fails
- **fixed** — Metadata annotation processor ignores getter-level @NestedConfigurationProperty for records
- **fixed** — spring-boot-h2-console pulls servlet-api as transitive dependency
- **fixed** — PropertiesLauncher does not log nested archive paths
- **fixed** — Methods that return the result of Map#remove are not declared with a @Nullable return type
- **fixed** — NativeImageResourceProvider flattens Flyway migration paths in subdirectories
- **fixed** — Fix ordering of Kotlinx Serialization CodecCustomizer
- **fixed** — JarFile is not closed when finding main class from archive
- **fixed** — Application-managed JUL bridge handler should only be removed if installed
- **fixed** — CloudFoundry reactive auto-configuration should not require a WebClient.Builder bean to be defined
- **fixed** — Context refresh fails on reactive Cloud Foundry when using Actuator without spring-boot-health
- **fixed** — Resources are not cleaned up when resolving an image that is not yet present in the builder
- **fixed** — GraphQlWebMvcAutoConfiguration should apply customizers in order
- **fixed** — Auto-configured RedisMessageListenerContainer does not use virtual threads when spring.threads.virtual.enabled is true
- **fixed** — Context refresh fails when using Actuator on Jersey without spring-boot-health
- **fixed** — Context refresh fails on Cloud Foundry when using Actuator without spring-boot-health

##### :warning: Attention Required

- Spring Boot's Gradle plugin no longer automatically configures gRPC when the Protobuf plugin is applied. This behavior caused problems for those using Protobuf without gRPC. To opt in to the configuration of gRPC, configure the `protobuf` extension with the `grpc` plugin using an empty block. The Spring Boot Gradle plugin will then automatically configure the use of `protoc-gen-grpc-java` as before. [#50822](https://github.com/spring-projects/spring-boot/issues/50822)

##### :lady_beetle: Bug Fixes

- Kafka consumer-specific security protocol is not taken into account [#51369](https://github.com/spring-projects/spring-boot/issues/51369)
- Structured logging: a failed JSON encode corrupts the next log event written on the same thread [#51156](https://github.com/spring-projects/spring-boot/pull/51156)
- Micrometer registries pin the application context [#51135](https://github.com/spring-projects/spring-boot/issues/51135)
- Temporary file is not deleted when ExportedImageTar construction fails [#51132](https://github.com/spring-projects/spring-boot/issues/51132)
- Metadata annotation processor ignores getter-level `@NestedConfigurationProperty` for records [#51098](https://github.com/spring-projects/spring-boot/issues/51098)
- spring-boot-h2-console pulls servlet-api as transitive dependency [#51095](https://github.com/spring-projects/spring-boot/issues/51095)
- PropertiesLauncher does not log nested archive paths [#51089](https://github.com/spring-projects/spring-boot/issues/51089)
- Methods that return the result of Map#remove are not declared with a `@Nullable` return type [#51087](https://github.com/spring-projects/spring-boot/issues/51087)
- NativeImageResourceProvider flattens Flyway migration paths in subdirectories [#50964](https://github.com/spring-projects/spring-boot/issues/50964)
- Fix ordering of Kotlinx Serialization CodecCustomizer [#50961](https://github.com/spring-projects/spring-boot/issues/50961)
- JarFile is not closed when finding main class from archive [#50959](https://github.com/spring-projects/spring-boot/issues/50959)
- Application-managed JUL bridge handler should only be removed if installed [#50950](https://github.com/spring-projects/spring-boot/issues/50950)
- CloudFoundry reactive auto-configuration should not require a WebClient.Builder bean to be defined [#50944](https://github.com/spring-projects/spring-boot/issues/50944)
- Context refresh fails on reactive Cloud Foundry when using Actuator without spring-boot-health [#50942](https://github.com/spring-projects/spring-boot/issues/50942)
- Resources are not cleaned up when resolving an image that is not yet present in the builder [#50941](https://github.com/spring-projects/spring-boot/issues/50941)
- GraphQlWebMvcAutoConfiguration should apply customizers in order [#50914](https://github.com/spring-projects/spring-boot/issues/50914)
- Auto-configured RedisMessageListenerContainer does not use virtual threads when spring.threads.virtual.enabled is true [#50884](https://github.com/spring-projects/spring-boot/issues/50884)
- Context refresh fails when using Actuator on Jersey without spring-boot-health [#50872](https://github.com/spring-projects/spring-boot/issues/50872)
- Context refresh fails on Cloud Foundry when using Actuator without spring-boot-health [#50871](https://github.com/spring-projects/spring-boot/issues/50871)
- IllegalStateException when binding properties to a `@Validated` class that contains a map whose value type is a wildcard [#50856](https://github.com/spring-projects/spring-boot/issues/50856)
- High number of connections due to Mongo health indicator [#50852](https://github.com/spring-projects/spring-boot/issues/50852)
- Inconsistent handling of empty string values of spring.security.oauth2.resourceserver.jwt issuer-uri and jwk-set-uri [#50849](https://github.com/spring-projects/spring-boot/issues/50849)
- Return type nullability of ApplicationContextAssert's getB

_[Truncated at 4000 characters — full notes: https://github.com/spring-projects/spring-boot/releases/tag/v4.1.1]_

### v4.0.7

- Date: 2026-06-10
- Version: v4.0.7
- Original notes: https://github.com/spring-projects/spring-boot/releases/tag/v4.0.7
- Permalink: https://whatsnew.fyi/product/spring-boot/releases/v4.0.7

- **fixed** — MailSender auto-configuration now enables hostname verification
- **fixed** — Artemis auto-configuration no longer uses a predictable default location for the embedded broker's data
- **fixed** — Fix NullPointerException in reactor-netty SniProvider and unmapped SSL bundle with RSocket
- **fixed** — SSL is no longer enabled when an SSL bundle is overridden to an empty string
- **fixed** — Docker Compose support now restores thread interrupt flag when catching InterruptedException
- **fixed** — RabbitProperties no longer enables SSL when spring.rabbitmq.ssl.bundle is overridden to an empty string
- **fixed** — Fix NullPointerException in reactor-netty SniProvider when SSL bundle uses client-auth or server truststore without server-name-bundles
- **fixed** — Test auto-configuration no longer integrates Spring Security with HtmlUnitDriver
- **fixed** — Layer written outside the output location exception is no longer thrown when using extract layers in root directory
- **fixed** — ConfigurationPropertiesReportEndpoint no longer exposes AOP proxy internals
- **fixed** — StackTracePrinter instances now have access to the Environment
- **fixed** — MappingsEndpoint now reports the correct parentId when a parent context exists
- **fixed** — Buildpack module now validates long-to-int casts
- **fixed** — GraphQL WebSocket support now configures allowed origins
- **fixed** — Configuration property metadata now includes correct class references
- **fixed** — Spring Boot Loader now supports RSA and EC signed jars
- **fixed** — Meter registries are now removed from the global registry when the context is closed
- **fixed** — EndpointRequest links matcher no longer unnecessarily matches HTTP methods other than GET
- **fixed** — Apply HTML escaping to timestamp attribute in Whitelabel error page
- **fixed** — Setting server.servlet.session.cookie.partitioned=true now has effect when using Tomcat

##### :lady_beetle: Bug Fixes

- MailSender auto-configuration does not enable hostname verification [#50746](https://github.com/spring-projects/spring-boot/issues/50746)
- Artemis auto-configuration uses a predictable default location for the embedded broker's data [#50744](https://github.com/spring-projects/spring-boot/issues/50744)
- NullPointerException in reactor-netty SniProvider and unmapped SSL bundle with RSocket [#50640](https://github.com/spring-projects/spring-boot/pull/50640)
- SSL should not be enabled when a SSL bundle is overridden to an empty string [#50634](https://github.com/spring-projects/spring-boot/issues/50634)
- Docker Compose support does not restore thread interrupt flag when catching InterruptedException [#50617](https://github.com/spring-projects/spring-boot/issues/50617)
- RabbitProperties enables SSL even when spring.rabbitmq.ssl.bundle is overridden to an empty string [#50611](https://github.com/spring-projects/spring-boot/issues/50611)
- NullPointerException in reactor-netty SniProvider when SSL bundle uses client-auth or server truststore without server-name-bundles [#50609](https://github.com/spring-projects/spring-boot/issues/50609)
- Test auto-configuration no longer integrates Spring Security with HtmlUnitDriver [#50602](https://github.com/spring-projects/spring-boot/pull/50602)
- Layer written outside the output location of '//' exception is thrown when using extract layers in root directory [#50509](https://github.com/spring-projects/spring-boot/issues/50509)
- ConfigurationPropertiesReportEndpoint exposes AOP proxy internals [#50416](https://github.com/spring-projects/spring-boot/issues/50416)
- Created StackTracePrinter instances have no access to the Environment [#50413](https://github.com/spring-projects/spring-boot/issues/50413)
- MappingsEndpoint reports the context's own ID as parentId when a parent exists [#50411](https://github.com/spring-projects/spring-boot/issues/50411)
- Buildpack module does not validate long-to-int casts [#50409](https://github.com/spring-projects/spring-boot/issues/50409)
- GraphQL WebSocket support does not configure allowed origins [#50393](https://github.com/spring-projects/spring-boot/issues/50393)
- Configuration property metadata includes incorrect class references [#50375](https://github.com/spring-projects/spring-boot/pull/50375)
- Spring Boot Loader Does Not Support RSA and EC Signed Jars [#50297](https://github.com/spring-projects/spring-boot/issues/50297)
- Meter registries are not removed from the global registry when the context is closed [#50286](https://github.com/spring-projects/spring-boot/issues/50286)
- Nullable annotations from AbstractErrorController.getErrorAttributes are not aligned with implementation [#50265](https://github.com/spring-projects/spring-boot/pull/50265)
- EndpointRequest links matcher unnecessarily matches HTTP methods other than GET  [#50260](https://github.com/spring-projects/spring-boot/issues/50260)
- Actuator's '/cloudfoundryapplication' endpoint does not work if restrictive CORS configuration is provided using a bean named corsConfigurationSource [#50257](https://github.com/spring-projects/spring-boot/issues/50257)
- ThreadPoolTaskScheduleBuilder unnecessarily loses precision when configuring await termination time [#50233](https://github.com/spring-projects/spring-boot/issues/50233)
- NimbusJwtDecoder silently accepts unknown values for spring.security.oauth2.resourceserver.jwt.jws-algorithms [#50227](https://github.com/spring-projects/spring-boot/issues/50227)
- Apply HTML escaping to timestamp attribute in Whitelabel error page [#50215](https://github.com/spring-projects/spring-boot/issues/50215)
- Setting server.servlet.session.cookie.partitioned=true has no effect when using Tomcat [#50201](https://github.com/spring-projects/spring-boot/issues/50201)

##### :notebook_with_decorative_cover: Documentation

- Fix reference to Gradle documentation for module replacement [#50646](https://github.com/spring-proje

_[Truncated at 4000 characters — full notes: https://github.com/spring-projects/spring-boot/releases/tag/v4.0.7]_

### v4.1.0

- Date: 2026-06-10
- Version: v4.1.0
- Original notes: https://github.com/spring-projects/spring-boot/releases/tag/v4.1.0
- Permalink: https://whatsnew.fyi/product/spring-boot/releases/v4.1.0

- **added** — Add public constructor to InvalidConfigurationPropertyValueException that accepts a cause
- **changed** — Reduce memory consumption when repeatedly calling WritableJson.toByteArray
- **fixed** — MailSender auto-configuration now enables hostname verification
- **fixed** — Artemis auto-configuration no longer uses a predictable default location for the embedded broker's data
- **fixed** — Embedded LDAP SSL is not enabled when its bundle is empty
- **fixed** — InetAddressFilter.externalAddresses now excludes special purpose addresses from RFC 6890
- **fixed** — NullPointerException in reactor-netty SniProvider and unmapped SSL bundle with RSocket
- **fixed** — SSL is not enabled when a SSL bundle is overridden to an empty string
- **fixed** — Test auto-configuration no longer integrates Spring Security with HtmlUnitDriver
- **fixed** — Configuration property metadata no longer includes incorrect class references
- **fixed** — Docker Compose support restores thread interrupt flag when catching InterruptedException
- **fixed** — RabbitProperties does not enable SSL when spring.rabbitmq.ssl.bundle is overridden to an empty string
- **fixed** — NullPointerException in reactor-netty SniProvider when SSL bundle uses client-auth or server truststore without server-name-bundles
- **deprecated** — SpringJtaPlatform is deprecated
- **fixed** — Layer written outside the output location of '//' exception is no longer thrown when using extract layers in root directory
- **fixed** — ConfigurationPropertiesReportEndpoint no longer exposes AOP proxy internals
- **fixed** — StackTracePrinter instances now have access to the Environment
- **fixed** — MappingsEndpoint reports the correct parentId when a parent context exists
- **fixed** — Spring Boot Loader now supports RSA and EC signed JARs
- **fixed** — Meter registries are removed from the global registry when the context is closed

Full [release notes for Spring Boot 4.1](https://github.com/spring-projects/spring-boot/wiki/Spring-Boot-4.1-Release-Notes) are available on the wiki.

##### :star: New Features

- Add public constructor to InvalidConfigurationPropertyValueException that accepts a cause [#50211](https://github.com/spring-projects/spring-boot/issues/50211)
- Reduce memory consumption when repeatedly calling WritableJson.toByteArray [#49428](https://github.com/spring-projects/spring-boot/issues/49428)

##### :lady_beetle: Bug Fixes

- MailSender auto-configuration does not enable hostname verification [#50747](https://github.com/spring-projects/spring-boot/issues/50747)
- Artemis auto-configuration uses a predictable default location for the embedded broker's data [#50745](https://github.com/spring-projects/spring-boot/issues/50745)
- Embedded LDAP SSL should not be enabled when its bundle is empty [#50700](https://github.com/spring-projects/spring-boot/pull/50700)
- InetAddressFilter.externalAddresses does not exclude special purpose addresses from RFC 6890 [#50668](https://github.com/spring-projects/spring-boot/issues/50668)
- NullPointerException in reactor-netty SniProvider and unmapped SSL bundle with RSocket [#50645](https://github.com/spring-projects/spring-boot/issues/50645)
- SSL should not be enabled when a SSL bundle is overridden to an empty string [#50635](https://github.com/spring-projects/spring-boot/issues/50635)
- Test auto-configuration no longer integrates Spring Security with HtmlUnitDriver [#50633](https://github.com/spring-projects/spring-boot/issues/50633)
- Configuration property metadata includes incorrect class references [#50632](https://github.com/spring-projects/spring-boot/issues/50632)
- Docker Compose support does not restore thread interrupt flag when catching InterruptedException [#50618](https://github.com/spring-projects/spring-boot/issues/50618)
- RabbitProperties enables SSL even when spring.rabbitmq.ssl.bundle is overridden to an empty string [#50612](https://github.com/spring-projects/spring-boot/issues/50612)
- NullPointerException in reactor-netty SniProvider when SSL bundle uses client-auth or server truststore without server-name-bundles [#50610](https://github.com/spring-projects/spring-boot/issues/50610)
- SpringJtaPlatform should have been deprecated since 4.1.0-M3 [#50592](https://github.com/spring-projects/spring-boot/issues/50592)
- Layer written outside the output location of '//' exception is thrown when using extract layers in root directory [#50510](https://github.com/spring-projects/spring-boot/issues/50510)
- ConfigurationPropertiesReportEndpoint exposes AOP proxy internals [#50417](https://github.com/spring-projects/spring-boot/issues/50417)
- Created StackTracePrinter instances have no access to the Environment [#50414](https://github.com/spring-projects/spring-boot/issues/50414)
- MappingsEndpoint reports the context's own ID as parentId when a parent exists [#50412](https://github.com/spring-projects/spring-boot/issues/50412)
- Buildpack module does not validate long-to-int casts [#50410](https://github.com/spring-projects/spring-boot/issues/50410)
- Gradle gRPC support fails if protobuf-java dependency is used instead of protobuf-java-util [#50405](https://github.com/spring-projects/spring-boot/pull/50405)
- GraphQL WebSocket support does not configure allowed origins [#50394](https://github.com/spring-projects/spring-boot/issues/50394)
- Spring Boot Loader Does Not Support RSA and EC Signed Jars [#50298](https://github.com/spring-projects/spring-boot/issues/50298)
- Meter registries are not removed from the global registry when the context is closed [#50287](https://github.com/spring-projects/spring-boot/issues/50287)
-  DataSourceBuilder cannot derive a DataSource from a lazy connection proxy [#50271](https://github.com/spring-projects/spring-boot/pull/50271)
- Nullable annotations from AbstractErrorController.getErrorAttributes are not aligned with imp

_[Truncated at 4000 characters — full notes: https://github.com/spring-projects/spring-boot/releases/tag/v4.1.0]_

### v4.0.6

- Date: 2026-04-23
- Version: v4.0.6
- Original notes: https://github.com/spring-projects/spring-boot/releases/tag/v4.0.6
- Permalink: https://whatsnew.fyi/product/spring-boot/releases/v4.0.6

- **fixed** — Default security is misconfigured when spring-boot-actuator-autoconfigure is present and spring-boot-health is not
- **fixed** — Elasticsearch Rest5Client auto-configuration misconfigures underlying HTTP client
- **fixed** — ApplicationPidFileWriter does not handle symlinks correctly
- **fixed** — RandomValuePropertySource is not suitable for secrets
- **fixed** — Cassandra auto-configuration misconfigures CqlSessionBuilder
- **fixed** — ApplicationTemp does not handle symlinks correctly
- **fixed** — Remote DevTools performs comparison incorrectly
- **fixed** — spring.rabbitmq.ssl.verify-hostname is applied inconsistently
- **fixed** — Whole number values are ignored when configuring min and max expected values and SLO boundaries for a distribution summary meter
- **fixed** — Classic starters are missing several modules
- **fixed** — Module spring-boot-resttestclient is missing from spring-boot-starter-test-classic
- **fixed** — Annotations like @Ssl don't work on @Bean methods when using @ServiceConnection
- **fixed** — EnversRevisionRepositoriesRegistrar should reuse @EnableEnversRepositories rather than configuring the JPA counterpart
- **fixed** — WebFlux Cloud Foundry links endpoint includes query string from received request in resolved links
- **fixed** — Imports on a containing test class are ignored when a nested class has imports
- **fixed** — With spring.jackson.use-jackson2-defaults set to true, FAIL_ON_UNKNOWN_PROPERTIES is enabled
- **fixed** — 500 response from env endpoint when supplied pattern is invalid
- **fixed** — Reactive MongoDB starter has a transitive dependency on the synchronous MongoDB driver
- **fixed** — HTTP method is lost when configuring excludes in EndpointRequest
- **fixed** — Honor HttpMethod for reactive additional endpoint paths

##### :lady_beetle: Bug Fixes

- Default security is misconfigured when spring-boot-actuator-autoconfigure is present and spring-boot-health is not [#50188](https://github.com/spring-projects/spring-boot/issues/50188)
- Elasticsearch Rest5Client auto-configuration misconfigures underlying HTTP client [#50187](https://github.com/spring-projects/spring-boot/issues/50187)
- ApplicationPidFileWriter does not handle symlinks correctly [#50185](https://github.com/spring-projects/spring-boot/issues/50185)
- RandomValuePropertySource is not suitable for secrets [#50183](https://github.com/spring-projects/spring-boot/issues/50183)
- Cassandra auto-configuration misconfigures CqlSessionBuilder [#50180](https://github.com/spring-projects/spring-boot/issues/50180)
- ApplicationTemp does not handle symlinks correctly [#50178](https://github.com/spring-projects/spring-boot/issues/50178)
- Remote DevTools performs comparison incorrectly [#50176](https://github.com/spring-projects/spring-boot/issues/50176)
- spring.rabbitmq.ssl.verify-hostname is applied inconsistently [#50174](https://github.com/spring-projects/spring-boot/issues/50174)
- Whole number values are ignored when configuring min and max expected values and SLO boundaries for a distribution summary meter [#50077](https://github.com/spring-projects/spring-boot/issues/50077)
- Classic starters are missing several modules [#50071](https://github.com/spring-projects/spring-boot/issues/50071)
- Module spring-boot-resttestclient is missing from spring-boot-starter-test-classic [#50069](https://github.com/spring-projects/spring-boot/pull/50069)
- Annotations like `@Ssl` don't work on `@Bean` methods when using `@ServiceConnection` [#50064](https://github.com/spring-projects/spring-boot/issues/50064)
- EnversRevisionRepositoriesRegistrar should reuse `@EnableEnversRepositories` rather than configuring the JPA counterpart [#50039](https://github.com/spring-projects/spring-boot/issues/50039)
- WebFlux Cloud Foundry links endpoint includes query string from received request in resolved links [#50017](https://github.com/spring-projects/spring-boot/issues/50017)
- Imports on a containing test class are ignored when a nested class has imports [#50012](https://github.com/spring-projects/spring-boot/issues/50012)
- With spring.jackson.use-jackson2-defaults set to true, FAIL\_ON\_UNKNOWN\_PROPERTIES is enabled [#49951](https://github.com/spring-projects/spring-boot/issues/49951)
- 500 response from env endpoint when supplied pattern is invalid [#49946](https://github.com/spring-projects/spring-boot/issues/49946)
- Reactive MongoDB starter has a transitive dependency on the synchronous MongoDB driver [#49945](https://github.com/spring-projects/spring-boot/issues/49945)
- HTTP method is lost when configuring excludes in EndpointRequest [#49943](https://github.com/spring-projects/spring-boot/issues/49943)
- Honor HttpMethod for reactive additional endpoint paths [#49880](https://github.com/spring-projects/spring-boot/issues/49880)
- Docker Compose support doesn't work with apache/artemis image [#49869](https://github.com/spring-projects/spring-boot/issues/49869)
- Docker Compose support doesn't work with apache/activemq image [#49866](https://github.com/spring-projects/spring-boot/issues/49866)
- Spring Security's PathPatternRequestMatcher.Builder is not auto-configured when using WebMvcTest and spring-boot-security-test [#49854](https://github.com/spring-projects/spring-boot/issues/49854)
- API versioning path strategy should be applied path last as it is not meant to yield [#49800](https://github.com/spring-projects/spring-boot/issues/49800)

##### :notebook_with_decorative_cover: Documentation

- Update docs to encourage Java fundamentals for beginners that prefer to learn that way [#50146](https://github.com/spring-projects/spring-boot/issues/50146)
- HTTP Service Interface Clients still document that API versioning can be configured via properties [#50126](https://g

_[Truncated at 4000 characters — full notes: https://github.com/spring-projects/spring-boot/releases/tag/v4.0.6]_

### v4.0.5

- Date: 2026-03-26
- Version: v4.0.5
- Original notes: https://github.com/spring-projects/spring-boot/releases/tag/v4.0.5
- Permalink: https://whatsnew.fyi/product/spring-boot/releases/v4.0.5

- **fixed** — Test starter for Spring Integration now includes Spring Integration test module
- **fixed** — Sliced tests that import TransactionAutoConfiguration now also import TransactionManagerCustomizationAutoConfiguration
- **fixed** — WebSocket messaging's task executors and stompWebSocketHandlerMapping are now auto-configured regardless of whether Jackson is present
- **fixed** — WebSocket app no longer fails to start when Jackson is on the classpath but there is no JsonMapper bean
- **fixed** — Metadata annotation processor now respects method-level @NestedConfigurationProperty when using constructor binding
- **fixed** — Property overrides in external application.properties or application.yaml are no longer ignored
- **fixed** — NativeImageResourceProvider now finds Flyway migration scripts in subdirectories
- **fixed** — NettyReactiveWebServerAutoConfiguration now includes @ConditionalOnWebApplication
- **fixed** — @GraphQlTest now includes @ControllerAdvice

##### :lady_beetle: Bug Fixes

- Test starter for Spring Integration does not include Spring Integration test module [#49784](https://github.com/spring-projects/spring-boot/issues/49784)
- Some sliced tests that import TransactionAutoConfiguration do not import TransactionManagerCustomizationAutoConfiguration [#49782](https://github.com/spring-projects/spring-boot/issues/49782)
- WebSocket messaging's task executors are only auto-configured and stompWebSocketHandlerMapping is only forced to be eager when using Jackson [#49753](https://github.com/spring-projects/spring-boot/issues/49753)
- WebSocket app fails to start when Jackson is on the classpath but there's no JsonMapper bean [#49749](https://github.com/spring-projects/spring-boot/issues/49749)
- Metadata annotation processor ignores method-level `@NestedConfigurationProperty` when using constructor binding [#49738](https://github.com/spring-projects/spring-boot/issues/49738)
- Override of property in external 'application.properties' or 'application.yaml' is ignored [#49731](https://github.com/spring-projects/spring-boot/issues/49731)
- NativeImageResourceProvider does not find Flyway migration scripts in subdirectories [#49706](https://github.com/spring-projects/spring-boot/issues/49706)
- Add `@ConditionalOnWebApplication` to NettyReactiveWebServerAutoConfiguration [#49695](https://github.com/spring-projects/spring-boot/pull/49695)
- `@GraphQlTest` does not include `@ControllerAdvice` [#49672](https://github.com/spring-projects/spring-boot/issues/49672)

##### :notebook_with_decorative_cover: Documentation

- Fix incorrect indefinite articles in Javadoc [#49727](https://github.com/spring-projects/spring-boot/issues/49727)
- Add some more Kotlin examples and trivial style fixes [#49714](https://github.com/spring-projects/spring-boot/issues/49714)
- Overhaul Spring Session documentation following modularization [#49704](https://github.com/spring-projects/spring-boot/issues/49704)

##### :hammer: Dependency Upgrades

- Upgrade to Brave 6.3.1 [#49763](https://github.com/spring-projects/spring-boot/issues/49763)
- Upgrade to Jackson 2 Bom 2.21.2 [#49764](https://github.com/spring-projects/spring-boot/issues/49764)
- Upgrade to jOOQ 3.19.31 [#49765](https://github.com/spring-projects/spring-boot/issues/49765)
- Upgrade to Netty 4.2.12.Final [#49794](https://github.com/spring-projects/spring-boot/issues/49794)
- Upgrade to Tomcat 11.0.20 [#49767](https://github.com/spring-projects/spring-boot/issues/49767)
- Upgrade to Zipkin Reporter 3.5.3 [#49762](https://github.com/spring-projects/spring-boot/issues/49762)

##### :heart: Contributors

Thank you to all the contributors who worked on this release:

@Joowon-Seo, @deejay1, @dlwldnjs1009, @kwondh5217, @ljrmorgan, and @quaff