Upgrading org.springframework.boot:spring-boot-dependencies 2 to 3
Breaking2.7.18 → 3.5.16Breaking2Security2Deprecated3New22Changed2369Fixed1080Other855
BreakingUpgrade verdict
2 breaking changes and 2 security fixes.
In plain terms
- The old spring.http.client properties are gone, and the reactive client settings property moved to a shorter name.
- Two starters no longer pull in AOP support automatically, so add it yourself if you relied on it.
- Mail sending now verifies the server's hostname, making connections harder to intercept.
- The default error page now escapes the timestamp to prevent HTML injection.
Must act Top 5 of 7 that need code or config changes
What you must change
Breaking2
Removes the 'spring.http.client' deprecation and renames 'spring.http.reactiveclient.settings' to 'spring.http.reactiveclient'.
spring.http.clientspring.http.reactiveclient.settingsspring.http.reactiveclientRemoves spring-boot-starter-aop dependency from spring-boot-starter-data-jpa and spring-boot-starter-integration.
spring-boot-starter-aopspring-boot-starter-data-jpaspring-boot-starter-integrationSecurity2
MailSender auto-configuration now enables hostname verification.
MailSenderApplies HTML escaping to the timestamp attribute in the Whitelabel error page.
Deprecations to plan for
Deprecated3
Adapts the deprecation level for management.health.influxdb.enabled.
management.health.influxdb.enabledDeprecates remaining @ControllerEndpoint and @RestControllerEndpoint infrastructure.
@ControllerEndpoint@RestControllerEndpointDeprecates remaining @ControllerEndpoint and @RestControllerEndpoint infrastructure.
@ControllerEndpoint@RestControllerEndpoint