v4.1.0-RC1

⭐ New Features

• Add support for docker.elastic.co/elasticsearch/elasticsearch #50119
• Narrow the scope of icons pattern to /icons/icon-* #50084
• Add configuration options for KafkaTemplate's allowNonTransactional and closeTimeout #49954
• Align ReactorHttpClientBuilder defaults with Spring Framework and provide an opt-out #49950
• Add support for providing a custom SessionTimeout bean #49883
• Add support for Redis Annotation driven listeners #49858
• Support spring.webflux.default-html-escape property for application-wide HTML escaping configuration #49791
• Add fallback support for '/opt/homebrew/bin' on macOS #49721
• Support InetAddress filtering for HTTP Clients #49687
• Monitor certificates from truststore in SslMeterBinder #49641
• Enable ansi support by default on Windows 11+ #49571
• Add '@GrpcAdvice' exception handling support #49053
• Add support for OpenTelemetry SDK environment variables #48799
• Add ability to read custom layers.xml from classpath #32466
• Support LazyConnectionDataSourceProxy #15480

🐞 Bug Fixes

• Default security is misconfigured when spring-boot-actuator-autoconfigure is present and spring-boot-health is not #50190
• Elasticsearch Rest5Client auto-configuration misconfigures underlying HTTP client #50189
• ApplicationPidFileWriter does not handle symlinks correctly #50186
• RandomValuePropertySource is not suitable for secrets #50184
• Cassandra auto-configuration misconfigures CqlSessionBuilder #50182
• ApplicationTemp does not handle symlinks correctly #50179
• Remote DevTools performs comparison incorrectly #50177
• spring.rabbitmq.ssl.verify-hostname is applied inconsistently #50175
• GrpcDisableCsrfHttpConfigurer incorrectly uses inverse of 'spring.grpc.server.security.csrf.enabled' property #50145
• API versioning path strategy should be applied path last as it is not meant to yield #50127
• Whole number values are ignored when configuring min and max expected values and SLO boundaries for a distribution summary meter #50078
• Classic starters are missing several modules #50072
• Module spring-boot-resttestclient is missing from spring-boot-starter-test-classic #50070
• Annotations like @Ssl don't work on @Bean methods when using @ServiceConnection #50065
• EnversRevisionRepositoriesRegistrar should reuse @EnableEnversRepositories rather than configuring the JPA counterpart #50040
• WebFlux Cloud Foundry links endpoint includes query string from received request in resolved links #50018
• Imports on a containing test class are ignored when a nested class has imports #50013
• Spring Security's PathPatternRequestMatcher.Builder is not auto-configured when using WebMvcTest and spring-boot-security-test #49988
• Reactive MongoDB starter has a transitive dependency on the synchronous MongoDB driver #49958
• With spring.jackson.use-jackson2-defaults set to true, FAIL_ON_UNKNOWN_PROPERTIES is enabled #49957
• 500 response from env endpoint when supplied pattern is invalid #49947
• HTTP method is lost when configuring excludes in EndpointRequest #49944
• Honor HttpMethod for reactive additional endpoint paths #49881
• Docker Compose support doesn't work with apache/artemis image #49870
• Docker Compose support doesn't work with apache/activemq image #49867
• ReactiveOAuth2ResourceServerAutoConfiguration should trigger only on real Reactive Applications #49807
• Test starters 'spring-boot-starter-grpc-client-test' and 'spring-boot-starter-grpc-server-test' are missing #49690
• Properties in '@ConfigurationProperties' annotated type shouldn't be able to define the same '@Name' #49565
• Distribution's SLO, minimum expected value, and maximum expected value are not applied to long task timer meters #49190
• WebConversionService breaks embedded value resolving #8923

📔 Documentation

• Update docs to encourage Java fundamentals for beginners that prefer to learn that way #50147
• HTTP Service Interface Clients still document that API versioning can be configured via properties #50128
• Link to the observability section of the Lettuce documentation is broken #50098
• Javadoc for StaticResourceLocation.FAVICON doesn't describe icons location #50086
• MySamlRelyingPartyConfiguration is missing a Kotlin sample #50025
• Move OAuth2 and SAML 2.0 documentation to a security section #50022
• Incorrect default value for management.httpexchanges.recording.include in configuration metadata #50020
• Link to the Kubernetes documentation when discussing startup probes #50016
• Document missing gRPC's default unit in GrpcClientProperties #49879
• Document the need for Liquibase and Flyway starters #49875
• Typo in JdbcSessionAutoConfiguration Javadoc #49874
• Clarify that configuration property default values are not available through the Environment #49852
• Kafka documentation refers to deprecated JSON serializer and deserializer classes #49834
• Document gRPC Support #49291

🔨 Dependency Upgrades

• Upgrade to ActiveMQ 6.2.4 #50002
• Upgrade to Byte Buddy 1.18.8 #49922
• Upgrade to Couchbase Client 3.11.2 #50066
• Upgrade to Ehcache3 3.12.0 #49923
• Upgrade to Elasticsearch Client 9.3.4 #50099
• Upgrade to Flyway 12.4.0 #50079
• Upgrade to Git Commit ID Maven Plugin 9.2.0 #49925
• Upgrade to Groovy 5.0.5 #49926
• Upgrade to Hibernate 7.2.12.Final #50136
• Upgrade to HttpClient5 5.6.1 [#50137](https://github.com/spring-project...

v4.0.6

🐞 Bug Fixes

• Default security is misconfigured when spring-boot-actuator-autoconfigure is present and spring-boot-health is not #50188
• Elasticsearch Rest5Client auto-configuration misconfigures underlying HTTP client #50187
• ApplicationPidFileWriter does not handle symlinks correctly #50185
• RandomValuePropertySource is not suitable for secrets #50183
• Cassandra auto-configuration misconfigures CqlSessionBuilder #50180
• ApplicationTemp does not handle symlinks correctly #50178
• Remote DevTools performs comparison incorrectly #50176
• spring.rabbitmq.ssl.verify-hostname is applied inconsistently #50174
• Whole number values are ignored when configuring min and max expected values and SLO boundaries for a distribution summary meter #50077
• Classic starters are missing several modules #50071
• Module spring-boot-resttestclient is missing from spring-boot-starter-test-classic #50069
• Annotations like @Ssl don't work on @Bean methods when using @ServiceConnection #50064
• EnversRevisionRepositoriesRegistrar should reuse @EnableEnversRepositories rather than configuring the JPA counterpart #50039
• WebFlux Cloud Foundry links endpoint includes query string from received request in resolved links #50017
• Imports on a containing test class are ignored when a nested class has imports #50012
• With spring.jackson.use-jackson2-defaults set to true, FAIL_ON_UNKNOWN_PROPERTIES is enabled #49951
• 500 response from env endpoint when supplied pattern is invalid #49946
• Reactive MongoDB starter has a transitive dependency on the synchronous MongoDB driver #49945
• HTTP method is lost when configuring excludes in EndpointRequest #49943
• Honor HttpMethod for reactive additional endpoint paths #49880
• Docker Compose support doesn't work with apache/artemis image #49869
• Docker Compose support doesn't work with apache/activemq image #49866
• Spring Security's PathPatternRequestMatcher.Builder is not auto-configured when using WebMvcTest and spring-boot-security-test #49854
• API versioning path strategy should be applied path last as it is not meant to yield #49800

📔 Documentation

• Update docs to encourage Java fundamentals for beginners that prefer to learn that way #50146
• HTTP Service Interface Clients still document that API versioning can be configured via properties #50126
• Link to the observability section of the Lettuce documentation is broken #50097
• Javadoc for StaticResourceLocation.FAVICON doesn't describe icons location #50085
• MySamlRelyingPartyConfiguration is missing a Kotlin sample #50024
• Incorrect default value for management.httpexchanges.recording.include in configuration metadata #50019
• Link to the Kubernetes documentation when discussing startup probes #50015
• Typo in JdbcSessionAutoConfiguration Javadoc #49873
• Clarify that configuration property default values are not available through the Environment #49851
• Document the need for Liquibase and Flyway starters #49839
• Kafka documentation refers to deprecated JSON serializer and deserializer classes #49826

🔨 Dependency Upgrades

• Upgrade to Elasticsearch Client 9.2.8 #50027
• Upgrade to Groovy 5.0.5 #49911
• Upgrade to Hibernate 7.2.12.Final #50134
• Upgrade to Jackson Bom 3.1.2 #50051
• Upgrade to Jaxen 2.0.1 #50104
• Upgrade to Jaybird 6.0.5 #49914
• Upgrade to Jetty 12.1.8 #49915
• Upgrade to jOOQ 3.19.32 #50105
• Upgrade to Log4j2 2.25.4 #49916
• Upgrade to Lombok 1.18.46 #50150
• Upgrade to MariaDB 3.5.8 #49917
• Upgrade to Micrometer 1.16.5 #49972
• Upgrade to Micrometer Tracing 1.6.5 #49973
• Upgrade to MongoDB 5.6.5 #50028
• Upgrade to MySQL 9.7.0 #50159
• Upgrade to Neo4j Java Driver 6.0.5 #50075
• Upgrade to Reactor Bom 2025.0.5 #49974
• Upgrade to Spring AMQP 4.0.3 #49975
• Upgrade to Spring Data Bom 2025.1.5 #49976
• Upgrade to Spring Framework 7.0.7 #49977
• Upgrade to Spring GraphQL 2.0.3 #49978
• Upgrade to Spring Kafka 4.0.5 #49979
• Upgrade to Spring LDAP 4.0.3 #49980
• Upgrade to Spring Pulsar 2.0.5 #49981
• Upgrade to Spring Security 7.0.5 #49982
• Upgrade to Spring Session 4.0.3 #49983
• Upgrade to Testcontainers 2.0.5 #50135
• Upgrade to Thymeleaf 3.1.5.RELEASE #50152
• Upgrade to Thymeleaf Extras SpringSecurity 3.1.5.RELEASE #50153
• Upgrade to Tomcat 11.0.21 #49918

❤️ Contributors

Thank you to all the contributors who worked o...

v3.5.14

🐞 Bug Fixes

• ApplicationPidFileWriter does not handle symlinks correctly #50173
• RandomValuePropertySource is not suitable for secrets #50172
• Cassandra auto-configuration misconfigures CqlSessionBuilder #50171
• ApplicationTemp does not handle symlinks correctly #50170
• Remote DevTools performs comparison incorrectly #50169
• spring.rabbitmq.ssl.verify-hostname is applied inconsistently #50168
• EnversRevisionRepositoriesRegistrar should reuse @EnableEnversRepositories rather than configuring the JPA counterpart #50035
• Annotations like @Ssl don't work on @Bean methods when using @ServiceConnection #50033
• Whole number values are ignored when configuring min and max expected values and SLO boundaries for a distribution summary meter #50021
• WebFlux Cloud Foundry links endpoint includes query string from received request in resolved links #50008
• 500 response from env endpoint when supplied pattern is invalid #49942
• HTTP method is lost when configuring excludes in EndpointRequest #49885
• Docker Compose support doesn't work with apache/artemis image #49865
• Honor HttpMethod for reactive additional endpoint paths #49864
• Docker Compose support doesn't work with apache/activemq image #49863
• Imports on a containing test class are ignored when a nested class has imports #49860

📔 Documentation

• Link to the observability section of the Lettuce documentation is broken #50092
• Javadoc for StaticResourceLocation.FAVICON doesn't describe icons location #50083
• MySamlRelyingPartyConfiguration is missing a Kotlin sample #50023
• Incorrect default value for management.httpexchanges.recording.include in configuration metadata #50010
• Link to the Kubernetes documentation when discussing startup probes #50007
• Update docs to encourage Java fundamentals for beginners that prefer to learn that way #49895
• Clarify that configuration property default values are not available through the Environment #49835

🔨 Dependency Upgrades

• Upgrade to Groovy 4.0.31 #49905
• Upgrade to Hibernate 6.6.49.Final #50140
• Upgrade to Jaxen 2.0.1 #50109
• Upgrade to Jaybird 6.0.5 #49907
• Upgrade to Jetty 12.0.34 #49908
• Upgrade to jOOQ 3.19.32 #50110
• Upgrade to Lombok 1.18.46 #50148
• Upgrade to MariaDB 3.5.8 #49909
• Upgrade to Micrometer 1.15.11 #49961
• Upgrade to Micrometer Tracing 1.5.11 #49962
• Upgrade to MySQL 9.7.0 #50161
• Upgrade to Neo4j Java Driver 5.28.13 #50074
• Upgrade to Reactor Bom 2024.0.17 #49963
• Upgrade to Spring AMQP 3.2.10 #49964
• Upgrade to Spring Authorization Server 1.5.7 #49965
• Upgrade to Spring Data Bom 2025.0.11 #49966
• Upgrade to Spring Framework 6.2.18 #49967
• Upgrade to Spring Kafka 3.3.15 #50129
• Upgrade to Spring LDAP 3.3.7 #49968
• Upgrade to Spring Pulsar 1.2.17 #49969
• Upgrade to Spring Security 6.5.10 #49970
• Upgrade to Spring Session 3.5.6 #49971
• Upgrade to Thymeleaf 3.1.5.RELEASE #50149
• Upgrade to Thymeleaf Extras SpringSecurity 3.1.5.RELEASE #50151
• Upgrade to Tomcat 10.1.54 #49910

❤️ Contributors

Thank you to all the contributors who worked on this release:

@MohammedGhallab, @dlwldnjs1009, @edwardsre, @kodama-kcc, @kwondh5217, @quaff, @refeccd, and @scordio

v4.1.0-M4

⭐ New Features

• Add 'spring.jpa.bootstrap' property for async background bootstrapping #49733
• Add support for custom GrpcServerObservationConvention #49730
• A Spring Data JPA bootstrap mode property of 'deferred' should provide a meaningful message if no suitable AsyncTaskExecutor is found #49688

🐞 Bug Fixes

• Test starter for Spring Integration does not include Spring Integration test module #49786
• Some sliced tests that import TransactionAutoConfiguration do not import TransactionManagerCustomizationAutoConfiguration #49783
• WebSocket app fails to start when Jackson is on the classpath but there's no JsonMapper bean #49755
• WebSocket messaging's task executors are only auto-configured and stompWebSocketHandlerMapping is only forced to be eager when using Jackson #49754
• Metadata annotation processor ignores method-level @NestedConfigurationProperty when using constructor binding #49739
• Override of property in external 'application.properties' or 'application.yaml' is ignored #49732
• NativeImageResourceProvider does not find Flyway migration scripts in subdirectories #49707
• Add @ConditionalOnWebApplication to NettyReactiveWebServerAutoConfiguration #49699
• App using spring-cloud-stream-binder-rabbit fails to start with 4.1.0-M3 #49676
• @GraphQlTest does not include @ControllerAdvice #49673

📔 Documentation

• Fix incorrect indefinite articles in Javadoc #49728
• Document gRPC's default unit in configuration properties consistently #49722
• Add some more Kotlin examples and trivial style fixes #49715
• Overhaul Spring Session documentation following modularization #49705

🔨 Dependency Upgrades

• Upgrade to Artemis 2.53.0 #49769
• Upgrade to Brave 6.3.1 #49771
• Upgrade to Grpc Java 1.80.0 #49772
• Upgrade to Jackson 2 Bom 2.21.2 #49773
• Upgrade to jOOQ 3.21.0 #49774
• Upgrade to Netty 4.2.12.Final #49795
• Upgrade to Prometheus Client 1.5.1 #49777
• Upgrade to Protobuf Common Protos 2.67.0 #49778
• Upgrade to Protobuf Java 4.34.1 #49779
• Upgrade to Protobuf Maven Plugin 5.1.0 #49776
• Upgrade to Thymeleaf Layout Dialect 4.0.1 #49780
• Upgrade to Tomcat 11.0.20 #49781
• Upgrade to Zipkin Reporter 3.5.3 #49770

❤️ Contributors

Thank you to all the contributors who worked on this release:

@deejay1, @dlwldnjs1009, @kwondh5217, @ljrmorgan, @quaff, and @therepanic

v4.0.5

🐞 Bug Fixes

• Test starter for Spring Integration does not include Spring Integration test module #49784
• Some sliced tests that import TransactionAutoConfiguration do not import TransactionManagerCustomizationAutoConfiguration #49782
• WebSocket messaging's task executors are only auto-configured and stompWebSocketHandlerMapping is only forced to be eager when using Jackson #49753
• WebSocket app fails to start when Jackson is on the classpath but there's no JsonMapper bean #49749
• Metadata annotation processor ignores method-level @NestedConfigurationProperty when using constructor binding #49738
• Override of property in external 'application.properties' or 'application.yaml' is ignored #49731
• NativeImageResourceProvider does not find Flyway migration scripts in subdirectories #49706
• Add @ConditionalOnWebApplication to NettyReactiveWebServerAutoConfiguration #49695
• @GraphQlTest does not include @ControllerAdvice #49672

📔 Documentation

• Fix incorrect indefinite articles in Javadoc #49727
• Add some more Kotlin examples and trivial style fixes #49714
• Overhaul Spring Session documentation following modularization #49704

🔨 Dependency Upgrades

• Upgrade to Brave 6.3.1 #49763
• Upgrade to Jackson 2 Bom 2.21.2 #49764
• Upgrade to jOOQ 3.19.31 #49765
• Upgrade to Netty 4.2.12.Final #49794
• Upgrade to Tomcat 11.0.20 #49767
• Upgrade to Zipkin Reporter 3.5.3 #49762

❤️ Contributors

Thank you to all the contributors who worked on this release:

@Joowon-Seo, @deejay1, @dlwldnjs1009, @kwondh5217, @ljrmorgan, and @quaff

v3.5.13

⚠️ Attention Required

• Jackson has been upgraded to 2.21.2 in response to the Jackson team ending support for Jackson 2.19.x and 2.20.x. #49365

🐞 Bug Fixes

• WebSocket messaging's task executors are only auto-configured and stompWebSocketHandlerMapping is only forced to be eager when using Jackson #49750
• Metadata annotation processor ignores method-level @NestedConfigurationProperty when using constructor binding #49734
• Override of property in external 'application.properties' or 'application.yaml' is ignored #49724
• Some sliced tests that import TransactionAutoConfiguration do not import TransactionManagerCustomizationAutoConfiguration #49716
• NativeImageResourceProvider does not find Flyway migration scripts in subdirectories #49661
• @GraphQlTest does not include @ControllerAdvice #49660

📔 Documentation

• Fix incorrect indefinite articles in Javadoc #49723
• Add some more Kotlin examples and trivial style fixes #49710

🔨 Dependency Upgrades

• Upgrade to Hibernate 6.6.45.Final #49757
• Upgrade to jOOQ 3.19.31 #49758
• Upgrade to Netty 4.1.132.Final #49759
• Upgrade to Tomcat 10.1.53 #49760
• Upgrade to Undertow 2.3.24.Final #49761
• Upgrade to Zipkin Reporter 3.5.3 #49756

❤️ Contributors

Thank you to all the contributors who worked on this release:

@Joowon-Seo, @deejay1, @dlwldnjs1009, and @ljrmorgan

v4.1.0-M3

⚠️ Attention Required

• OpenTelemetry's ZipkinSpanExporter has been deprecated and its support will be removed in Spring Boot 4.2. #49557
• The default value for server.tomcat.max-part-count has been increased from 10 to 50. This aligns it with Tomcat's own default and the default in Spring Boot 3.x. #49312

⭐ New Features

• Introduce Generic AMQP 1.0 client support #49621
• Rename spring-boot-amqp to spring-boot-rabbitmq #49620
• Add support for SslBundles to OTLP metrics export #49590
• Add support for SslBundles to OTLP traces export #49584
• Add support for SslBundles to OTLP logging export #49583
• Add more fine-grained support for selecting metric exemplars #49572
• Add property to disable the OpenTelemetry SDK #49564
• Add properties to select OpenTelemetry's sampler #49548
• Configure BootBuildInfo task created using the DSL as a src dir of the main source set's resources #49547
• Add properties to configure BatchLogRecordProcessor #49543
• Add type-safe binding support for gPRC service config #49540
• Add auto-configuration for OTLP exemplars #49538
• Output Docker Compose's logs when start or up fails #49423
• Provide protobuf gradle plugin support #49369
• Provide protobuf-maven-plugin configuration in the starter parent POM #49353
• Add FailureAnalyzedException to reduce the number of internal FailureAnalyzers required #49320
• Add more styling support to the Logback and Log4j2 color converters #49285
• Create reusable default TaskScheduler configuration #49280
• Update TestRestTemplate's default cookie handling to match RestTemplate's #49261
• Add Spring gRPC server and client observation support #49056
• Fail gRPC servlet applications if server.http2.enabled is not enabled #49050
• Add Spring gRPC Server Health Check Support #49048
• Add Spring gRPC server and client security support #49047
• Add Spring gRPC Testing Support #49046
• Add Spring gRPC Client Support #49045
• Add Spring gRPC Server Support #49044
• Add support for Spring gRPC #49043
• Add builder customizer for SpringOpaqueTokenIntrospector and SpringReactiveOpaqueTokenIntrospector #49029
• Deprecate LiveReload support for removal #48971
• Add SSL support to auto-configuration for RabbitMQ Streams #48960
• Allow empty objects to be loaded from YAML #48958
• Support binding of default properties when an empty property is defined #48920
• Auto-configure Jackson mapper beans with a bean-based HandlerInstantiator #48711
• Add support for auto-configuring ExpressionJwtGrantedAuthoritiesConverter #48490
• Deprecate RootUriTemplateHandler in favor of DefaultUriBuilderFactory #48350
• Add Log4j2 rolling policy configuration #47260
• Enable auto-configuration of OAuth2 resource server machinery in a non-webapp #43978
• Add support for Spring Batch MongoDB #43236

🐞 Bug Fixes

• EndpointRequest request matcher for health groups is too complex #49650
• "/cloudfoundryapplication" web path is not limited to Actuator #49647
• Fix EndpointRequest.toLinks() when base-path is '/' #49618
• Docker fails when a 'tcp://' address ends with a slash (for example 'tcp://docker:2375/') #49597
• RSocket exposes duplicate endpoint for websocket setups #49595
• Failure analysis for a missing mail sender is misleading #49585
• Dependency management for HttpClient5 misses httpclient5-observation #49553
• SpringBootContextLoader mentions class that no longer exists in message for classes or locations assertion #49536
• Missing starter for spring-boot-restdocs #49524
• Ordering of 'spring.config.import' is inconsistent when defined in environment or system properties #49483
• "spring.main.cloud-platform=none" does not disable cloud features #49480
• SSL support with Docker Compose does not work as documented #49386
• NoSuchMethodException when forcing the use of Log4J2LoggingSystem using org.springframework.boot.logging.LoggingSystem system property #49384
• ErrorPageRegistrarBeanPostProcessor is not auto-configured in war deployments and the ErrorPageCustomizer is not applied #49380
• Auto-configuration overrides authorization server configuration applied by Customizer beans #49379
• Using @AutoConfigureWebTestClient prevents separate configuration of spring.test.webtestclient.timeout from taking effect #49345
• Several reactive starters do not depend on spring-boot-reactor #49335
• HTTP Service Interface Client doesn't work in a native image due to missing property binding #49326
• RouterFunctions descriptions in Actuator do not support nesting #49303
• Maven plugin does not set '-parameters' option when processing AOT code #49296

📔 Documentation

• Document support for Java 26 #49605
• List all supported colors when describing color-coded log output #49563
• Improve EndpointRequest matcher documentation #49521
• Clarify that running is the only supported input state when triggering a Quartz job through the Actuator endpoint #49515
• Document security considerations for forwarded headers in cloud deployments #49511
• Tutorial in the reference guide has outdated instructions #49430
• Document additional repositories required for shibboleth.net #49393
• Javadoc of JettyHttpClientBuilder refers to the wrong type #49388
• Example spring-devtools.properties file is shown in the wrong format #49363
• Clarify inferred relationships between OAuth 2 registrations and providers #49328
• Mention using org.springframework.boot.aot Gradle plugin directly for AOT processing with the JVM [#49322](...

v4.0.4

⚠️ Attention Required

• OpenTelemetry's ZipkinSpanExporter has been deprecated and its support will be removed in Spring Boot 4.2. #49453
• Jackson 2 has been upgraded to 2.21.1 in response to the Jackson team ending support for Jackson 2.20.x. #49389
• Jackson has been upgraded to 3.1.0 in response to the Jackson team ending support for Jackson 3.0.x. #49383
• The default value for server.tomcat.max-part-count has been increased from 10 to 50. This aligns it with Tomcat's own default and the default in Spring Boot 3.x. #49311

🐞 Bug Fixes

• EndpointRequest request matcher for health groups is too complex #49649
• "/cloudfoundryapplication" web path is not limited to Actuator #49646
• Fix EndpointRequest.toLinks() when base-path is '/' #49617
• Docker fails when a 'tcp://' address ends with a slash (for example 'tcp://docker:2375/') #49596
• RSocket exposes duplicate endpoint for websocket setups #49593
• Failure analysis for a missing mail sender is misleading #49582
• SpringBootContextLoader mentions class that no longer exists in message for classes or locations assertion #49535
• Ordering of 'spring.config.import' is inconsistent when defined in environment or system properties #49482
• "spring.main.cloud-platform=none" does not disable cloud features #49479
• SSL support with Docker Compose does not work as documented #49385
• Auto-configuration overrides authorization server configuration applied by Customizer beans #49367
• Using @AutoConfigureWebTestClient prevents separate configuration of spring.test.webtestclient.timeout from taking effect #49344
• NoSuchMethodException when forcing the use of Log4J2LoggingSystem using org.springframework.boot.logging.LoggingSystem system property #49343
• RouterFunctions descriptions in Actuator do not support nesting #49302
• Maven plugin does not set '-parameters' option when processing AOT code #49295
• HTTP Service Interface Client doesn't work in a native image due to missing property binding #49274
• ErrorPageRegistrarBeanPostProcessor is not auto-configured in war deployments and the ErrorPageCustomizer is not applied #49176
• Missing starter for spring-boot-restdocs #48289

📔 Documentation

• Document support for Java 26 #49604
• List all supported colors when describing color-coded log output #49562
• Improve EndpointRequest matcher documentation #49520
• Clarify that running is the only supported input state when triggering a Quartz job through the Actuator endpoint #49514
• Document security considerations for forwarded headers in cloud deployments #49507
• Tutorial in the reference guide has outdated instructions #49429
• Document additional repositories required for shibboleth.net #49392
• Javadoc of JettyHttpClientBuilder refers to the wrong type #49387
• Example spring-devtools.properties file is shown in the wrong format #49362
• Clarify inferred relationships between OAuth 2 registrations and providers #49327
• Mention using org.springframework.boot.aot Gradle plugin directly for AOT processing with the JVM #49321
• Remove superfluous semi-colon from read timeout configuration example for HTTP service interface clients #49306
• Update CLI's INSTALL.txt to reflect Groovy no longer being bundled #49298
• JDK requirement for the CLI still refers to Java 8 #49293
• Java and Kotlin samples of an environment post processor are inconsistent #49287

🔨 Dependency Upgrades

• Upgrade to Commons Logging 1.3.6 #49545
• Upgrade to DB2 JDBC 12.1.4.0 #49546
• Upgrade to Elasticsearch Client 9.2.6 #49421
• Upgrade to Hibernate 7.2.7.Final #49608
• Upgrade to Jakarta XML WS 4.0.3 #49469
• Upgrade to JBoss Logging 3.6.3.Final #49632
• Upgrade to Jetty 12.1.7 #49470
• Upgrade to Kafka 4.1.2 #49627
• Upgrade to Liquibase 5.0.2 #49471
• Upgrade to Lombok 1.18.44 #49575
• Upgrade to Maven Failsafe Plugin 3.5.5 #49472
• Upgrade to Maven Shade Plugin 3.6.2 #49473
• Upgrade to Maven Surefire Plugin 3.5.5 #49474
• Upgrade to Micrometer 1.16.4 #49413
• Upgrade to Micrometer Tracing 1.6.4 #49414
• Upgrade to MongoDB 5.6.4 #49422
• Upgrade to Native Build Tools Plugin 0.11.5 #49475
• Upgrade to Neo4j Java Driver 6.0.3 #49431
• Upgrade to Pulsar 4.1.3 #49476
• Upgrade to Reactor Bom 2025.0.4 #49415
• Upgrade to Spring Batch 6.0.3 #49416
• Upgrade to Spring Data Bom 2025.1.4 #49417
• Upgrade to Spring Framework 7.0.6 #49418
• Upgrade to Spring HATEOAS 3.0.3 #49587
• Upgrade to Spring Integration 7.0.4 #49529
• Upgrade to Spring Kafka 4.0.4 #49419
• Upgrade to Spring Pulsar 2.0.4 #49420
• Upgrade to Spring Security 7.0.4 #49530
• Upgrade to Spring WS 5.0.1 #49531
• Upgrade to Testcontainers 2.0.4 #49655

❤️ Contributors

Thank you to all the contributors who worked on this release:

@FBibonne, @answndud, @bbbbooo, @chandanv89, @giyeon95, @itsmevichu, @jayychoi, @l2yujw, @ngocnhan-tran1996, @qnnn, @quaff, and @sbrannen

v3.5.12

🐞 Bug Fixes

• EndpointRequest request matcher for health groups is too complex #49648
• "/cloudfoundryapplication" web path is not limited to Actuator #49645
• RSocket exposes duplicate endpoint for websocket setups #49592
• Fix EndpointRequest.toLinks() when base-path is '/' #49591
• SpringBootContextLoader mentions class that no longer exists in message for classes or locations assertion #49518
• "spring.main.cloud-platform=none" does not disable cloud features #49478
• Using @AutoConfigureWebTestClient prevents separate configuration of spring.test.webtestclient.timeout from taking effect #49340
• Ordering of 'spring.config.import' is inconsistent when defined in environment or system properties #49324
• RouterFunctions descriptions in Actuator do not support nesting #49289
• Maven plugin does not set '-parameters' option when processing AOT code #49268
• SSL support with Docker Compose does not work as documented #49210
• Docker fails when a 'tcp://' address ends with a slash (for example 'tcp://docker:2375/') #49055

📔 Documentation

• List all supported colors when describing color-coded log output #49561
• Clarify that running is the only supported input state when triggering a Quartz job through the Actuator endpoint #49506
• Tutorial in the reference guide has outdated instructions #49411
• Javadoc of JettyHttpClientBuilder refers to the wrong type #49364
• Example spring-devtools.properties file is shown in the wrong format #49357
• Mention using org.springframework.boot.aot Gradle plugin directly for AOT processing with the JVM #49307
• Update CLI's INSTALL.txt to reflect Groovy no longer being bundled #49297
• JDK requirement for the CLI still refers to Java 8 #49290
• Java and Kotlin samples of an environment post processor are inconsistent #49282
• Document additional repositories required for shibboleth.net #49260
• Clarify inferred relationships between OAuth 2 registrations and providers #49240

🔨 Dependency Upgrades

• Upgrade to DB2 JDBC 12.1.4.0 #49544
• Upgrade to Hibernate 6.6.44.Final #49457
• Upgrade to Jakarta XML WS 4.0.3 #49458
• Upgrade to JBoss Logging 3.6.3.Final #49630
• Upgrade to Jetty 12.0.33 #49459
• Upgrade to Kafka 3.9.2 #49460
• Upgrade to Lombok 1.18.44 #49574
• Upgrade to Maven Failsafe Plugin 3.5.5 #49461
• Upgrade to Maven Shade Plugin 3.6.2 #49462
• Upgrade to Maven Surefire Plugin 3.5.5 #49463
• Upgrade to Micrometer 1.15.10 #49403
• Upgrade to Micrometer Tracing 1.5.10 #49404
• Upgrade to Pulsar 4.0.9 #49464
• Upgrade to Reactor Bom 2024.0.16 #49405
• Upgrade to Spring Batch 5.2.5 #49406
• Upgrade to Spring Data Bom 2025.0.10 #49407
• Upgrade to Spring Framework 6.2.17 #49408
• Upgrade to Spring HATEOAS 2.5.2 #49586
• Upgrade to Spring Integration 6.5.8 #49631
• Upgrade to Spring Kafka 3.3.14 #49409
• Upgrade to Spring Pulsar 1.2.16 #49410
• Upgrade to Spring Security 6.5.9 #49527
• Upgrade to Spring WS 4.1.3 #49528

❤️ Contributors

Thank you to all the contributors who worked on this release:

@bbbbooo, @chandanv89, @itsmevichu, @jayychoi, @l2yujw, @ngocnhan-tran1996, @qnnn, @quaff, and @sbrannen

v4.1.0-M2

⭐ New Features

• Add support for publishMaxGaugeForHistograms in OtlpRegistry #49242
• Add TWENTY_SIX to JavaVersion enum #49194
• Support service connections with RabbitMQ Stream and Docker Compose #49162
• Bind 'Optional' value object parameters as empty rather than null #49152
• Add Kotlin DSL extension functions for TestEntityManager #49063
• Add customizers for OtlpHttpLogRecordExporterBuilder and OtlpGrpcLogRecordExporterBuilder #49002
• Improve performance of structure logging 'ContextPairs' nested name splitting #48999
• Show certificates from truststore in SSL info endpoint #48967
• Add time, locale, and work dir data to ProcessInfo #48959
• Add compression mode OTLP property #48957
• Provide support for adding to the mime types that are compressed #48930
• Support service connections with RabbitMQ Streams and Testcontainers #42443
• Provide configuration properties and customizers for configuring Jackson's factories #34709
• Provide a configuration option to load properties config data files as UTF-8 #28663

🐞 Bug Fixes

• Jackson properties may not be applied correctly to RestClients #49250
• Using the OTel and Zipkin starters together creates invalid configuration #49215
• ClassNotFoundException when using Actuator without spring-boot-health #49198
• Whitespace can be incorrectly removed when spring-boot-configuration-processor runs on multi-line javadoc #49061
• Slice test includes fail to load when using spring-boot-starter-test-classic #49042
• Java version requirement check for native image is confusing if AOT didn't run #49025
• Jackson2HttpMessageConvertersConfiguration uses ConditionOn Jackson3 XMLMapper class #49016
• TestPropertyValues.Pair.fromMapEntry(Entry<String, String>) does not comply with its nullability contract #48991
• server.jetty.threads.max is ignored when using virtual threads #48990
• Docker credential helpers with file extensions cannot be executed on Windows #48980

📔 Documentation

• Couchbase and Kafka are incorrectly listed as supporting SSL with Docker Compose #49213
• Document that use of non idiomatic format for '@Value' still apply for environment variables #49110
• Document naming convention for custom test-scoped starters #49018
• Delay removal of Jackson 2 support until 4.3 at the earliest #49011
• LICENSE.txt and NOTICE.txt files have the wrong content in the latest releases #49004
• ApplicationContextAssert documents a non-existent assertion in getFailure() #48978
• Update the configuration metadata changelog to include properties whose default values have changed #48962
• Highlight the importance of the preStop hook when configuring Kubernetes probes #48947

🔨 Dependency Upgrades

• Upgrade to ActiveMQ 6.2.1 #49254
• Upgrade to Artemis 2.51.0 #49203
• Upgrade to AssertJ 3.27.7 #49124
• Upgrade to Byte Buddy 1.18.5 #49235
• Upgrade to Commons Codec 1.21.0 #49125
• Upgrade to Couchbase Client 3.11.1 #49252
• Upgrade to Elasticsearch Client 9.2.5 #49177
• Upgrade to Flyway 11.20.3 #49127
• Upgrade to Flyway 12.0.1 #49255
• Upgrade to Groovy 5.0.4 #49128
• Upgrade to Hibernate 7.2.4.Final #49180
• Upgrade to HttpCore5 5.4.1 #49181
• Upgrade to Jaybird 6.0.4 #49130
• Upgrade to JBoss Logging 3.6.2.Final #49131
• Upgrade to Jedis 7.2.1 #49227
• Upgrade to Jersey 4.0.2 #49132
• Upgrade to Jetty 12.1.6 #49133
• Upgrade to jOOQ 3.20.11 #49134
• Upgrade to JUnit Jupiter 6.0.3 #49236
• Upgrade to Kafka 4.2.0 #49258
• Upgrade to Kotlin 2.3.10 #49135
• Upgrade to Lettuce 7.2.1.RELEASE #49228
• Upgrade to Logback 1.5.32 #49248
• Upgrade to Maven Compiler Plugin 3.15.0 #49137
• Upgrade to Maven Dependency Plugin 3.10.0 #49172
• Upgrade to Micrometer 1.17.0-M2 #49173
• Upgrade to Micrometer Tracing 1.7.0-M3 #49174
• Upgrade to MongoDB 5.6.3 #49138
• Upgrade to MySQL 9.6.0 #49139
• Upgrade to Netty 4.2.10.Final #49140
• Upgrade to OpenTelemetry 1.58.0 #49141
• Upgrade to Oracle Database 23.26.1.0.0 #49142
• Upgrade to Postgresql 42.7.10 #49204
• Upgrade to Prometheus Client 1.5.0 #49256
• Upgrade to R2DBC MariaDB 1.4.0 #49257
• Upgrade to Rabbit Stream Client 1.5.0 #49182
• Upgrade to Reactor Bom 2025.0.3 #49113
• Upgrade to Spring AMQP 4.1.0-M2 #49114
• Upgrade to Spring Data 2026.0.0-M1 #49229
• Upgrade to Spring Framework 7.0.5 #49218
• Upgrade to Spring Integration 7.1.0-M2 #49117
• Upgrade to Spring Kafka 4.1.0-M1 #49118
• Upgrade to Spring LDAP 4.1.0-M1 #49119
• Upgrade to Spring Pulsar 2.0.3 #49120
• Upgrade to Spring Security 7.1.0-M2 #49121
• Upgrade to Spring Session 4.1.0-M1 #49145
• Upgrade to SQLite JDBC 3.51.2.0 #49175
• Upgrade to Tomcat 11.0.18 #49143

❤️ Contributors

Thank you to all the contributors who worked on this release:

@GaetanoCerciello, @aalsanie, @dj258255, @dsyer, @eddumelendez, @garvit-joshi, @jdsalasca, @joaquinjsb, @jonatan-ivanov, @junpakPark, @linkian209, @nosan, @osvetlik, @quaff, @scordio, @shakuzen, and @srt