Skip to content

[backend] chore(deps): update spring boot to v4 (major) #4561

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
renovate wants to merge 1 commit into
base: master
Choose a base branch
from
Open

[backend] chore(deps): update spring boot to v4 (major) #4561

renovate wants to merge 1 commit into from
+3 −3

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Dec 13, 2025 •
edited
Loading

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
org.springframework.boot:spring-boot-starter-oauth2-client (source) 3.2.11 → 4.0.2 age confidence
org.springframework.boot:spring-boot-starter-security (source) 3.2.11 → 4.0.2 age confidence
org.springframework.boot:spring-boot-starter-parent (source) 3.3.7 → 4.0.2 age confidence

Release Notes

spring-projects/spring-boot (org.springframework.boot:spring-boot-starter-oauth2-client)

v4.0.2

⚠️ Noteworthy Changes

  • The dependency on org.eclipse.jetty.ee11:jetty-ee11-servlets has been removed from spring-boot-jetty as it was unnecessary and unused. If your application code depends on a class from jetty-ee11-servlets, declare a dependency on it in your build configuration. #​48677

🐞 Bug Fixes

  • No TransactionAutoConfiguration with spring-boot-starter-kafka for Spring Boot 4 #​48880
  • Evaluation of bean conditions unnecessarily queries the bean factory for types that are not present #​48840
  • When a bean condition references a type that is not present, it appears as ? in the condition evaluation report #​48838
  • SessionAutoConfiguration creates a DefaultCookieSerializer with a default SameSite of null instead of Lax #​48830
  • Setting graphql schema location to "classpath*:graphql/**/" causes failure due to incorrectly packaged test resource #​48829
  • Message interpolation by MVC and WebFlux's Validators does not work correctly in a native image #​48828
  • CloudFoundry integration fails in Servlet-based web app without a dependency on spring-boot-starter-restclient #​48826
  • RestTestClientAutoConfiguration and TestRestTemplateAutoConfiguration should be package-private #​48820
  • SSL metrics are no longer auto-configured #​48819
  • Actuator /info endpoint fails in Java 25 Native Image (VirtualThreadSchedulerMXBean support) #​48812
  • DataSourceBuilder cannot create oracle.ucp.jdbc.PoolDataSourceImpl in a native image #​48703
  • The spring-boot-cloudfoundry module should only have an optional dependency on spring-boot-security #​48685
  • Application JAR created by extract command is not reproductible #​48678
  • AOT processing of tests should not be disabled when 'skipTests' is set #​48662
  • @SpringBootTest(webEnvironment = WebEnvironment.RANDOM_PORT) is no longer applied to the management server #​48653
  • Fix zero-length byte buffer in InspectedContent #​48650
  • Can no longer override JacksonJsonHttpMessageConverter with ServerHttpMessageConvertersCustomizer #​48635
  • HttpServiceClientProperties incorrectly uses the @ConfigurationProperties annotation on a LinkedHashMap class #​48616
  • spring-boot-micrometer-tracing-opentelemetry fails if spring-boot-opentelemetry isn't there #​48585
  • App fails to start with starter-webmvc and starter-zipkin #​48581
  • Micrometer test modules should have an api dependency on micrometer-observation-test #​48386

📔 Documentation

  • Fix typo in REST client documentation #​48907
  • Remove duplicate word #​48874
  • Document support for configuring arguments passed to Docker Compose #​48806
  • The documentation related to EnvironmentPostProcessor links to deprecated interface #​48803
  • Update documentation for Buildpack's AOT Cache support #​48769
  • Correct docs to use new location for error handling configuration properties #​48767
  • Document spring-boot-starter-cloudfoundry on Cloud Foundry Support Page #​48675
  • Clarify javadoc to make it clear that HazelcastConfigCustomizer beans are only applied if Hazelcast is configured via a config file #​48659
  • Example using excludeDevtools property should document that optional dependencies should be enabled #​48641
  • Fix grammar and typos in the reference guide #​48601
  • Update Tracing section for Spring Boot 4's modularity #​48576

🔨 Dependency Upgrades

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​GaoSSR, @​ShaunHaldane, @​Zuohuang-Cai, @​izeye, @​mspiess, @​ngocnhan-tran1996, and @​philipbolting

v4.0.1

⚠️ Noteworthy Changes

  • Hibernate has been upgraded to 7.2.0.Final in response to Hibernate 7.1 moving to limited support
  • spring-boot-starter-kotlin-serialization has been renamed to to spring-boot-starter-kotlinx-serialization-json and spring-boot-starter-kotlin-serialization-test has been renamed to spring-boot-starter-kotlinx-serialization-json-test. This change aligns the starters' names with those of their respective modules
  • Using TestRestTemplate now requires a dependency on spring-boot-restclient

🐞 Bug Fixes

  • JsonMixinModuleEntriesBeanRegistrationAotProcessor does not handle deprecated code #​48564
  • JdbcSessionAutoConfiguration may not match when using the auto-configured DataSource #​48552
  • @ServiceConnection for LgtmStackContainer fails when logging endpoint is configured due to multiple OtlpLoggingConnectionDetails beans #​48536
  • WebApplicationType does not consider modules when deduced from classpath #​48517
  • Spring Session auto-configuration fails in a war deployment as ServerProperties is not available #​48493
  • Opentelemetry logging export requires actuator module #​48488
  • RabbitHealthIndicator reports an error when version is missing from the connection's server properties #​48487
  • Actuator Info class has inconsistent nullability annotations and cannot be built with null value #​48480
  • Profiles retained during AOT processing are not configured in a native image #​48476
  • Security matchers and WebServerNamespace resolution can fail with NoClassDefFoundError when used in a traditional WAR deployment #​48388
  • HealthEndpointGroupMembershipValidator does not consider reactive health indicators causing NoSuchHealthContributorException to be thrown #​48387
  • spring.jackson.default-property-inclusion is not applied to content inclusion #​48343
  • TestRestTemplate.getRootUri() returns empty string #​48330
  • Redis health check reports an error when redis_version is missing from the INFO response #​48328
  • Parent's MeterRegistry beans are closed when child context closes #​48325
  • HttpMessageConverters picks up converter beans for both client and server #​48310
  • Conditions to auto-configure a RestClient are outdated with the modularization #​48308
  • A custom JwtTypeValidator that replaces the default can no longer be configured #​48301
  • PropertiesRestClientHttpServiceGroupConfigurer has highest precedence, preventing other configurers from being ordered ahead of it #​48296
  • SpringBootTest.UseMainMethod.WHEN_AVAILABLE and ALWAYS are incompatible with package-private or parameter-less main method #​48275
  • Conditions to auto-configure RestClient-based HTTP service clients are outdated with the modularization #​48274
  • Starter for Kotlinx Serialization Json is misnamed #​48262
  • ApplicationServletEnvironment is no longer configured in war deployments #​48254
  • RestClient.Builder bean present in @SpringBootTest due to spring-boot-starter-webmvc-test, but missing at runtime without restclient starter #​48253
  • ProblemDetail is rendered to XML incorrectly #​48222

📔 Documentation

  • Harmonize Kotlin example for HTTP Service client support #​48577
  • Document HttpMessageConverters detection changes in 4.0.1 #​48574
  • Improve javadoc for when to use class names rather than class references #​48569
  • Documentation has an outdated reference to the Jackson Kotlin Module #​48534
  • Caching documentation should clarify how to use a no-op implementation to run a test suite #​48532
  • Document that the default rolling policy for Log4j2 requires logging.file.path to be set #​48527
  • Review documentation and migration guide about changes in @AutoConfigureCache #​48522
  • License header in build samples is displayed in the reference documentation #​48478
  • Configuring Two DataSources How-To code sample is inconsistent #​48449
  • Fix links to source files on GitHub #​48398
  • Documentation contains broken links to GitHub source files #​48394
  • Document that org.aspectj.weaver.Advice must be on the classpath to enable support for Micrometer's annotations #​48360
  • Correct the annotation in the Kotlin @ConfigurationPropertiesSource example #​48357
  • Polish TestRestTemplate examples in the reference guide #​48336
  • Documentation missing for LocalTestWebServer #​48333
  • Update "Creating Your Own Starter" following modularisation #​48317
  • Fix links to javadoc in the reference documentation #​48300
  • Update references for RestTemplateCustomizer and RestTemplateBuilder classes in documentation #​48295
  • Remove modules section of the README following modularisation #​48291
  • Wrong number in Graceful Shutdown chapter #​48284
  • Mention new spring-boot-h2console module when describing how to use H2 Console #​48278
  • Clarify that @EnableBatchProcessing turns off all batch auto-configuration, including schema initialization #​48266
  • Documented replacements for spring.jackson.generator and spring.jackson.parser are inverted #​48255
  • Document the need for a JdbcDialect bean when using Spring Data JDBC and AOT #​48240
  • Update reference documentation as Spring Batch's resourceless infrastructure means that it no longer always requires a DataSource #​48233
  • Kotlin auto-configuration examples are not annotated with @AutoConfiguration #​48228
  • Revise "Use Liquibase for test-only migrations" section in reference manual #​48219
  • Infinispan Cache Documentation is outdated #​48218
  • Removed max-attempts properties metadata don't have replacement #​48206
  • Polish documentation on testing web applications and the various testing clients that are available #​47948

🔨 Dependency Upgrades

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​Nhahan, @​arey, @​banseok1216, @​berry120, @​candrews, @​dmitrysulman, @​geopark021, @​hktechn0, @​igslznev, @​jwalter, @​kzander91, @​michaldo, @​mzeijen, @​ngocnhan-tran1996, @​noojung, @​scottfrederick, @​vpavic, and @​youngledo

v4.0.0

Full release notes for Spring Boot 4.0 are available on the wiki. There is also a migration guide to help you upgrade from Spring Boot 3.5.

⭐ New Features

  • Change tomcat and jetty runtime modules to starters #​48175
  • Rename spring-boot-kotlin-serialization to align with the name of the Kotlinx module that it pulls in #​48076

🐞 Bug Fixes

  • Error properties are a general web concern and should not be located beneath server.* #​48201
  • With both Jackson 2 and 3 on the classpath, @JsonTest fails due to duplicate jacksonTesterFactoryBean #​48198
  • Gradle war task does not exclude starter POMs from lib-provided #​48197
  • spring.test.webclient.mockrestserviceserver.enabled is not aligned with its module's name #​48193
  • SslMeterBinder doesn't register metrics for dynamically added bundles if no bundles exist at bind time #​48182
  • Properties bound in the child management context ignore the parent's environment prefix #​48177
  • ssl.chain.expiry metrics doesn't update for dynamically registered SSL bundles #​48171
  • Starter for spring-boot-micrometer-metrics is missing #​48161
  • Elasticsearch client's sniffer functionality should not be enabled by default #​48155
  • spring-boot-starter-elasticsearch should depend on elasticsearch-java #​48141
  • Auto-configuration exclusions are checked using a different class loader to the one that loads auto-configuration classes #​48132
  • New arm64 macbooks fail to bootBuildImage due to incorrect platform image #​48128
  • Properties for configuring an isolated JsonMapper or ObjectMapper are incorrectly named #​48116
  • Buildpack fails with recent Docker installs due to hardcoded version in URL #​48103
  • Image building may fail when specifying a platform if an image has already been built with a different platform #​48099
  • Default values of Kotlinx Serialization JSON configuration properties are not documented #​48097
  • Custom XML converters should override defaults in HttpMessageConverters #​48096
  • Kotlin serialization is used too aggressively when other JSON libraries are available #​48070
  • PortInUseException incorrectly thrown on failure to bind port due to Netty IP misconfiguration #​48059
  • Auto-configured JCacheMetrics cannot be customized #​48057
  • WebSecurityCustomizer beans are excluded by WebMvcTest #​48055
  • Deprecated EnvironmentPostProcessor does not resolve arguments #​48047
  • RetryPolicySettings should refer to maxRetries, not maxAttempts #​48023
  • Devtools Restarter does not work with a parameterless main method #​47996
  • Dependency management for Kafka should not manage Scala 2.12 libraries #​47991
  • spring-boot-mail should depend on jakarta.mail:jakarta.mail-api and org.eclipse.angus:angus-mail instead of org.eclipse.angus:jakarta.mail #​47983
  • spring-boot-starter-data-mongodb-reactive has dependency on reactor-test #​47982
  • Support for ReactiveElasticsearchClient is in the wrong module #​47848

📔 Documentation

  • Removed property spring.test.webclient.register-rest-template is still documented #​48199
  • Mention support for detecting AWS ECS in "Deploying to the Cloud" #​48170
  • Revise AWS section of "Deploying to the Cloud" in reference manual #​48163
  • Fix typo in PortInUseException Javadoc #​48134
  • Correct section about required setters in "Type-safe Configuration Properties" #​48131
  • Use since attribute in configuration properties deprecation consistently #​48122
  • Document EndpointJsonMapper and management.endpoints.jackson.isolated-json-mapper #​48115
  • Document support for configuring servlet context init parameters using properties #​48112
  • Some configuration properties are not documented in the appendix #​48095
  • Clarify how warnings about soon-to-expire SSL certificates are reported #​48063
  • Document how to use ContextPropagatingTaskDecorator for propagating trace context over thread boundaries #​48053
  • Document the level of support for the OpenTelemetry APIs #​47960
  • Document that you need to build with Java 25 for buildpack build-image Graal support #​45501

🔨 Dependency Upgrades

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​K-jun98, @​TerryTaoYY, @​filiphr, @​hojooo, @​linw-bai, @​nosan, @​scottfrederick, @​stevearmstrong-dev, @​stewue, and @​vpavic

v3.5.10

🐞 Bug Fixes
  • Evaluation of bean conditions unnecessarily queries the bean factory for types that are not present #​48836
  • When a bean condition references a type that is not present, it appears as ? in the condition evaluation report #​48835
  • Actuator /info endpoint fails in Java 25 Native Image (VirtualThreadSchedulerMXBean support) #​48810
  • DataSourceBuilder cannot create oracle.ucp.jdbc.PoolDataSourceImpl in a native image #​48702
  • Application JAR created by extract command is not reproductible #​48664
  • AOT processing of tests should not be disabled when 'skipTests' is set #​48661
  • Fix zero-length byte buffer in InspectedContent #​48649
📔 Documentation
  • Update documentation for Buildpack's AOT Cache support #​48768
  • Document support for configuring arguments passed to Docker Compose #​48657
  • Clarify javadoc to make it clear that HazelcastConfigCustomizer beans are only applied if Hazelcast is configured via a config file #​48634
  • Fix grammar and typos in the reference guide #​48596
🔨 Dependency Upgrades
❤️ Contributors

Thank you to all the contributors who worked on this release:

@​GaoSSR, @​izeye, and @​ngocnhan-tran1996

v3.5.9

Compare Source

🐞 Bug Fixes
  • RabbitHealthIndicator reports an error when version is missing from the connection's server properties #​48486
  • Profiles retained during AOT processing are not configured in a native image #​48475
  • NullPointerException in UndertowWebServer.destroy() when using @DirtiesContext and Citrus Spring Boot Simulator #​48450
  • Redis health check reports an error when redis_version is missing from the INFO response #​48326
  • Parent's MeterRegistry beans are closed when child context closes #​48324
  • SpringBootTest.UseMainMethod.WHEN_AVAILABLE and ALWAYS are incompatible with package-private or parameter-less main method #​48271
📔 Documentation
  • Documentation has an outdated reference to the Jackson Kotlin Module #​48533
  • Caching documentation should clarify how to use a no-op implementation to run a test suite #​48531
  • Document that the default rolling policy for Log4j2 requires logging.file.path to be set #​48526
  • License header in build samples is displayed in the reference documentation #​48477
  • Configuring Two DataSources How-To code sample is inconsistent #​48448
  • Improve javadoc for when to use class names rather than class references #​48395
  • Document that org.aspectj.weaver.Advice must be on the classpath to enable support for Micrometer's annotations #​48359
  • Polish TestRestTemplate examples in the reference guide #​48335
  • Fix links to javadoc in the reference documentation #​48299
  • Clarify that @EnableBatchProcessing turns off all batch auto-configuration, including schema initialization #​48265
  • Kotlin auto-configuration examples are not annotated with @AutoConfiguration #​48227
  • Infinispan Cache Documentation is outdated #​48217
  • Revise "Use Liquibase for test-only migrations" section in reference manual #​48169
🔨 Dependency Upgrades
❤️ Contributors

Thank you to all the contributors who worked on this release:

@​banseok1216, @​berry120, @​dmitrysulman, @​geopark021, @​noojung, @​scottfrederick, @​vpavic, and @​youngledo

v3.5.8

Compare Source

⚠️ Noteworthy changes

🐞 Bug Fixes

  • Gradle war task does not exclude starter POMs from lib-provided #​48196
  • Testcontainers integration fails on Docker 29.0.0 #​48192
  • SslMeterBinder doesn't register metrics for dynamically added bundles if no bundles exist at bind time #​48180
  • Properties bound in the child management context ignore the parent's environment prefix #​48176
  • ssl.chain.expiry metrics doesn't update for dynamically registered SSL bundles #​48153
  • Auto-configuration exclusions are checked using a different class loader to the one that loads auto-configuration classes #​48129
  • New arm64 macbooks fail to bootBuildImage due to incorrect platform image #​48127
  • NullPointerException when using @ConditionalOnSingleCandidate with multiple manually registered singletons #​48123
  • Buildpack fails with recent Docker installs due to hardcoded version in URL #​48102
  • Image building may fail when specifying a platform if an image has already been built with a different platform #​48098
  • Undertow's ServletContext is destroy too early, making it unusable in @PreDestroy methods #​48061
  • PortInUseException incorrectly thrown on failure to bind port due to Netty IP misconfiguration #​48058
  • Auto-configured JCacheMetrics cannot be customized #​48056
  • WebSecurityCustomizer beans are excluded by WebMvcTest #​48054
  • Devtools Restarter does not work with a parameterless main method #​47987
  • Setting 'max-uri-tags' does not prevent unlimited meter growth on any AutoConfiguredCompositeMeterRegistry #​47923
  • Docker response 407 is not handled correctly resulting in no error message #​47900
  • spring-boot-maven-plugin process-aot goal does not find package-private main method #​47780

📔 Documentation

  • Revise AWS section of "Deploying to the Cloud" in reference manual #​48156
  • Fix typo in PortInUseException Javadoc #​48133
  • Correct section about required setters in "Type-safe Configuration Properties" #​48130
  • Document EndpointObjectMapper and management.endpoints.jackson.isolated-object-mapper #​48114
  • Document support for configuring servlet context init parameters using properties #​48111
  • Clarify how warnings about soon-to-expire SSL certificates are reported #​48062
  • Document how to use ContextPropagatingTaskDecorator for propagating trace context over thread boundaries #​48052
  • Use since attribute in configuration properties deprecation consistently #​47980
  • BootstrapContext#getOrElseThrow has incorrect reference to IllegalStateException #​47905
  • Clarify when BootstrapContext get methods may return null rather than throwing an exception or calling the fallback supplier #​47898
  • Document that Actuator endpoint may have at most one extension of each type #​47873
  • Limit Kotlin API documentation to Kotlin-specific APIs #​47859
  • Adapt AOTCache documentation to JEP 514 #​47274

🔨 Dependency Upgrades

Configuration

📅 Schedule: Branch creation - At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday ( * 0-4,22-23 * * 1-5 ), Only on Sunday and Saturday ( * * * * 0,6 ) in timezone Europe/Paris, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot added dependencies use for pull requests that update a dependency file filigran team use to identify PR from the Filigran team labels Dec 13, 2025
@renovate renovate bot force-pushed the renovate/major-spring-boot branch from 0b9bd01 to a4b9e06 Compare December 21, 2025 20:54
@renovate renovate bot force-pushed the renovate/major-spring-boot branch from a4b9e06 to 83432fe Compare January 30, 2026 22:09
@renovate renovate bot force-pushed the renovate/major-spring-boot branch from 83432fe to 600b84d Compare February 2, 2026 21:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies use for pull requests that update a dependency file filigran team use to identify PR from the Filigran team

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants