# Spring Boot changelog

> Stand-alone, production-grade Spring applications.

- Vendor: Broadcom
- Category: Frameworks & Libraries
- Official site: https://spring.io/projects/spring-boot
- Tracked by: What's New (https://whatsnew.fyi/product/spring-boot)
- Harvested from: GitHub (spring-projects/spring-boot)
- Entries below: 10 (newest first)

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

## Releases

### v3.5.16

- Date: 2026-06-25
- Version: v3.5.16
- Original notes: https://github.com/spring-projects/spring-boot/releases/tag/v3.5.16
- Permalink: https://whatsnew.fyi/product/spring-boot/releases/v3.5.16

- **changed** — Upgrade to Spring AMQP 3.2.12
- **changed** — Upgrade to Spring Data Bom 2025.0.13
- **changed** — Upgrade to Spring Integration 6.5.10

##### :hammer: Dependency Upgrades

- Upgrade to [Spring AMQP 3.2.12](https://github.com/spring-projects/spring-amqp/releases/tag/v3.2.12) [#50818](https://github.com/spring-projects/spring-boot/issues/50818)
- Upgrade to [Spring Data Bom 2025.0.13](https://github.com/spring-projects/spring-data-bom/releases/tag/2025.0.13) [#50819](https://github.com/spring-projects/spring-boot/issues/50819)
- Upgrade to [Spring Integration 6.5.10](https://github.com/spring-projects/spring-integration/releases/tag/v6.5.10) [#50820](https://github.com/spring-projects/spring-boot/issues/50820)

### v3.5.15

- Date: 2026-06-10
- Version: v3.5.15
- Original notes: https://github.com/spring-projects/spring-boot/releases/tag/v3.5.15
- Permalink: https://whatsnew.fyi/product/spring-boot/releases/v3.5.15

- **fixed** — Artemis auto-configuration uses a predictable default location for the embedded broker's data
- **fixed** — MailSender auto-configuration does not enable hostname verification
- **fixed** — SSL should not be enabled when a SSL bundle is overridden to an empty string
- **fixed** — Layer written outside the output location of '//' exception is thrown when using extract layers in root directory
- **fixed** — Docker Compose support does not restore thread interrupt flag when catching InterruptedException
- **fixed** — RabbitProperties enables SSL even when spring.rabbitmq.ssl.bundle is overridden to an empty string
- **fixed** — GraphQL WebSocket support does not configure allowed origins
- **fixed** — Buildpack module does not validate long-to-int casts
- **fixed** — MappingsEndpoint reports the context's own ID as parentId when a parent exists
- **fixed** — Created StackTracePrinter instances have no access to the Environment
- **fixed** — NullPointerException in reactor-netty SniProvider when SSL bundle uses client-auth or server truststore without server-name-bundles
- **fixed** — Spring Boot Loader does not support RSA and EC signed jars
- **fixed** — ConfigurationPropertiesReportEndpoint exposes AOP proxy internals
- **fixed** — Actuator's '/cloudfoundryapplication' endpoint does not work if restrictive CORS configuration is provided using a bean named corsConfigurationSource
- **fixed** — Meter registries are not removed from the global registry when the context is closed
- **fixed** — ThreadPoolTaskScheduleBuilder unnecessarily loses precision when configuring await termination time
- **fixed** — Apply HTML escaping to timestamp attribute in Whitelabel error page
- **fixed** — NimbusJwtDecoder silently accepts unknown values for spring.security.oauth2.resourceserver.jwt.jws-algorithms
- **fixed** — EndpointRequest links matcher unnecessarily matches HTTP methods other than GET

##### :lady_beetle: Bug Fixes

- Artemis auto-configuration uses a predictable default location for the embedded broker's data [#50743](https://github.com/spring-projects/spring-boot/issues/50743)
- MailSender auto-configuration does not enable hostname verification [#50742](https://github.com/spring-projects/spring-boot/issues/50742)
- SSL should not be enabled when a SSL bundle is overridden to an empty string [#50624](https://github.com/spring-projects/spring-boot/pull/50624)
- Layer written outside the output location of '//' exception is thrown when using extract layers in root directory [#50501](https://github.com/spring-projects/spring-boot/pull/50501)
- Docker Compose support does not restore thread interrupt flag when catching InterruptedException [#50451](https://github.com/spring-projects/spring-boot/pull/50451)
- RabbitProperties enables SSL even when spring.rabbitmq.ssl.bundle is overridden to an empty string [#50429](https://github.com/spring-projects/spring-boot/pull/50429)
- GraphQL WebSocket support does not configure allowed origins [#50391](https://github.com/spring-projects/spring-boot/issues/50391)
- Buildpack module does not validate long-to-int casts [#50382](https://github.com/spring-projects/spring-boot/pull/50382)
- MappingsEndpoint reports the context's own ID as parentId when a parent exists [#50373](https://github.com/spring-projects/spring-boot/pull/50373)
- Created StackTracePrinter instances have no access to the Environment [#50303](https://github.com/spring-projects/spring-boot/pull/50303)
- NullPointerException in reactor-netty SniProvider when SSL bundle uses client-auth or server truststore without server-name-bundles [#50301](https://github.com/spring-projects/spring-boot/pull/50301)
- Spring Boot Loader Does Not Support RSA and EC Signed Jars [#50292](https://github.com/spring-projects/spring-boot/issues/50292)
- ConfigurationPropertiesReportEndpoint exposes AOP proxy internals [#50273](https://github.com/spring-projects/spring-boot/pull/50273)
- Actuator's '/cloudfoundryapplication' endpoint does not work if restrictive CORS configuration is provided using a bean named corsConfigurationSource [#50254](https://github.com/spring-projects/spring-boot/issues/50254)
- Meter registries are not removed from the global registry when the context is closed [#50235](https://github.com/spring-projects/spring-boot/pull/50235)
- ThreadPoolTaskScheduleBuilder unnecessarily loses precision when configuring await termination time [#50225](https://github.com/spring-projects/spring-boot/pull/50225)
- Apply HTML escaping to timestamp attribute in Whitelabel error page [#50205](https://github.com/spring-projects/spring-boot/pull/50205)
- NimbusJwtDecoder silently accepts unknown values for spring.security.oauth2.resourceserver.jwt.jws-algorithms [#50118](https://github.com/spring-projects/spring-boot/pull/50118)
- EndpointRequest links matcher unnecessarily matches HTTP methods other than GET  [#50095](https://github.com/spring-projects/spring-boot/pull/50095)

##### :notebook_with_decorative_cover: Documentation

- Fix reference to Gradle documentation for module replacement [#50641](https://github.com/spring-projects/spring-boot/pull/50641)
- Remove the use of Optional from Data Neo4j repository examples [#50600](https://github.com/spring-projects/spring-boot/pull/50600)
- Fix typos in documentation [#50593](https://github.com/spring-projects/spring-boot/pull/50593)
- Document Java 25 requirement for AOT cache [#50482](https://github.com/spring-projects/spring-boot/pull/50482)
- Clarify dependency requirement for Bean Validation support [#50290](https://github.com/spring-projects/spring-boot/pull/50290)
- Document SSL reloading with Let's Encrypt [#50222](https://github.com/spring-projects/spring-boot/pull/50222)
- Polish InvalidConfigurationPropertyValueException constructor javadoc [#50212](https://github.com/spring-projects/spring-boot/issues/50212)
- Document known testcontainers lifecycle issues  [#50

_[Truncated at 4000 characters — full notes: https://github.com/spring-projects/spring-boot/releases/tag/v3.5.15]_

### v4.0.7

- Date: 2026-06-10
- Version: v4.0.7
- Original notes: https://github.com/spring-projects/spring-boot/releases/tag/v4.0.7
- Permalink: https://whatsnew.fyi/product/spring-boot/releases/v4.0.7

- **fixed** — MailSender auto-configuration now enables hostname verification
- **fixed** — Artemis auto-configuration no longer uses a predictable default location for the embedded broker's data
- **fixed** — Fix NullPointerException in reactor-netty SniProvider and unmapped SSL bundle with RSocket
- **fixed** — SSL is no longer enabled when an SSL bundle is overridden to an empty string
- **fixed** — Docker Compose support now restores thread interrupt flag when catching InterruptedException
- **fixed** — RabbitProperties no longer enables SSL when spring.rabbitmq.ssl.bundle is overridden to an empty string
- **fixed** — Fix NullPointerException in reactor-netty SniProvider when SSL bundle uses client-auth or server truststore without server-name-bundles
- **fixed** — Test auto-configuration no longer integrates Spring Security with HtmlUnitDriver
- **fixed** — Layer written outside the output location exception is no longer thrown when using extract layers in root directory
- **fixed** — ConfigurationPropertiesReportEndpoint no longer exposes AOP proxy internals
- **fixed** — StackTracePrinter instances now have access to the Environment
- **fixed** — MappingsEndpoint now reports the correct parentId when a parent context exists
- **fixed** — Buildpack module now validates long-to-int casts
- **fixed** — GraphQL WebSocket support now configures allowed origins
- **fixed** — Configuration property metadata now includes correct class references
- **fixed** — Spring Boot Loader now supports RSA and EC signed jars
- **fixed** — Meter registries are now removed from the global registry when the context is closed
- **fixed** — EndpointRequest links matcher no longer unnecessarily matches HTTP methods other than GET
- **fixed** — Apply HTML escaping to timestamp attribute in Whitelabel error page
- **fixed** — Setting server.servlet.session.cookie.partitioned=true now has effect when using Tomcat

##### :lady_beetle: Bug Fixes

- MailSender auto-configuration does not enable hostname verification [#50746](https://github.com/spring-projects/spring-boot/issues/50746)
- Artemis auto-configuration uses a predictable default location for the embedded broker's data [#50744](https://github.com/spring-projects/spring-boot/issues/50744)
- NullPointerException in reactor-netty SniProvider and unmapped SSL bundle with RSocket [#50640](https://github.com/spring-projects/spring-boot/pull/50640)
- SSL should not be enabled when a SSL bundle is overridden to an empty string [#50634](https://github.com/spring-projects/spring-boot/issues/50634)
- Docker Compose support does not restore thread interrupt flag when catching InterruptedException [#50617](https://github.com/spring-projects/spring-boot/issues/50617)
- RabbitProperties enables SSL even when spring.rabbitmq.ssl.bundle is overridden to an empty string [#50611](https://github.com/spring-projects/spring-boot/issues/50611)
- NullPointerException in reactor-netty SniProvider when SSL bundle uses client-auth or server truststore without server-name-bundles [#50609](https://github.com/spring-projects/spring-boot/issues/50609)
- Test auto-configuration no longer integrates Spring Security with HtmlUnitDriver [#50602](https://github.com/spring-projects/spring-boot/pull/50602)
- Layer written outside the output location of '//' exception is thrown when using extract layers in root directory [#50509](https://github.com/spring-projects/spring-boot/issues/50509)
- ConfigurationPropertiesReportEndpoint exposes AOP proxy internals [#50416](https://github.com/spring-projects/spring-boot/issues/50416)
- Created StackTracePrinter instances have no access to the Environment [#50413](https://github.com/spring-projects/spring-boot/issues/50413)
- MappingsEndpoint reports the context's own ID as parentId when a parent exists [#50411](https://github.com/spring-projects/spring-boot/issues/50411)
- Buildpack module does not validate long-to-int casts [#50409](https://github.com/spring-projects/spring-boot/issues/50409)
- GraphQL WebSocket support does not configure allowed origins [#50393](https://github.com/spring-projects/spring-boot/issues/50393)
- Configuration property metadata includes incorrect class references [#50375](https://github.com/spring-projects/spring-boot/pull/50375)
- Spring Boot Loader Does Not Support RSA and EC Signed Jars [#50297](https://github.com/spring-projects/spring-boot/issues/50297)
- Meter registries are not removed from the global registry when the context is closed [#50286](https://github.com/spring-projects/spring-boot/issues/50286)
- Nullable annotations from AbstractErrorController.getErrorAttributes are not aligned with implementation [#50265](https://github.com/spring-projects/spring-boot/pull/50265)
- EndpointRequest links matcher unnecessarily matches HTTP methods other than GET  [#50260](https://github.com/spring-projects/spring-boot/issues/50260)
- Actuator's '/cloudfoundryapplication' endpoint does not work if restrictive CORS configuration is provided using a bean named corsConfigurationSource [#50257](https://github.com/spring-projects/spring-boot/issues/50257)
- ThreadPoolTaskScheduleBuilder unnecessarily loses precision when configuring await termination time [#50233](https://github.com/spring-projects/spring-boot/issues/50233)
- NimbusJwtDecoder silently accepts unknown values for spring.security.oauth2.resourceserver.jwt.jws-algorithms [#50227](https://github.com/spring-projects/spring-boot/issues/50227)
- Apply HTML escaping to timestamp attribute in Whitelabel error page [#50215](https://github.com/spring-projects/spring-boot/issues/50215)
- Setting server.servlet.session.cookie.partitioned=true has no effect when using Tomcat [#50201](https://github.com/spring-projects/spring-boot/issues/50201)

##### :notebook_with_decorative_cover: Documentation

- Fix reference to Gradle documentation for module replacement [#50646](https://github.com/spring-proje

_[Truncated at 4000 characters — full notes: https://github.com/spring-projects/spring-boot/releases/tag/v4.0.7]_

### v4.1.0

- Date: 2026-06-10
- Version: v4.1.0
- Original notes: https://github.com/spring-projects/spring-boot/releases/tag/v4.1.0
- Permalink: https://whatsnew.fyi/product/spring-boot/releases/v4.1.0

- **added** — Add public constructor to InvalidConfigurationPropertyValueException that accepts a cause
- **changed** — Reduce memory consumption when repeatedly calling WritableJson.toByteArray
- **fixed** — MailSender auto-configuration now enables hostname verification
- **fixed** — Artemis auto-configuration no longer uses a predictable default location for the embedded broker's data
- **fixed** — Embedded LDAP SSL is not enabled when its bundle is empty
- **fixed** — InetAddressFilter.externalAddresses now excludes special purpose addresses from RFC 6890
- **fixed** — NullPointerException in reactor-netty SniProvider and unmapped SSL bundle with RSocket
- **fixed** — SSL is not enabled when a SSL bundle is overridden to an empty string
- **fixed** — Test auto-configuration no longer integrates Spring Security with HtmlUnitDriver
- **fixed** — Configuration property metadata no longer includes incorrect class references
- **fixed** — Docker Compose support restores thread interrupt flag when catching InterruptedException
- **fixed** — RabbitProperties does not enable SSL when spring.rabbitmq.ssl.bundle is overridden to an empty string
- **fixed** — NullPointerException in reactor-netty SniProvider when SSL bundle uses client-auth or server truststore without server-name-bundles
- **deprecated** — SpringJtaPlatform is deprecated
- **fixed** — Layer written outside the output location of '//' exception is no longer thrown when using extract layers in root directory
- **fixed** — ConfigurationPropertiesReportEndpoint no longer exposes AOP proxy internals
- **fixed** — StackTracePrinter instances now have access to the Environment
- **fixed** — MappingsEndpoint reports the correct parentId when a parent context exists
- **fixed** — Spring Boot Loader now supports RSA and EC signed JARs
- **fixed** — Meter registries are removed from the global registry when the context is closed

Full [release notes for Spring Boot 4.1](https://github.com/spring-projects/spring-boot/wiki/Spring-Boot-4.1-Release-Notes) are available on the wiki.

##### :star: New Features

- Add public constructor to InvalidConfigurationPropertyValueException that accepts a cause [#50211](https://github.com/spring-projects/spring-boot/issues/50211)
- Reduce memory consumption when repeatedly calling WritableJson.toByteArray [#49428](https://github.com/spring-projects/spring-boot/issues/49428)

##### :lady_beetle: Bug Fixes

- MailSender auto-configuration does not enable hostname verification [#50747](https://github.com/spring-projects/spring-boot/issues/50747)
- Artemis auto-configuration uses a predictable default location for the embedded broker's data [#50745](https://github.com/spring-projects/spring-boot/issues/50745)
- Embedded LDAP SSL should not be enabled when its bundle is empty [#50700](https://github.com/spring-projects/spring-boot/pull/50700)
- InetAddressFilter.externalAddresses does not exclude special purpose addresses from RFC 6890 [#50668](https://github.com/spring-projects/spring-boot/issues/50668)
- NullPointerException in reactor-netty SniProvider and unmapped SSL bundle with RSocket [#50645](https://github.com/spring-projects/spring-boot/issues/50645)
- SSL should not be enabled when a SSL bundle is overridden to an empty string [#50635](https://github.com/spring-projects/spring-boot/issues/50635)
- Test auto-configuration no longer integrates Spring Security with HtmlUnitDriver [#50633](https://github.com/spring-projects/spring-boot/issues/50633)
- Configuration property metadata includes incorrect class references [#50632](https://github.com/spring-projects/spring-boot/issues/50632)
- Docker Compose support does not restore thread interrupt flag when catching InterruptedException [#50618](https://github.com/spring-projects/spring-boot/issues/50618)
- RabbitProperties enables SSL even when spring.rabbitmq.ssl.bundle is overridden to an empty string [#50612](https://github.com/spring-projects/spring-boot/issues/50612)
- NullPointerException in reactor-netty SniProvider when SSL bundle uses client-auth or server truststore without server-name-bundles [#50610](https://github.com/spring-projects/spring-boot/issues/50610)
- SpringJtaPlatform should have been deprecated since 4.1.0-M3 [#50592](https://github.com/spring-projects/spring-boot/issues/50592)
- Layer written outside the output location of '//' exception is thrown when using extract layers in root directory [#50510](https://github.com/spring-projects/spring-boot/issues/50510)
- ConfigurationPropertiesReportEndpoint exposes AOP proxy internals [#50417](https://github.com/spring-projects/spring-boot/issues/50417)
- Created StackTracePrinter instances have no access to the Environment [#50414](https://github.com/spring-projects/spring-boot/issues/50414)
- MappingsEndpoint reports the context's own ID as parentId when a parent exists [#50412](https://github.com/spring-projects/spring-boot/issues/50412)
- Buildpack module does not validate long-to-int casts [#50410](https://github.com/spring-projects/spring-boot/issues/50410)
- Gradle gRPC support fails if protobuf-java dependency is used instead of protobuf-java-util [#50405](https://github.com/spring-projects/spring-boot/pull/50405)
- GraphQL WebSocket support does not configure allowed origins [#50394](https://github.com/spring-projects/spring-boot/issues/50394)
- Spring Boot Loader Does Not Support RSA and EC Signed Jars [#50298](https://github.com/spring-projects/spring-boot/issues/50298)
- Meter registries are not removed from the global registry when the context is closed [#50287](https://github.com/spring-projects/spring-boot/issues/50287)
-  DataSourceBuilder cannot derive a DataSource from a lazy connection proxy [#50271](https://github.com/spring-projects/spring-boot/pull/50271)
- Nullable annotations from AbstractErrorController.getErrorAttributes are not aligned with imp

_[Truncated at 4000 characters — full notes: https://github.com/spring-projects/spring-boot/releases/tag/v4.1.0]_

### v3.5.14

- Date: 2026-04-23
- Version: v3.5.14
- Original notes: https://github.com/spring-projects/spring-boot/releases/tag/v3.5.14
- Permalink: https://whatsnew.fyi/product/spring-boot/releases/v3.5.14

- **fixed** — ApplicationPidFileWriter does not handle symlinks correctly
- **fixed** — RandomValuePropertySource is not suitable for secrets
- **fixed** — Cassandra auto-configuration misconfigures CqlSessionBuilder
- **fixed** — ApplicationTemp does not handle symlinks correctly
- **fixed** — Remote DevTools performs comparison incorrectly
- **fixed** — spring.rabbitmq.ssl.verify-hostname is applied inconsistently
- **fixed** — EnversRevisionRepositoriesRegistrar should reuse @EnableEnversRepositories rather than configuring the JPA counterpart
- **fixed** — Annotations like @Ssl don't work on @Bean methods when using @ServiceConnection
- **fixed** — Whole number values are ignored when configuring min and max expected values and SLO boundaries for a distribution summary meter
- **fixed** — WebFlux Cloud Foundry links endpoint includes query string from received request in resolved links
- **fixed** — 500 response from env endpoint when supplied pattern is invalid
- **fixed** — HTTP method is lost when configuring excludes in EndpointRequest
- **fixed** — Docker Compose support doesn't work with apache/artemis image
- **fixed** — Honor HttpMethod for reactive additional endpoint paths
- **fixed** — Docker Compose support doesn't work with apache/activemq image
- **fixed** — Imports on a containing test class are ignored when a nested class has imports

##### :lady_beetle: Bug Fixes

- ApplicationPidFileWriter does not handle symlinks correctly [#50173](https://github.com/spring-projects/spring-boot/issues/50173)
- RandomValuePropertySource is not suitable for secrets [#50172](https://github.com/spring-projects/spring-boot/issues/50172)
- Cassandra auto-configuration misconfigures CqlSessionBuilder [#50171](https://github.com/spring-projects/spring-boot/issues/50171)
- ApplicationTemp does not handle symlinks correctly [#50170](https://github.com/spring-projects/spring-boot/issues/50170)
- Remote DevTools performs comparison incorrectly [#50169](https://github.com/spring-projects/spring-boot/issues/50169)
- spring.rabbitmq.ssl.verify-hostname is applied inconsistently [#50168](https://github.com/spring-projects/spring-boot/issues/50168)
- EnversRevisionRepositoriesRegistrar should reuse `@EnableEnversRepositories` rather than configuring the JPA counterpart [#50035](https://github.com/spring-projects/spring-boot/pull/50035)
- Annotations like `@Ssl` don't work on `@Bean` methods when using `@ServiceConnection` [#50033](https://github.com/spring-projects/spring-boot/pull/50033)
- Whole number values are ignored when configuring min and max expected values and SLO boundaries for a distribution summary meter [#50021](https://github.com/spring-projects/spring-boot/issues/50021)
- WebFlux Cloud Foundry links endpoint includes query string from received request in resolved links [#50008](https://github.com/spring-projects/spring-boot/pull/50008)
- 500 response from env endpoint when supplied pattern is invalid [#49942](https://github.com/spring-projects/spring-boot/pull/49942)
- HTTP method is lost when configuring excludes in EndpointRequest [#49885](https://github.com/spring-projects/spring-boot/pull/49885)
- Docker Compose support doesn't work with apache/artemis image [#49865](https://github.com/spring-projects/spring-boot/issues/49865)
- Honor HttpMethod for reactive additional endpoint paths [#49864](https://github.com/spring-projects/spring-boot/pull/49864)
- Docker Compose support doesn't work with apache/activemq image [#49863](https://github.com/spring-projects/spring-boot/issues/49863)
- Imports on a containing test class are ignored when a nested class has imports [#49860](https://github.com/spring-projects/spring-boot/issues/49860)

##### :notebook_with_decorative_cover: Documentation

- Link to the observability section of the Lettuce documentation is broken [#50092](https://github.com/spring-projects/spring-boot/pull/50092)
- Javadoc for StaticResourceLocation.FAVICON doesn't describe icons location [#50083](https://github.com/spring-projects/spring-boot/issues/50083)
- MySamlRelyingPartyConfiguration is missing a Kotlin sample [#50023](https://github.com/spring-projects/spring-boot/issues/50023)
- Incorrect default value for management.httpexchanges.recording.include in configuration metadata [#50010](https://github.com/spring-projects/spring-boot/pull/50010)
- Link to the Kubernetes documentation when discussing startup probes [#50007](https://github.com/spring-projects/spring-boot/issues/50007)
- Update docs to encourage Java fundamentals for beginners that prefer to learn that way [#49895](https://github.com/spring-projects/spring-boot/issues/49895)
- Clarify that configuration property default values are not available through the Environment [#49835](https://github.com/spring-projects/spring-boot/pull/49835)

##### :hammer: Dependency Upgrades

- Upgrade to Groovy 4.0.31 [#49905](https://github.com/spring-projects/spring-boot/issues/49905)
- Upgrade to Hibernate 6.6.49.Final [#50140](https://github.com/spring-projects/spring-boot/issues/50140)
- Upgrade to [Jaxen 2.0.1](https://github.com/jaxen-xpath/jaxen/releases/tag/v2.0.1) [#50109](https://github.com/spring-projects/spring-boot/issues/50109)
- Upgrade to [Jaybird 6.0.5](https://github.com/FirebirdSQL/jaybird/releases/tag/v6.0.5) [#49907](https://github.com/spring-projects/spring-boot/issues/49907)
- Upgrade

_[Truncated at 4000 characters — full notes: https://github.com/spring-projects/spring-boot/releases/tag/v3.5.14]_

### v4.1.0-RC1

- Date: 2026-04-23
- Version: v4.1.0-RC1
- Original notes: https://github.com/spring-projects/spring-boot/releases/tag/v4.1.0-RC1
- Permalink: https://whatsnew.fyi/product/spring-boot/releases/v4.1.0-rc1
- Labels: Pre-release

- **added** — Add support for docker.elastic.co/elasticsearch/elasticsearch
- **added** — Narrow the scope of icons pattern to /icons/icon-*
- **added** — Add configuration options for KafkaTemplate's allowNonTransactional and closeTimeout
- **added** — Align ReactorHttpClientBuilder defaults with Spring Framework and provide an opt-out
- **added** — Add support for providing a custom SessionTimeout bean
- **added** — Add support for Redis Annotation driven listeners
- **added** — Support spring.webflux.default-html-escape property for application-wide HTML escaping configuration
- **added** — Add fallback support for '/opt/homebrew/bin' on macOS
- **added** — Support InetAddress filtering for HTTP Clients
- **added** — Monitor certificates from truststore in SslMeterBinder
- **added** — Enable ansi support by default on Windows 11+
- **added** — Add @GrpcAdvice exception handling support
- **added** — Add support for OpenTelemetry SDK environment variables
- **added** — Add ability to read custom layers.xml from classpath
- **added** — Support LazyConnectionDataSourceProxy
- **fixed** — Default security is misconfigured when spring-boot-actuator-autoconfigure is present and spring-boot-health is not
- **fixed** — Elasticsearch Rest5Client auto-configuration misconfigures underlying HTTP client
- **fixed** — ApplicationPidFileWriter does not handle symlinks correctly
- **fixed** — Cassandra auto-configuration misconfigures CqlSessionBuilder
- **fixed** — ApplicationTemp does not handle symlinks correctly

##### :star: New Features

- Add support for docker.elastic.co/elasticsearch/elasticsearch [#50119](https://github.com/spring-projects/spring-boot/pull/50119)
- Narrow the scope of icons pattern to /icons/icon-\* [#50084](https://github.com/spring-projects/spring-boot/issues/50084)
- Add configuration options for KafkaTemplate's allowNonTransactional and closeTimeout [#49954](https://github.com/spring-projects/spring-boot/issues/49954)
- Align ReactorHttpClientBuilder defaults with Spring Framework and provide an opt-out [#49950](https://github.com/spring-projects/spring-boot/issues/49950)
- Add support for providing a custom SessionTimeout bean [#49883](https://github.com/spring-projects/spring-boot/pull/49883)
- Add support for Redis Annotation driven listeners [#49858](https://github.com/spring-projects/spring-boot/issues/49858)
- Support spring.webflux.default-html-escape property for application-wide HTML escaping configuration [#49791](https://github.com/spring-projects/spring-boot/pull/49791)
- Add fallback support for '/opt/homebrew/bin' on macOS [#49721](https://github.com/spring-projects/spring-boot/pull/49721)
- Support InetAddress filtering for HTTP Clients [#49687](https://github.com/spring-projects/spring-boot/issues/49687)
- Monitor certificates from truststore in SslMeterBinder [#49641](https://github.com/spring-projects/spring-boot/pull/49641)
- Enable ansi support by default on Windows 11+ [#49571](https://github.com/spring-projects/spring-boot/pull/49571)
- Add '`@GrpcAdvice`' exception handling support [#49053](https://github.com/spring-projects/spring-boot/issues/49053)
- Add support for OpenTelemetry SDK environment variables [#48799](https://github.com/spring-projects/spring-boot/issues/48799)
- Add ability to read custom layers.xml from classpath [#32466](https://github.com/spring-projects/spring-boot/issues/32466)
- Support LazyConnectionDataSourceProxy [#15480](https://github.com/spring-projects/spring-boot/issues/15480)

##### :lady_beetle: Bug Fixes

- Default security is misconfigured when spring-boot-actuator-autoconfigure is present and spring-boot-health is not [#50190](https://github.com/spring-projects/spring-boot/issues/50190)
- Elasticsearch Rest5Client auto-configuration misconfigures underlying HTTP client [#50189](https://github.com/spring-projects/spring-boot/issues/50189)
- ApplicationPidFileWriter does not handle symlinks correctly [#50186](https://github.com/spring-projects/spring-boot/issues/50186)
- RandomValuePropertySource is not suitable for secrets [#50184](https://github.com/spring-projects/spring-boot/issues/50184)
- Cassandra auto-configuration misconfigures CqlSessionBuilder [#50182](https://github.com/spring-projects/spring-boot/issues/50182)
- ApplicationTemp does not handle symlinks correctly [#50179](https://github.com/spring-projects/spring-boot/issues/50179)
- Remote DevTools performs comparison incorrectly [#50177](https://github.com/spring-projects/spring-boot/issues/50177)
- spring.rabbitmq.ssl.verify-hostname is applied inconsistently [#50175](https://github.com/spring-projects/spring-boot/issues/50175)
- GrpcDisableCsrfHttpConfigurer incorrectly uses inverse of 'spring.grpc.server.security.csrf.enabled' property [#50145](https://github.com/spring-projects/spring-boot/issues/50145)
- API versioning path strategy should be applied path last as it is not meant to yield [#50127](https://github.com/spring-projects/spring-boot/issues/50127)
- Whole number values are ignored when configuring min and max expected values and SLO boundaries for a distribution summary meter [#50078](https://github.com/spring-projects/spring-boot/issues/50078)
- Classic starters are missing several modules [#50072](https://github.com/spring-projects/spring-boot/issues/50072)
- Module spring-boot-resttestclient is missing from spring-boot-starter-test-classic [#50070](https://github.com/spring-projects/spring-boot/issues/50070)
- Annotations like `@Ssl` don't work on `@Bean` methods when using

_[Truncated at 4000 characters — full notes: https://github.com/spring-projects/spring-boot/releases/tag/v4.1.0-RC1]_

### v4.0.6

- Date: 2026-04-23
- Version: v4.0.6
- Original notes: https://github.com/spring-projects/spring-boot/releases/tag/v4.0.6
- Permalink: https://whatsnew.fyi/product/spring-boot/releases/v4.0.6

- **fixed** — Default security is misconfigured when spring-boot-actuator-autoconfigure is present and spring-boot-health is not
- **fixed** — Elasticsearch Rest5Client auto-configuration misconfigures underlying HTTP client
- **fixed** — ApplicationPidFileWriter does not handle symlinks correctly
- **fixed** — RandomValuePropertySource is not suitable for secrets
- **fixed** — Cassandra auto-configuration misconfigures CqlSessionBuilder
- **fixed** — ApplicationTemp does not handle symlinks correctly
- **fixed** — Remote DevTools performs comparison incorrectly
- **fixed** — spring.rabbitmq.ssl.verify-hostname is applied inconsistently
- **fixed** — Whole number values are ignored when configuring min and max expected values and SLO boundaries for a distribution summary meter
- **fixed** — Classic starters are missing several modules
- **fixed** — Module spring-boot-resttestclient is missing from spring-boot-starter-test-classic
- **fixed** — Annotations like @Ssl don't work on @Bean methods when using @ServiceConnection
- **fixed** — EnversRevisionRepositoriesRegistrar should reuse @EnableEnversRepositories rather than configuring the JPA counterpart
- **fixed** — WebFlux Cloud Foundry links endpoint includes query string from received request in resolved links
- **fixed** — Imports on a containing test class are ignored when a nested class has imports
- **fixed** — With spring.jackson.use-jackson2-defaults set to true, FAIL_ON_UNKNOWN_PROPERTIES is enabled
- **fixed** — 500 response from env endpoint when supplied pattern is invalid
- **fixed** — Reactive MongoDB starter has a transitive dependency on the synchronous MongoDB driver
- **fixed** — HTTP method is lost when configuring excludes in EndpointRequest
- **fixed** — Honor HttpMethod for reactive additional endpoint paths

##### :lady_beetle: Bug Fixes

- Default security is misconfigured when spring-boot-actuator-autoconfigure is present and spring-boot-health is not [#50188](https://github.com/spring-projects/spring-boot/issues/50188)
- Elasticsearch Rest5Client auto-configuration misconfigures underlying HTTP client [#50187](https://github.com/spring-projects/spring-boot/issues/50187)
- ApplicationPidFileWriter does not handle symlinks correctly [#50185](https://github.com/spring-projects/spring-boot/issues/50185)
- RandomValuePropertySource is not suitable for secrets [#50183](https://github.com/spring-projects/spring-boot/issues/50183)
- Cassandra auto-configuration misconfigures CqlSessionBuilder [#50180](https://github.com/spring-projects/spring-boot/issues/50180)
- ApplicationTemp does not handle symlinks correctly [#50178](https://github.com/spring-projects/spring-boot/issues/50178)
- Remote DevTools performs comparison incorrectly [#50176](https://github.com/spring-projects/spring-boot/issues/50176)
- spring.rabbitmq.ssl.verify-hostname is applied inconsistently [#50174](https://github.com/spring-projects/spring-boot/issues/50174)
- Whole number values are ignored when configuring min and max expected values and SLO boundaries for a distribution summary meter [#50077](https://github.com/spring-projects/spring-boot/issues/50077)
- Classic starters are missing several modules [#50071](https://github.com/spring-projects/spring-boot/issues/50071)
- Module spring-boot-resttestclient is missing from spring-boot-starter-test-classic [#50069](https://github.com/spring-projects/spring-boot/pull/50069)
- Annotations like `@Ssl` don't work on `@Bean` methods when using `@ServiceConnection` [#50064](https://github.com/spring-projects/spring-boot/issues/50064)
- EnversRevisionRepositoriesRegistrar should reuse `@EnableEnversRepositories` rather than configuring the JPA counterpart [#50039](https://github.com/spring-projects/spring-boot/issues/50039)
- WebFlux Cloud Foundry links endpoint includes query string from received request in resolved links [#50017](https://github.com/spring-projects/spring-boot/issues/50017)
- Imports on a containing test class are ignored when a nested class has imports [#50012](https://github.com/spring-projects/spring-boot/issues/50012)
- With spring.jackson.use-jackson2-defaults set to true, FAIL\_ON\_UNKNOWN\_PROPERTIES is enabled [#49951](https://github.com/spring-projects/spring-boot/issues/49951)
- 500 response from env endpoint when supplied pattern is invalid [#49946](https://github.com/spring-projects/spring-boot/issues/49946)
- Reactive MongoDB starter has a transitive dependency on the synchronous MongoDB driver [#49945](https://github.com/spring-projects/spring-boot/issues/49945)
- HTTP method is lost when configuring excludes in EndpointRequest [#49943](https://github.com/spring-projects/spring-boot/issues/49943)
- Honor HttpMethod for reactive additional endpoint paths [#49880](https://github.com/spring-projects/spring-boot/issues/49880)
- Docker Compose support doesn't work with apache/artemis image [#49869](https://github.com/spring-projects/spring-boot/issues/49869)
- Docker Compose support doesn't work with apache/activemq image [#49866](https://github.com/spring-projects/spring-boot/issues/49866)
- Spring Security's PathPatternRequestMatcher.Builder is not auto-configured when using WebMvcTest and spring-boot-security-test [#49854](https://github.com/spring-projects/spring-boot/issues/49854)
- API versioning path strategy should be applied path last as it is not meant to yield [#49800](https://github.com/spring-projects/spring-boot/issues/49800)

##### :notebook_with_decorative_cover: Documentation

- Update docs to encourage Java fundamentals for beginners that prefer to learn that way [#50146](https://github.com/spring-projects/spring-boot/issues/50146)
- HTTP Service Interface Clients still document that API versioning can be configured via properties [#50126](https://g

_[Truncated at 4000 characters — full notes: https://github.com/spring-projects/spring-boot/releases/tag/v4.0.6]_

### v4.0.5

- Date: 2026-03-26
- Version: v4.0.5
- Original notes: https://github.com/spring-projects/spring-boot/releases/tag/v4.0.5
- Permalink: https://whatsnew.fyi/product/spring-boot/releases/v4.0.5

- **fixed** — Test starter for Spring Integration now includes Spring Integration test module
- **fixed** — Sliced tests that import TransactionAutoConfiguration now also import TransactionManagerCustomizationAutoConfiguration
- **fixed** — WebSocket messaging's task executors and stompWebSocketHandlerMapping are now auto-configured regardless of whether Jackson is present
- **fixed** — WebSocket app no longer fails to start when Jackson is on the classpath but there is no JsonMapper bean
- **fixed** — Metadata annotation processor now respects method-level @NestedConfigurationProperty when using constructor binding
- **fixed** — Property overrides in external application.properties or application.yaml are no longer ignored
- **fixed** — NativeImageResourceProvider now finds Flyway migration scripts in subdirectories
- **fixed** — NettyReactiveWebServerAutoConfiguration now includes @ConditionalOnWebApplication
- **fixed** — @GraphQlTest now includes @ControllerAdvice

##### :lady_beetle: Bug Fixes

- Test starter for Spring Integration does not include Spring Integration test module [#49784](https://github.com/spring-projects/spring-boot/issues/49784)
- Some sliced tests that import TransactionAutoConfiguration do not import TransactionManagerCustomizationAutoConfiguration [#49782](https://github.com/spring-projects/spring-boot/issues/49782)
- WebSocket messaging's task executors are only auto-configured and stompWebSocketHandlerMapping is only forced to be eager when using Jackson [#49753](https://github.com/spring-projects/spring-boot/issues/49753)
- WebSocket app fails to start when Jackson is on the classpath but there's no JsonMapper bean [#49749](https://github.com/spring-projects/spring-boot/issues/49749)
- Metadata annotation processor ignores method-level `@NestedConfigurationProperty` when using constructor binding [#49738](https://github.com/spring-projects/spring-boot/issues/49738)
- Override of property in external 'application.properties' or 'application.yaml' is ignored [#49731](https://github.com/spring-projects/spring-boot/issues/49731)
- NativeImageResourceProvider does not find Flyway migration scripts in subdirectories [#49706](https://github.com/spring-projects/spring-boot/issues/49706)
- Add `@ConditionalOnWebApplication` to NettyReactiveWebServerAutoConfiguration [#49695](https://github.com/spring-projects/spring-boot/pull/49695)
- `@GraphQlTest` does not include `@ControllerAdvice` [#49672](https://github.com/spring-projects/spring-boot/issues/49672)

##### :notebook_with_decorative_cover: Documentation

- Fix incorrect indefinite articles in Javadoc [#49727](https://github.com/spring-projects/spring-boot/issues/49727)
- Add some more Kotlin examples and trivial style fixes [#49714](https://github.com/spring-projects/spring-boot/issues/49714)
- Overhaul Spring Session documentation following modularization [#49704](https://github.com/spring-projects/spring-boot/issues/49704)

##### :hammer: Dependency Upgrades

- Upgrade to Brave 6.3.1 [#49763](https://github.com/spring-projects/spring-boot/issues/49763)
- Upgrade to Jackson 2 Bom 2.21.2 [#49764](https://github.com/spring-projects/spring-boot/issues/49764)
- Upgrade to jOOQ 3.19.31 [#49765](https://github.com/spring-projects/spring-boot/issues/49765)
- Upgrade to Netty 4.2.12.Final [#49794](https://github.com/spring-projects/spring-boot/issues/49794)
- Upgrade to Tomcat 11.0.20 [#49767](https://github.com/spring-projects/spring-boot/issues/49767)
- Upgrade to Zipkin Reporter 3.5.3 [#49762](https://github.com/spring-projects/spring-boot/issues/49762)

##### :heart: Contributors

Thank you to all the contributors who worked on this release:

@Joowon-Seo, @deejay1, @dlwldnjs1009, @kwondh5217, @ljrmorgan, and @quaff

### v4.1.0-M4

- Date: 2026-03-26
- Version: v4.1.0-M4
- Original notes: https://github.com/spring-projects/spring-boot/releases/tag/v4.1.0-M4
- Permalink: https://whatsnew.fyi/product/spring-boot/releases/v4.1.0-m4
- Labels: Pre-release

- **added** — Add 'spring.jpa.bootstrap' property for async background bootstrapping
- **added** — Add support for custom GrpcServerObservationConvention
- **added** — Spring Data JPA bootstrap mode property of 'deferred' should provide a meaningful message if no suitable AsyncTaskExecutor is found
- **fixed** — Test starter for Spring Integration does not include Spring Integration test module
- **fixed** — Some sliced tests that import TransactionAutoConfiguration do not import TransactionManagerCustomizationAutoConfiguration
- **fixed** — WebSocket app fails to start when Jackson is on the classpath but there's no JsonMapper bean
- **fixed** — WebSocket messaging's task executors are only auto-configured and stompWebSocketHandlerMapping is only forced to be eager when using Jackson
- **fixed** — Metadata annotation processor ignores method-level @NestedConfigurationProperty when using constructor binding
- **fixed** — Override of property in external 'application.properties' or 'application.yaml' is ignored
- **fixed** — NativeImageResourceProvider does not find Flyway migration scripts in subdirectories
- **fixed** — Add @ConditionalOnWebApplication to NettyReactiveWebServerAutoConfiguration
- **fixed** — App using spring-cloud-stream-binder-rabbit fails to start with 4.1.0-M3
- **fixed** — @GraphQlTest does not include @ControllerAdvice

##### :star: New Features

- Add 'spring.jpa.bootstrap' property for async background bootstrapping [#49733](https://github.com/spring-projects/spring-boot/issues/49733)
- Add support for custom GrpcServerObservationConvention [#49730](https://github.com/spring-projects/spring-boot/pull/49730)
- A Spring Data JPA bootstrap mode property of 'deferred' should provide a meaningful message if no suitable AsyncTaskExecutor is found [#49688](https://github.com/spring-projects/spring-boot/issues/49688)

##### :lady_beetle: Bug Fixes

- Test starter for Spring Integration does not include Spring Integration test module [#49786](https://github.com/spring-projects/spring-boot/issues/49786)
- Some sliced tests that import TransactionAutoConfiguration do not import TransactionManagerCustomizationAutoConfiguration [#49783](https://github.com/spring-projects/spring-boot/issues/49783)
- WebSocket app fails to start when Jackson is on the classpath but there's no JsonMapper bean [#49755](https://github.com/spring-projects/spring-boot/issues/49755)
- WebSocket messaging's task executors are only auto-configured and stompWebSocketHandlerMapping is only forced to be eager when using Jackson [#49754](https://github.com/spring-projects/spring-boot/issues/49754)
- Metadata annotation processor ignores method-level `@NestedConfigurationProperty` when using constructor binding [#49739](https://github.com/spring-projects/spring-boot/issues/49739)
- Override of property in external 'application.properties' or 'application.yaml' is ignored [#49732](https://github.com/spring-projects/spring-boot/issues/49732)
- NativeImageResourceProvider does not find Flyway migration scripts in subdirectories [#49707](https://github.com/spring-projects/spring-boot/issues/49707)
- Add `@ConditionalOnWebApplication` to NettyReactiveWebServerAutoConfiguration [#49699](https://github.com/spring-projects/spring-boot/issues/49699)
- App using spring-cloud-stream-binder-rabbit fails to start with 4.1.0-M3 [#49676](https://github.com/spring-projects/spring-boot/issues/49676)
- `@GraphQlTest` does not include `@ControllerAdvice` [#49673](https://github.com/spring-projects/spring-boot/issues/49673)

##### :notebook_with_decorative_cover: Documentation

- Fix incorrect indefinite articles in Javadoc [#49728](https://github.com/spring-projects/spring-boot/issues/49728)
- Document gRPC's default unit in configuration properties consistently [#49722](https://github.com/spring-projects/spring-boot/issues/49722)
- Add some more Kotlin examples and trivial style fixes [#49715](https://github.com/spring-projects/spring-boot/issues/49715)
- Overhaul Spring Session documentation following modularization [#49705](https://github.com/spring-projects/spring-boot/issues/49705)

##### :hammer: Dependency Upgrades

- Upgrade to Artemis 2.53.0 [#49769](https://github.com/spring-projects/spring-boot/issues/49769)
- Upgrade to Brave 6.3.1 [#49771](https://github.com/spring-projects/spring-boot/issues/49771)
- Upgrade to Grpc Java 1.80.0 [#49772](https://github.com/spring-projects/spring-boot/issues/49772)
- Upgrade to Jackson 2 Bom 2.21.2 [#49773](https://github.com/spring-projects/spring-boot/issues/49773)
- Upgrade to jOOQ 3.21.0 [#49774](https://github.com/spring-projects/spring-boot/issues/49774)
- Upgrade to Netty 4.2.12.Final [#49795](https://github.com/spring-projects/spring-boot/issues/49795)
- Upgrade to Prometheus Client 1.5.1 [#49777](https://github.com/spring-projects/spring-boot/issues/49777)
- Upgrade to Protobuf Common Protos 2.67.0 [#49778](https://github.com/spring-projects/spring-boot/issues/49778)
- Upgrade to Protobuf Java 4.34.1 [#49779](https://github.com/spring-projects/spring-boot/issues/49779)
- Upgrade to Protobuf Maven Plugin 5.1.0 [#49776](https://github.com/spring-projects/spring-boot/issues/49776)
- Upgrade to Thymeleaf Layout Dialect 4.0.1 [#49780](https://github.com/spring-projects/spring-boot/issues/49780)
- Upgrade to Tomcat 1

_[Truncated at 4000 characters — full notes: https://github.com/spring-projects/spring-boot/releases/tag/v4.1.0-M4]_

### v3.5.13

- Date: 2026-03-26
- Version: v3.5.13
- Original notes: https://github.com/spring-projects/spring-boot/releases/tag/v3.5.13
- Permalink: https://whatsnew.fyi/product/spring-boot/releases/v3.5.13

- **changed** — Jackson upgraded to 2.21.2 due to Jackson team ending support for 2.19.x and 2.20.x
- **fixed** — WebSocket messaging's task executors are only auto-configured and stompWebSocketHandlerMapping is only forced to be eager when using Jackson
- **fixed** — Metadata annotation processor now respects method-level @NestedConfigurationProperty when using constructor binding
- **fixed** — Override of property in external application.properties or application.yaml is no longer ignored
- **fixed** — Some sliced tests that import TransactionAutoConfiguration now also import TransactionManagerCustomizationAutoConfiguration
- **fixed** — NativeImageResourceProvider now finds Flyway migration scripts in subdirectories
- **fixed** — @GraphQlTest now includes @ControllerAdvice

##### :warning: Attention Required

- Jackson has been upgraded to 2.21.2 in response to the Jackson team ending support for Jackson 2.19.x and 2.20.x. [#49365](https://github.com/spring-projects/spring-boot/issues/49365)

##### :lady_beetle: Bug Fixes

- WebSocket messaging's task executors are only auto-configured and stompWebSocketHandlerMapping is only forced to be eager when using Jackson [#49750](https://github.com/spring-projects/spring-boot/issues/49750)
- Metadata annotation processor ignores method-level `@NestedConfigurationProperty` when using constructor binding [#49734](https://github.com/spring-projects/spring-boot/issues/49734)
- Override of property in external 'application.properties' or 'application.yaml' is ignored [#49724](https://github.com/spring-projects/spring-boot/issues/49724)
- Some sliced tests that import TransactionAutoConfiguration do not import TransactionManagerCustomizationAutoConfiguration [#49716](https://github.com/spring-projects/spring-boot/issues/49716)
- NativeImageResourceProvider does not find Flyway migration scripts in subdirectories [#49661](https://github.com/spring-projects/spring-boot/issues/49661)
- `@GraphQlTest` does not include `@ControllerAdvice` [#49660](https://github.com/spring-projects/spring-boot/pull/49660)

##### :notebook_with_decorative_cover: Documentation

- Fix incorrect indefinite articles in Javadoc [#49723](https://github.com/spring-projects/spring-boot/pull/49723)
- Add some more Kotlin examples and trivial style fixes [#49710](https://github.com/spring-projects/spring-boot/pull/49710)

##### :hammer: Dependency Upgrades

- Upgrade to Hibernate 6.6.45.Final [#49757](https://github.com/spring-projects/spring-boot/issues/49757)
- Upgrade to jOOQ 3.19.31 [#49758](https://github.com/spring-projects/spring-boot/issues/49758)
- Upgrade to Netty 4.1.132.Final [#49759](https://github.com/spring-projects/spring-boot/issues/49759)
- Upgrade to Tomcat 10.1.53 [#49760](https://github.com/spring-projects/spring-boot/issues/49760)
- Upgrade to Undertow 2.3.24.Final [#49761](https://github.com/spring-projects/spring-boot/issues/49761)
- Upgrade to Zipkin Reporter 3.5.3 [#49756](https://github.com/spring-projects/spring-boot/issues/49756)

##### :heart: Contributors

Thank you to all the contributors who worked on this release:

@Joowon-Seo, @deejay1, @dlwldnjs1009, and @ljrmorgan